mm: workingset: prevent lruvec release in workingset_refault()

In the near future, a folio will no longer pin its corresponding
memory cgroup. So an lruvec returned by folio_lruvec() could be
released without the rcu read lock or a reference to its memory
cgroup.

In the current patch, the rcu read lock is employed to safeguard
against the release of the lruvec in workingset_refault().

This serves as a preparatory measure for the reparenting of the
LRU pages.

Signed-off-by: Muchun Song <[email protected]>

Orabug: 37997580

Conflicts:
	mm/workingset.c
	(Due to prescence of 'commit 9cbfd1c mm/mglru: clean up
	 workingset')

This suppresses the warning:
  WARNING: CPU: 0 PID: 9726 at include/linux/memcontrol.h:407 workingset_refault+0x21f/0x270
  [...]
  Call Trace:
   <TASK>
   filemap_add_folio+0xcd/0x100
   page_cache_ra_unbounded+0x149/0x240
   do_sync_mmap_readahead+0x1b6/0x4e0
   filemap_fault+0x546/0x910
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? mark_held_locks+0x49/0x80
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? __xfs_filemap_fault+0xdd/0x1e0 [xfs]
   __do_fault+0x39/0x210
   do_fault+0x146/0x2f0
   __handle_mm_fault+0x592/0x770
   handle_mm_fault+0x104/0x3a0
   do_user_addr_fault+0x16d/0x7b0
   exc_page_fault+0x77/0x270
   asm_exc_page_fault+0x26/0x30
   </TASK>

Link: https://lore.kernel.org/linux-mm/[email protected]/
Fixes: 4717687 ("mm: memcontrol: make all the callers of {folio,page}_memcg() safe")
Reviewed-by: Imran Khan <[email protected]>
Signed-off-by: Harry Yoo <[email protected]>

Author: Muchun Song

mm/workingset.c

@@ -565,14 +565,15 @@ void workingset_refault(struct folio *folio, void *shadow)
 	 */
 	VM_BUG_ON_FOLIO(!folio_test_locked(folio), folio);
 	nr = folio_nr_pages(folio);
+	rcu_read_lock();
 	memcg = folio_memcg(folio);
 	pgdat = folio_pgdat(folio);
 	lruvec = mem_cgroup_lruvec(memcg, pgdat);
 
 	mod_lruvec_state(lruvec, WORKINGSET_REFAULT_BASE + file, nr);
 
 	if (!workingset_test_recent(shadow, file, &workingset, true))
-		return;
+		goto out;
 
 	folio_set_active(folio);
 	workingset_age_nonresident(lruvec, nr);
@@ -588,6 +589,8 @@ void workingset_refault(struct folio *folio, void *shadow)
 		lru_note_cost_refault(folio);
 		mod_lruvec_state(lruvec, WORKINGSET_RESTORE_BASE + file, nr);
 	}
+out:
+	rcu_read_unlock();
 }
 
 /**