From 034dd340b08be1f2f0477ad16131d609f9dbd53c Mon Sep 17 00:00:00 2001 From: Linus Torvalds Date: Sun, 30 Aug 2026 09:22:00 -0700 Subject: Merge tag 'trace-v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix error output of boot instance creation failure Currently if a boot instance creation fails, instead of printing out the name of the instance that failed, it prints "(null)". That is because it prints "cur_str" that had already been processed by strsep(). Print the saved name instead. While at it, print the error code of the failure. - Fix use-after-free for same named historgrams Histograms can be named so that they can be used in multiple events. But if the named histogram has a variable attached, the second event that uses the named histogram which duplicates it and needs to free the original after duplication leaves the old variable in place and still visible. If another histogram uses than variable, it will use the stale one which will try to reference the freed duplicate histogram and crash the kernel. Free the duplicate variables along with the duplicated histogram data. - Check return value of kthread_run() in event self test The events self tests uses a kthread for testing but does not check if it succeeded in creating a kthread. If the kthread creation were to fail, the code will still try to call kthread_stop() on the error returned. - Fix race between reading trace_pipe and updating subbuffer size If a user is reading the trace_pipe file at the same time they update the ring buffer sub-buffer size, can cause the trace_pipe read to read stale data. Add trace_access_lock() around updating the ring buffer sub-buffer size. - Fix eventfs_inode on failure path in creation of the events directory In the creation of the "events" directory, if after allocating the eventfs_inode a failure is detected, it calls cleanup_ei() which calls free_ei(). The free_ei() will test if eventfs_inode being freed has no children. It is a bug if it does. But on the failure case of the creation of the "events" directory, the children lists have not yet been initialized and the free will trigger a warning because list_empty() on an uninitialized list returns false. Move the initialization into init_ei() where it makes more sense and makes sure that a created eventfs_inode has its lists initialized upon creation. - Check return value of kthread_run() in ftrace direct sample code The sample code that shows how to use the ftrace direct calls does not test the return of kthread_run() to see if it succeeds. Return a failure if the kthread_run() doesn't succeed. - Clear user events state on fork in case of alloc failure On fork, the child gets a pointer to the parent's user events state. It makes a copy of it then updates the child's pointer to it. But if the allocation fails, the duplication function leaves the child with a pointer to its parent's descriptor. When the child cleans up its data, it will free the parent's descriptor while the parent is still using it. In the duplication function, set the child's user_event_mm to NULL before testing if the allocation succeeded, and when it exits it will not free the parent's descriptor. - Fix retry exhaustion in simple ring buffer reader swap simple_ring_buffer_swap_reader_page() starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement leaves retry at zero, while a failed replacement leaves it at -1. But the check for success expects the retry value to be non-zero and exits with an error on zero. This is the opposite result. Fix it. - Fail nicely when the remote swap_reader_page() returns an error Currently, if the swap_reader_page() of a remote buffer fails, it triggers a WARN_ON_ONCE() and continues normally. Instead, have it exit with an error and a pr_warn() print instead of a full WARNING. * tag 'trace-v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ring-buffer: Stop remote reader update when page swap fails tracing: Fix retry exhaustion in simple ring buffer reader swap tracing/user_events: Clear copied tracing state before fork duplication samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify eventfs: Initialize ei->children and ei->list in init_ei() tracing: Fix use-after-free in trace_pipe read on sub-buffer order change tracing: Fix crash passing ERR_PTR to kthread_stop() tracing: Fix use-after-free with same-name named triggers tracing: Fix logged instance name on creation failure --- fs/mpage.c | 693 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 693 insertions(+) create mode 100644 fs/mpage.c (limited to 'fs/mpage.c') diff --git a/fs/mpage.c b/fs/mpage.c new file mode 100644 index 000000000..f02d8ebd7 --- /dev/null +++ b/fs/mpage.c @@ -0,0 +1,693 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * fs/mpage.c + * + * Copyright (C) 2002, Linus Torvalds. + * + * Contains functions related to preparing and submitting BIOs which contain + * multiple pagecache pages. + * + * 15May2002 Andrew Morton + * Initial version + * 27Jun2002 axboe@suse.de + * use bio_add_page() to build bio's just the right size + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include "internal.h" + +/* + * I/O completion handler for multipage BIOs. + * + * The mpage code never puts partial pages into a BIO (except for end-of-file). + * If a page does not map to a contiguous run of blocks then it simply falls + * back to block_read_full_folio(). + * + * Why is this? If a page's completion depends on a number of different BIOs + * which can complete in any order (or at the same time) then determining the + * status of that page is hard. See end_buffer_async_read() for the details. + * There is no point in duplicating all that complexity. + */ +static void mpage_read_end_io(struct bio *bio) +{ + struct folio_iter fi; + int err = blk_status_to_errno(bio->bi_status); + + bio_for_each_folio_all(fi, bio) + folio_end_read(fi.folio, err == 0); + + bio_put(bio); +} + +static void mpage_write_end_io(struct bio *bio) +{ + struct folio_iter fi; + int err = blk_status_to_errno(bio->bi_status); + + bio_for_each_folio_all(fi, bio) { + if (err) + mapping_set_error(fi.folio->mapping, err); + folio_end_writeback(fi.folio); + } + + bio_put(bio); +} + +static struct bio *mpage_bio_submit_read(struct bio *bio) +{ + bio->bi_end_io = mpage_read_end_io; + guard_bio_eod(bio); + submit_bio(bio); + return NULL; +} + +static struct bio *mpage_bio_submit_write(struct bio *bio) +{ + bio->bi_end_io = mpage_write_end_io; + guard_bio_eod(bio); + submit_bio(bio); + return NULL; +} + +/* + * support function for mpage_readahead. The fs supplied get_block might + * return an up to date buffer. This is used to map that buffer into + * the page, which allows read_folio to avoid triggering a duplicate call + * to get_block. + * + * The idea is to avoid adding buffers to pages that don't already have + * them. So when the buffer is up to date and the page size == block size, + * this marks the page up to date instead of adding new buffers. + */ +static void map_buffer_to_folio(struct folio *folio, struct buffer_head *bh, + int page_block) +{ + struct inode *inode = folio->mapping->host; + struct buffer_head *page_bh, *head; + int block = 0; + + head = folio_buffers(folio); + if (!head) { + /* + * don't make any buffers if there is only one buffer on + * the folio and the folio just needs to be set up to date + */ + if (inode->i_blkbits == folio_shift(folio) && + buffer_uptodate(bh)) { + folio_mark_uptodate(folio); + return; + } + head = create_empty_buffers(folio, i_blocksize(inode), 0); + } + + page_bh = head; + do { + if (block == page_block) { + page_bh->b_state = bh->b_state; + page_bh->b_bdev = bh->b_bdev; + page_bh->b_blocknr = bh->b_blocknr; + break; + } + page_bh = page_bh->b_this_page; + block++; + } while (page_bh != head); +} + +struct mpage_readpage_args { + struct bio *bio; + struct folio *folio; + unsigned int nr_pages; + bool is_readahead; + sector_t last_block_in_bio; + struct buffer_head map_bh; + unsigned long first_logical_block; + get_block_t *get_block; +}; + +/* + * This is the worker routine which does all the work of mapping the disk + * blocks and constructs largest possible bios, submits them for IO if the + * blocks are not contiguous on the disk. + * + * We pass a buffer_head back and forth and use its buffer_mapped() flag to + * represent the validity of its disk mapping and to decide when to do the next + * get_block() call. + */ +static void do_mpage_readpage(struct mpage_readpage_args *args) +{ + struct folio *folio = args->folio; + struct inode *inode = folio->mapping->host; + const unsigned blkbits = inode->i_blkbits; + const unsigned blocks_per_folio = folio_size(folio) >> blkbits; + const unsigned blocksize = 1 << blkbits; + struct buffer_head *map_bh = &args->map_bh; + sector_t block_in_file; + sector_t last_block; + sector_t last_block_in_file; + sector_t first_block; + unsigned page_block; + unsigned first_hole = blocks_per_folio; + struct block_device *bdev = NULL; + int length; + int fully_mapped = 1; + blk_opf_t opf = REQ_OP_READ; + unsigned nblocks; + unsigned relative_block; + gfp_t gfp = mapping_gfp_constraint(folio->mapping, GFP_KERNEL); + + if (args->is_readahead) { + opf |= REQ_RAHEAD; + gfp |= __GFP_NORETRY | __GFP_NOWARN; + } + + if (folio_buffers(folio)) + goto confused; + + block_in_file = folio_pos(folio) >> blkbits; + last_block = block_in_file + ((args->nr_pages * PAGE_SIZE) >> blkbits); + last_block_in_file = (i_size_read(inode) + blocksize - 1) >> blkbits; + if (last_block > last_block_in_file) + last_block = last_block_in_file; + page_block = 0; + + /* + * Map blocks using the result from the previous get_blocks call first. + */ + nblocks = map_bh->b_size >> blkbits; + if (buffer_mapped(map_bh) && + block_in_file > args->first_logical_block && + block_in_file < (args->first_logical_block + nblocks)) { + unsigned map_offset = block_in_file - args->first_logical_block; + unsigned last = nblocks - map_offset; + + first_block = map_bh->b_blocknr + map_offset; + for (relative_block = 0; ; relative_block++) { + if (relative_block == last) { + clear_buffer_mapped(map_bh); + break; + } + if (page_block == blocks_per_folio) + break; + page_block++; + block_in_file++; + } + bdev = map_bh->b_bdev; + } + + /* + * Then do more get_blocks calls until we are done with this folio. + */ + map_bh->b_folio = folio; + while (page_block < blocks_per_folio) { + map_bh->b_state = 0; + map_bh->b_size = 0; + + if (block_in_file < last_block) { + map_bh->b_size = (last_block-block_in_file) << blkbits; + if (args->get_block(inode, block_in_file, map_bh, 0)) + goto confused; + args->first_logical_block = block_in_file; + } + + if (!buffer_mapped(map_bh)) { + fully_mapped = 0; + if (first_hole == blocks_per_folio) + first_hole = page_block; + page_block++; + block_in_file++; + continue; + } + + /* some filesystems will copy data into the page during + * the get_block call, in which case we don't want to + * read it again. map_buffer_to_folio copies the data + * we just collected from get_block into the folio's buffers + * so read_folio doesn't have to repeat the get_block call + */ + if (buffer_uptodate(map_bh)) { + map_buffer_to_folio(folio, map_bh, page_block); + goto confused; + } + + if (first_hole != blocks_per_folio) + goto confused; /* hole -> non-hole */ + + /* Contiguous blocks? */ + if (!page_block) + first_block = map_bh->b_blocknr; + else if (first_block + page_block != map_bh->b_blocknr) + goto confused; + nblocks = map_bh->b_size >> blkbits; + for (relative_block = 0; ; relative_block++) { + if (relative_block == nblocks) { + clear_buffer_mapped(map_bh); + break; + } else if (page_block == blocks_per_folio) + break; + page_block++; + block_in_file++; + } + bdev = map_bh->b_bdev; + } + + if (first_hole != blocks_per_folio) { + folio_zero_segment(folio, first_hole << blkbits, folio_size(folio)); + if (first_hole == 0) { + folio_mark_uptodate(folio); + folio_unlock(folio); + goto out; + } + } else if (fully_mapped) { + folio_set_mappedtodisk(folio); + } + + /* + * This folio will go to BIO. Do we need to send this BIO off first? + */ + if (args->bio && (args->last_block_in_bio != first_block - 1)) + args->bio = mpage_bio_submit_read(args->bio); + +alloc_new: + if (args->bio == NULL) { + args->bio = bio_alloc(bdev, bio_max_segs(args->nr_pages), opf, + gfp); + if (args->bio == NULL) + goto confused; + args->bio->bi_iter.bi_sector = first_block << (blkbits - 9); + } + + length = first_hole << blkbits; + if (!bio_add_folio(args->bio, folio, length, 0)) { + args->bio = mpage_bio_submit_read(args->bio); + goto alloc_new; + } + + relative_block = block_in_file - args->first_logical_block; + nblocks = map_bh->b_size >> blkbits; + if ((buffer_boundary(map_bh) && relative_block == nblocks) || + (first_hole != blocks_per_folio)) + args->bio = mpage_bio_submit_read(args->bio); + else + args->last_block_in_bio = first_block + blocks_per_folio - 1; +out: + return; + +confused: + if (args->bio) + args->bio = mpage_bio_submit_read(args->bio); + if (!folio_test_uptodate(folio)) + block_read_full_folio(folio, args->get_block); + else + folio_unlock(folio); + goto out; +} + +/** + * mpage_readahead - start reads against pages + * @rac: Describes which pages to read. + * @get_block: The filesystem's block mapper function. + * + * This function walks the pages and the blocks within each page, building and + * emitting large BIOs. + * + * If anything unusual happens, such as: + * + * - encountering a page which has buffers + * - encountering a page which has a non-hole after a hole + * - encountering a page with non-contiguous blocks + * + * then this code just gives up and calls the buffer_head-based read function. + * It does handle a page which has holes at the end - that is a common case: + * the end-of-file on blocksize < PAGE_SIZE setups. + * + * BH_Boundary explanation: + * + * There is a problem. The mpage read code assembles several pages, gets all + * their disk mappings, and then submits them all. That's fine, but obtaining + * the disk mappings may require I/O. Reads of indirect blocks, for example. + * + * So an mpage read of the first 16 blocks of an ext2 file will cause I/O to be + * submitted in the following order: + * + * 12 0 1 2 3 4 5 6 7 8 9 10 11 13 14 15 16 + * + * because the indirect block has to be read to get the mappings of blocks + * 13,14,15,16. Obviously, this impacts performance. + * + * So what we do it to allow the filesystem's get_block() function to set + * BH_Boundary when it maps block 11. BH_Boundary says: mapping of the block + * after this one will require I/O against a block which is probably close to + * this one. So you should push what I/O you have currently accumulated. + * + * This all causes the disk requests to be issued in the correct order. + */ +void mpage_readahead(struct readahead_control *rac, get_block_t get_block) +{ + struct folio *folio; + struct mpage_readpage_args args = { + .get_block = get_block, + .is_readahead = true, + }; + + while ((folio = readahead_folio(rac))) { + prefetchw(&folio->flags); + args.folio = folio; + args.nr_pages = readahead_count(rac); + do_mpage_readpage(&args); + /* + * If read ahead failed synchronously, it may cause by removed + * device, or some filesystem metadata error. + */ + if (!folio_test_locked(folio) && !folio_test_uptodate(folio)) + break; + } + if (args.bio) + mpage_bio_submit_read(args.bio); +} +EXPORT_SYMBOL(mpage_readahead); + +/* + * This isn't called much at all + */ +int mpage_read_folio(struct folio *folio, get_block_t get_block) +{ + struct mpage_readpage_args args = { + .folio = folio, + .nr_pages = folio_nr_pages(folio), + .get_block = get_block, + }; + + do_mpage_readpage(&args); + if (args.bio) + mpage_bio_submit_read(args.bio); + return 0; +} +EXPORT_SYMBOL(mpage_read_folio); + +/* + * Writing is not so simple. + * + * If the page has buffers then they will be used for obtaining the disk + * mapping. We only support pages which are fully mapped-and-dirty, with a + * special case for pages which are unmapped at the end: end-of-file. + * + * If the page has no buffers (preferred) then the page is mapped here. + * + * If all blocks are found to be contiguous then the page can go into the + * BIO. Otherwise fall back to the mapping's writepage(). + * + * FIXME: This code wants an estimate of how many pages are still to be + * written, so it can intelligently allocate a suitably-sized BIO. For now, + * just allocate full-size (16-page) BIOs. + */ + +struct mpage_data { + struct bio *bio; + sector_t last_block_in_bio; + get_block_t *get_block; +}; + +/* + * We have our BIO, so we can now mark the buffers clean. Make + * sure to only clean buffers which we know we'll be writing. + */ +static void clean_buffers(struct folio *folio, unsigned first_unmapped) +{ + unsigned buffer_counter = 0; + struct buffer_head *bh, *head = folio_buffers(folio); + + if (!head) + return; + bh = head; + + do { + if (buffer_counter++ == first_unmapped) + break; + clear_buffer_dirty(bh); + bh = bh->b_this_page; + } while (bh != head); + + /* + * we cannot drop the bh if the page is not uptodate or a concurrent + * read_folio would fail to serialize with the bh and it would read from + * disk before we reach the platter. + */ + if (buffer_heads_over_limit && folio_test_uptodate(folio)) + try_to_free_buffers(folio); +} + +static int mpage_write_folio(struct writeback_control *wbc, struct folio *folio, + struct mpage_data *mpd) +{ + struct bio *bio = mpd->bio; + struct address_space *mapping = folio->mapping; + struct inode *inode = mapping->host; + const unsigned blkbits = inode->i_blkbits; + const unsigned blocks_per_folio = folio_size(folio) >> blkbits; + sector_t last_block; + sector_t block_in_file; + sector_t first_block; + unsigned page_block; + unsigned first_unmapped = blocks_per_folio; + struct block_device *bdev = NULL; + int boundary = 0; + sector_t boundary_block = 0; + struct block_device *boundary_bdev = NULL; + size_t length; + struct buffer_head map_bh; + loff_t i_size = i_size_read(inode); + int ret = 0; + struct buffer_head *head = folio_buffers(folio); + + if (head) { + struct buffer_head *bh = head; + + /* If they're all mapped and dirty, do it */ + page_block = 0; + do { + BUG_ON(buffer_locked(bh)); + if (!buffer_mapped(bh)) { + /* + * unmapped dirty buffers are created by + * block_dirty_folio -> mmapped data + */ + if (buffer_dirty(bh)) + goto confused; + if (first_unmapped == blocks_per_folio) + first_unmapped = page_block; + continue; + } + + if (first_unmapped != blocks_per_folio) + goto confused; /* hole -> non-hole */ + + if (!buffer_dirty(bh) || !buffer_uptodate(bh)) + goto confused; + if (page_block) { + if (bh->b_blocknr != first_block + page_block) + goto confused; + } else { + first_block = bh->b_blocknr; + } + page_block++; + boundary = buffer_boundary(bh); + if (boundary) { + boundary_block = bh->b_blocknr; + boundary_bdev = bh->b_bdev; + } + bdev = bh->b_bdev; + } while ((bh = bh->b_this_page) != head); + + if (first_unmapped) + goto page_is_mapped; + + /* + * Page has buffers, but they are all unmapped. The page was + * created by pagein or read over a hole which was handled by + * block_read_full_folio(). If this address_space is also + * using mpage_readahead then this can rarely happen. + */ + goto confused; + } + + /* + * The page has no buffers: map it to disk + */ + BUG_ON(!folio_test_uptodate(folio)); + block_in_file = folio_pos(folio) >> blkbits; + /* + * Whole page beyond EOF? Skip allocating blocks to avoid leaking + * space. + */ + if (block_in_file >= (i_size + (1 << blkbits) - 1) >> blkbits) + goto page_is_mapped; + last_block = (i_size - 1) >> blkbits; + map_bh.b_folio = folio; + for (page_block = 0; page_block < blocks_per_folio; ) { + + map_bh.b_state = 0; + map_bh.b_size = 1 << blkbits; + if (mpd->get_block(inode, block_in_file, &map_bh, 1)) + goto confused; + if (!buffer_mapped(&map_bh)) + goto confused; + if (buffer_new(&map_bh)) + clean_bdev_bh_alias(&map_bh); + if (buffer_boundary(&map_bh)) { + boundary_block = map_bh.b_blocknr; + boundary_bdev = map_bh.b_bdev; + } + if (page_block) { + if (map_bh.b_blocknr != first_block + page_block) + goto confused; + } else { + first_block = map_bh.b_blocknr; + } + page_block++; + boundary = buffer_boundary(&map_bh); + bdev = map_bh.b_bdev; + if (block_in_file == last_block) + break; + block_in_file++; + } + BUG_ON(page_block == 0); + + first_unmapped = page_block; + +page_is_mapped: + /* Don't bother writing beyond EOF, truncate will discard the folio */ + if (folio_pos(folio) >= i_size) + goto confused; + length = folio_size(folio); + if (folio_pos(folio) + length > i_size) { + /* + * The page straddles i_size. It must be zeroed out on each + * and every writepage invocation because it may be mmapped. + * "A file is mapped in multiples of the page size. For a file + * that is not a multiple of the page size, the remaining memory + * is zeroed when mapped, and writes to that region are not + * written out to the file." + */ + length = i_size - folio_pos(folio); + folio_zero_segment(folio, length, folio_size(folio)); + } + + /* + * This page will go to BIO. Do we need to send this BIO off first? + */ + if (bio && mpd->last_block_in_bio != first_block - 1) + bio = mpage_bio_submit_write(bio); + +alloc_new: + if (bio == NULL) { + bio = bio_alloc(bdev, BIO_MAX_VECS, + REQ_OP_WRITE | wbc_to_write_flags(wbc), + GFP_NOFS); + bio->bi_iter.bi_sector = first_block << (blkbits - 9); + wbc_init_bio(wbc, bio); + bio->bi_write_hint = inode->i_write_hint; + } + + /* + * Must try to add the page before marking the buffer clean or + * the confused fail path above (OOM) will be very confused when + * it finds all bh marked clean (i.e. it will not write anything) + */ + wbc_account_cgroup_owner(wbc, folio, folio_size(folio)); + length = first_unmapped << blkbits; + if (!bio_add_folio(bio, folio, length, 0)) { + bio = mpage_bio_submit_write(bio); + goto alloc_new; + } + + clean_buffers(folio, first_unmapped); + + BUG_ON(folio_test_writeback(folio)); + folio_start_writeback(folio); + folio_unlock(folio); + if (boundary || (first_unmapped != blocks_per_folio)) { + bio = mpage_bio_submit_write(bio); + if (boundary_block) { + write_boundary_block(boundary_bdev, + boundary_block, 1 << blkbits); + } + } else { + mpd->last_block_in_bio = first_block + blocks_per_folio - 1; + } + goto out; + +confused: + if (bio) + bio = mpage_bio_submit_write(bio); + + /* + * The caller has a ref on the inode, so *mapping is stable + */ + ret = block_write_full_folio(folio, wbc, mpd->get_block); + mapping_set_error(mapping, ret); +out: + mpd->bio = bio; + return ret; +} + +/** + * __mpage_writepages - walk the list of dirty pages of the given address space + * & writepage() all of them + * @mapping: address space structure to write + * @wbc: subtract the number of written pages from *@wbc->nr_to_write + * @get_block: the filesystem's block mapper function. + * @write_folio: handler to call for each folio before calling + * mpage_write_folio() + * + * This is a library function, which implements the writepages() + * address_space_operation. It calls @write_folio handler for each folio. If + * the handler returns value > 0, it calls mpage_write_folio() to do the + * folio writeback. + */ +int +__mpage_writepages(struct address_space *mapping, + struct writeback_control *wbc, get_block_t get_block, + int (*write_folio)(struct folio *folio, + struct writeback_control *wbc)) +{ + struct mpage_data mpd = { + .get_block = get_block, + }; + struct folio *folio = NULL; + struct blk_plug plug; + int error; + + blk_start_plug(&plug); + while ((folio = writeback_iter(mapping, wbc, folio, &error))) { + if (write_folio) { + error = write_folio(folio, wbc); + /* + * == 0 means folio is handled, < 0 means error. In + * both cases hand back control to writeback_iter() + */ + if (error <= 0) + continue; + /* Let mpage_write_folio() handle the folio. */ + } + error = mpage_write_folio(wbc, folio, &mpd); + } + if (mpd.bio) + mpage_bio_submit_write(mpd.bio); + blk_finish_plug(&plug); + return error; +} +EXPORT_SYMBOL(__mpage_writepages); -- cgit v1.3.1