Re: [RFC PATCH v2 03/18] fuse: don't move a folio with PG_rcu_free into a fuse file

[David Hildenbrand (Arm)]

On 11/4/26 14:00, Kiryl Shutsemau (Meta) wrote:
> fuse_try_move_folio() takes the folio of a pipe buffer and puts it into
> a fuse file, where writes change it.  A folio with PG_rcu_free may still
> be copied by a lockless page cache read that found it before it left
> the page cache.
> 
> Such a folio reaches fuse when a mapped file page is gifted with
> vmsplice(SPLICE_F_GIFT) and its file is then truncated.
> fuse_check_folio() refuses it only because the flag is not among those
> it allows, and with a dump_page().
> 
> Copy such a folio instead, as fuse does whenever it cannot take one.
> 
> Signed-off-by: Kiryl Shutsemau (Meta) <kas@xxxxxxxxxx>
> ---
>  fs/fuse/dev.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
> index 4fec31fc0b84..526929c7b3f1 100644
> --- a/fs/fuse/dev.c
> +++ b/fs/fuse/dev.c
> @@ -1152,6 +1152,10 @@ static int fuse_try_move_folio(struct fuse_copy_state *cs, struct folio **foliop
>  
>  	newfolio = page_folio(buf->page);
>  
> +	/* A lockless page cache read may still be copying from it */
> +	if (folio_test_rcu_free(newfolio))
> +		goto out_fallback_unlock;
> +
>  	folio_clear_uptodate(newfolio);
>  	folio_clear_mappedtodisk(newfolio);

Talking to Zi, it would actually be nice if we could disallow converting
ordinary pages to folios and the other way around. That will be required for
some future changes where we identify folios with a distinct PG_folio.

Could we get rid of fuse_try_move_folio() entirely?

I think we'd just want to get rid of any such stealing if possible.

-- 
Cheers,

David