From a842a1f947da8a7020e72f885ffbf2ce6a93685f Mon Sep 17 00:00:00 2001 From: Chris Mason Date: Thu, 29 Oct 2026 11:43:28 +0100 Subject: [PATCH] mm/shmem: stop retrying folios that cannot be split A fault or collapse can insert a large folio crossing EOF after shmem_undo_range() has handled the boundary folios. If splitting that folio fails, truncate_inode_partial_folio() retains it when it is dirty. The final scan then repeatedly finds it because it restarts from an unchanged start. Truncation keeps the inode lock and ignores fatal signals while looping. A concurrent unlink() can then block other directory operations while holding the directory lock and waiting for the file's lock. Advance start past the retained folio, whose truncated part has already been zeroed. Do not move start backwards if the failed split has shrunk the folio. Fix generated by an LLM and sent by Chris Mason in private. Fixes: 55ac8bbe358b ("mm/shmem: fix race in shmem_undo_range w/THP") Cc: stable@vger.kernel.org Signed-off-by: Chris Mason Tested-by: Gregory Price (Meta) [ david: split fixes, simplify descriptions, adjust comments ] Reviewed-by: Zi Yan Reviewed-by: Balbir Singh Link: https://patch.msgid.link/20261029-fixes_shmem-v4-7-392fc715d8f6@kernel.org Signed-off-by: David Hildenbrand (Arm) --- mm/shmem.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/mm/shmem.c b/mm/shmem.c index c44d2dd71c89..af49d6bf6382 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -1481,6 +1481,15 @@ static void shmem_undo_range(struct inode *inode, loff_t lstart, uoff_t lend, index = start; break; } + } else if (folio->mapping) { + /* + * Splitting failed, but the part in the + * range is already zeroed. The folio + * was not dropped, so skip it when + * restarting the scan to avoid retrying + * it forever. + */ + start = max(start, folio_next_index(folio)); } } folio_unlock(folio);