Merge: mm: migrate high-order folios in swap cache correctly

MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/3851

The following commit fixes an issue that causes tasks to hang on attempting to take mm->mmap_lock

    commit fc346d0
    Author: Charan Teja Kalla <quic_charante@quicinc.com>
    Date:   Thu Dec 14 04:58:41 2023 +0000

        mm: migrate high-order folios in swap cache correctly

        Large folios occupy N consecutive entries in the swap cache instead of
        using multi-index entries like the page cache.  However, if a large folio
        is re-added to the LRU list, it can be migrated.  The migration code was
        not aware of the difference between the swap cache and the page cache and
        assumed that a single xas_store() would be sufficient.

        This leaves potentially many stale pointers to the now-migrated folio in
        the swap cache, which can lead to almost arbitrary data corruption in the
        future.  This can also manifest as infinite loops with the RCU read lock
        held.

JIRA: https://issues.redhat.com/browse/RHEL-23654

Signed-off-by: Nico Pache <npache@redhat.com>

Approved-by: Waiman Long <longman@redhat.com>
Approved-by: Donald Dutile <ddutile@redhat.com>

Merged-by: Lucas Zampieri <lzampier@redhat.com>

Author: zampierilucas

mm/migrate.c

@@ -396,6 +396,7 @@ int folio_migrate_mapping(struct address_space *mapping,
 	int dirty;
 	int expected_count = folio_expected_refs(mapping, folio) + extra_count;
 	long nr = folio_nr_pages(folio);
+	long entries, i;
 
 	if (!mapping) {
 		/* Anonymous page without mapping */
@@ -433,8 +434,10 @@ int folio_migrate_mapping(struct address_space *mapping,
 			folio_set_swapcache(newfolio);
 			newfolio->private = folio_get_private(folio);
 		}
+		entries = nr;
 	} else {
 		VM_BUG_ON_FOLIO(folio_test_swapcache(folio), folio);
+		entries = 1;
 	}
 
 	/* Move dirty while page refs frozen and newpage not yet exposed */
@@ -444,7 +447,11 @@ int folio_migrate_mapping(struct address_space *mapping,
 		folio_set_dirty(newfolio);
 	}
 
-	xas_store(&xas, newfolio);
+	/* Swap cache still stores N entries instead of a high-order entry */
+	for (i = 0; i < entries; i++) {
+		xas_store(&xas, newfolio);
+		xas_next(&xas);
+	}
 
 	/*
 	 * Drop cache reference from old page by unfreezing