Re: [PATCH 09/16] mm/shmem: preserve data in clean folios when splitting fails

[Baolin Wang]

On 10/27/26 1:12 AM, Kiryl Shutsemau wrote:
> On Mon, Oct 26, 2026 at 10:40:42AM +0100, David Hildenbrand (Arm) wrote:
> > From: Chris Mason <mason@xxxxxxxxxx>
> >
> > A shared writable mapping can have dirty PTEs while its shmem folio is
> > still clean. A read fault can install a writable PTE, and a later store
> > sets the PTE's dirty bit without marking the folio dirty.
> >
> > After shmem_undo_range() has handled the boundary folios, a concurrent
> > read fault into a hole below the new EOF can allocate a large folio.
> > For example, on a tmpfs mount with huge=always, the fault's offset must
> > be within the file, but the allocated folio can extend beyond i_size.
> > The final scan then finds this folio and calls
> > truncate_inode_partial_folio() without marking it dirty.
>
> This is hard to follow. I asked LLM for a diagram. I think it would be
> helpful for the commit message:
>
> CPU0: ftruncate(fd, 3M)                CPU1: MAP_SHARED, tmpfs huge=always
> ─────────────────────────────────────  ──────────────────────────────────
> i_size = 3M
> shmem_undo_range(3M, -1)
>    first pass: hole, nothing to do
>    boundary folio at 3M: hole, none
>                                         read fault at 2M+x (below EOF)
>                                           PMD folio [2M,4M), crosses EOF
>                                           writable PTE, folio clean
>                                         store to 2M+x
>                                           PTE dirty, folio still clean
>                                         vmsplice(2M+x)
>                                           extra folio reference
>    whole_folios: finds [2M,4M) folio
>    truncate_inode_partial_folio()
>      zero [3M,4M)
>      folio_split()
>        unmap_folio(): extra ref
>          → -EAGAIN, PTE dirty bit
>            never reaches the folio
>      folio clean
>        → truncate_inode_folio(whole)
>          [2M,3M) dropped
>                                         read 2M+x → refault → zeroes

Thanks. The diagram is really helpful.

> > Splitting normally collects the PTE dirty bits when unmapping the
> > folio. An extra reference, for example from vmsplice(), can make it
> > fail before that step. The fallback unmapping on split failure excludes
> > shmem, so the helper still sees a clean folio and drops it, losing data
> > outside the range.
> >
> > Mark large folios dirty before partial truncation in the final scan,
> > as the boundary handling already does. Exclude failed-fallocate
> > rollback, which must discard the folios it added.
> >
> > Fix generated by an LLM and sent by Chris Mason in private.
> >
> > Fixes: b9a8a4195c7d ("truncate,shmem: Handle truncates that split large folios")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Chris Mason <mason@xxxxxxxxxx>
> > [ david: simplify descriptions, adjust comments ]
> > Signed-off-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>
>
> The fix itself looks reasonable:
>
> Acked-by: Kiryl Shutsemau (Meta) <kas@xxxxxxxxxx>

LGTM.
Reviewed-by: Baolin Wang <baolin.wang@xxxxxxxxxxxxxxxxx>