Re: [PATCH 2/5] mm: limit pagecache folio refcount when splicing into pipes

["David Hildenbrand (Arm)" <david@kernel.org>]

On 11/6/26 18:58, Josef Bacik wrote:
> On Thu, Nov 05, 2026 at 02:10:11PM +0100, David Hildenbrand (Arm) wrote:
>> Similar to mapping pagecache folios into page tables, let's reject splicing
>> folios into a pipe if the refcount is at it's limit, similar to how we
>> handle it during GUP.
>>
>> This will prevent more cases of possible folio refcount overflows with
>> large pagecache folios.
>>
>> Let's keep it simple and check in the two callers of
>> splice_folio_into_pipe().
>>
>> Also check in try_get_page() to cover pipe-buffer duplication by tee()
>> and partial pipe-to-pipe splicing.
>>
>> Fixes: 800d8c63b2e9 ("shmem: add huge pages support")
>> Fixes: 99cb0dbd47a1 ("mm,thp: add read-only THP support for (non-shmem) FS")
>> Fixes: 793917d997df ("mm/readahead: Add large folio readahead")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
>> ---
>>  include/linux/mm.h | 9 ++++++---
>>  mm/filemap.c       | 4 ++++
>>  mm/shmem.c         | 4 ++++
>>  3 files changed, 14 insertions(+), 3 deletions(-)
>>
>> diff --git a/include/linux/mm.h b/include/linux/mm.h
>> index 79ae8fc0d6bb4..a82cfbce18215 100644
>> --- a/include/linux/mm.h
>> +++ b/include/linux/mm.h
>> @@ -2287,10 +2287,13 @@ static inline void get_page(struct page *page)
>>  
>>  static inline __must_check bool try_get_page(struct page *page)
>>  {
>> -	page = compound_head(page);
>> -	if (WARN_ON_ONCE(page_ref_count(page) <= 0))
>> +	struct folio *folio = page_folio(page);
>> +
>> +	if (WARN_ON_ONCE(folio_ref_count(folio) <= 0))
> 
> Since you're here anyway can you change this to something other than
> WARN_ON_ONCE, since that results in an OOPS with panic_on_warn set?
> Thanks,

If it actually turns negative (or 0) with out changes, we had an overflow and
for sure want to know about it :)

-- 
Cheers,

David