From: Pankaj Raghav <p.raghav@samsung.com>

Usually the page cache does not extend beyond the size of the inode,
therefore, no PTEs are created for folios that extend beyond the size.

But with LBS support, we might extend page cache beyond the size of the
inode as we need to guarantee folios of minimum order. Cap the PTE range
to be created for the page cache by i_size.

A fstest has been created to trigger this edge case[1].

[1]https://lore.kernel.org/fstests/20240415081054.1782715-1-mcgrof@kernel.org/

Signed-off-by: Pankaj Raghav <p.raghav@samsung.com>
Co-Developed-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
---
 mm/filemap.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/mm/filemap.c b/mm/filemap.c
index f0c0cfbbd134..259531dd297b 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -3600,12 +3600,15 @@ vm_fault_t filemap_map_pages(struct vm_fault *vmf,
 	}
 	do {
 		unsigned long end;
+		unsigned long i_size;
 
 		addr += (xas.xa_index - last_pgoff) << PAGE_SHIFT;
 		vmf->pte += xas.xa_index - last_pgoff;
 		last_pgoff = xas.xa_index;
 		end = folio_next_index(folio) - 1;
-		nr_pages = min(end, end_pgoff) - xas.xa_index + 1;
+		i_size = DIV_ROUND_UP(i_size_read(mapping->host),
+				      PAGE_SIZE) - 1;
+		nr_pages = min3(end, end_pgoff, i_size) - xas.xa_index + 1;
 
 		if (!folio_test_large(folio))
 			ret |= filemap_map_order0_folio(vmf,
-- 
2.34.1

On Thu, Apr 25, 2024 at 01:37:41PM +0200, Pankaj Raghav (Samsung) wrote:
>  	do {
>  		unsigned long end;
> +		unsigned long i_size;

Usually i_size is the name of a variable that contains an loff_t, not a
page count.  Not sure what to call this though.  Also, can't we move
this outside the loop?

	pgoff_t file_end = DIV_ROUND_UP(i_size_read(mapping->host),
					PAGE_SIZE) - 1;

	if (end_pgoff > file_end)
		end_pgoff = file_end;

On Thu, Apr 25, 2024 at 09:24:33PM +0100, Matthew Wilcox wrote:
> On Thu, Apr 25, 2024 at 01:37:41PM +0200, Pankaj Raghav (Samsung) wrote:
> >  	do {
> >  		unsigned long end;
> > +		unsigned long i_size;
> 
> Usually i_size is the name of a variable that contains an loff_t, not a
> page count.  Not sure what to call this though.  Also, can't we move
> this outside the loop?
You are right, this can move out as i_size is not going to change. I
will make this change. Thanks!
> 
> 	pgoff_t file_end = DIV_ROUND_UP(i_size_read(mapping->host),
> 					PAGE_SIZE) - 1;
> 
> 	if (end_pgoff > file_end)
> 		end_pgoff = file_end;

--
Pankaj