Re: [PATCH stable v2] mm/khugepaged: write all dirty file folios when collapsing

[Baolin Wang]

On 7/9/26 12:28 AM, Pedro Falcato wrote:
> Seems that I accidentally dropped linked list Cc's here, see
> https://lore.kernel.org/stable/20260708151357.353173-1-pfalcato@xxxxxxx/
>
> On Wed, Jul 08, 2026 at 04:13:57PM +0100, Pedro Falcato wrote:
> > [There is no upstream commit, as this code was removed by upstream
> >   commit 044925f9b565 ("mm: fs: remove filemap_nr_thps*() functions and their users")]
> >
> > As-is, khugepaged and writable-file opening exclude each other. A file
> > cannot be open writeable and have THPs (because the filesystem is not aware
> > of them). khugepaged will never collapse file pages for files that are
> > opened writeable. On an open(O_RDWR/O_WRONLY), the page cache for that
> > particular file is dropped. This is fine because nothing could've been
> > dirtied.
> >
> > However, there is an edge-case: collapse_file() might not be able to
> > coexist with concurrent writers, but it can coexist with dirty folios
> > (from previous writers). Therefore, the following can happen:
> >
> > open(file, O_RDWR)
> > write(file)
> > close(file)
> > madvise(file_mapping, MADV_COLLAPSE, some non-dirty range)
> > open(file, O_RDWR)
> >   nr_thps > 0
> >    truncate_inode_pages()
> >      /* THPs are cleared out, but so are the dirty folios */
> >
> > When this edge-case happens, there is data loss, as the dirty folios are
> > fully discarded.
> >
> > Fix it by fully writing back the page cache (and waiting) when collapsing
> > file THPs. Doing so provides the guarantee that no dirty folio will be
> > observed while there are active THPs. To fully ensure this is safe, the
> > invalidate_lock needs to be held while doing the writeout, so that
> > do_dentry_open()'s page cache truncation excludes this write-and-wait.
> >
> > As a side effect, move the nr_thps counter bumping outside the i_pages
> > lock. This is correct since the counter itself is an atomic_t and the
> > producer <-> consumer correctness is provided by a full memory barrier:
> > smp_mb() in collapse_file()/memory barrier implied by full ordering in
> > get_write_access() -> atomic_inc_unless_negative().
> >
> > Cc: stable@xxxxxxxxxxxxxxx
> > Cc: Alexander Viro <viro@xxxxxxxxxxxxxxxxxx>
> > Cc: Christian Brauner <brauner@xxxxxxxxxx>
> > Cc: Jan Kara <jack@xxxxxxx>
> > Cc: Matthew Wilcox <willy@xxxxxxxxxxxxx>
> > Cc: Song Liu <song@xxxxxxxxxx>
> > Cc: Eric Hagberg <ehagberg@xxxxxxxxxxxxxx>
> > Cc: Zi Yan <ziy@xxxxxxxxxx>
> > Fixes: 99cb0dbd47a1 ("mm,thp: add read-only THP support for (non-shmem) FS")
> > Reported-by: Gregg Leventhal <gleventhal@xxxxxxxxxxxxxx>
> > Closes: https://lore.kernel.org/linux-mm/CAFN_u7H_0ECF3jixP=T=U7AH5=Q3wQNvJMo8an3VqUDMerQfUw@xxxxxxxxxxxxxx/
> > Tested-by: Zi Yan <ziy@xxxxxxxxxx>
> > Tested-by: Lance Yang <lance.yang@xxxxxxxxx>
> > Signed-off-by: Pedro Falcato <pfalcato@xxxxxxx>
> > ---

LGTM. Thanks.
Reviewed-by: Baolin Wang <baolin.wang@xxxxxxxxxxxxxxxxx>