From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794585703; b=pFhYCKaULvWWZFTQMfLCzKqAXjRmv3lSvt05BD5xq7S7otJiPEK9CvAA8jle0/J2WwEZ F6US2AF8kGAn9Hkeb7YBLgZirKvZev86YcE9xIUkJtYNQQ+JUU9kGvIGgv/O1tAxz4y5n If84DOtAXwJAEyFbNvW9tT3ScXa6CFfjpni0aBWItANd/08t5lOVSvQlmL41ihYLMjWA4 d9Tcjsmvemjov+mHxRcQ5rHR6DH9fMB5CRshB9SJ7KnWSr+WvLo1rrCxSb5Z5oXQh83Xt WzKJGrlCzEYt2U3bT8ZLEwyWE9OH7azIYHkOgLupCF8z9jpWnrrx1ZNnm9VqEftzGXQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794585703; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=ZAAftO8cLfwyiQi5UtVIW2TTg5CcMK6yykEnTX6OEa4=; b=lN2i3tRFgV4ngMN6Ga1Q+T+y4mPTzVDxXkfOFmAMath7a3wowgUY5GnUMiXPtTiou4hW Kpc3zI1oPRyY5qutxsVQGXwatBOPvbzFywwfetA/L4oHLUSAE7R7sLnKKwLIn5KmHZPq4 asPA8vax4dyfjcZt0uwKlpyjSSuIWyLR3NjqfyM8U5+ZnNsFyqJE72Aic8LwQkd8mQ3ha tLXRAEV8ICai44ELsbYdyd6EyCNBTECC/zh4DFMEdh2tSI1utEMuhiPtnZRWaYk8+62c5 Zp9HjA96tFqSp2MH0F6D+tgcpyKIQkdfJd99WxhS1xLBEI/D3R+DNj96PlTRhH+/DvQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b="Fa2hQVd/"; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 23250606A8A8; Fri, 13 Nov 2026 16:01:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=Fa2hQVd/ Received: by smtp.kernel.org (Postfix) with ESMTPSA id C7E461F000C4; Fri, 13 Nov 2026 16:01:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794585703; bh=ZAAftO8cLfwyiQi5UtVIW2TTg5CcMK6yykEnTX6OEa4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Fa2hQVd/wjHYHRkueiAuleJdPmuoJ2qW9p2CoU9w5fmv7uPXuD8qhXs+Adqe0VA3m qLqVtJmkU+GMPcvFPMqlH7inlNjmuD7Q07D5krhiKRGhjaHgziYXnBZav+VsiaTLpm kHC5JBictq2lQLml7E7sRSL1+AjPjiSvlaVeP2tA= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Chris Mason , "Pratyush Yadav (Google)" , Samiullah Khawaja , Muhammad Usama Anjum , Lance Yang , "David Hildenbrand (Arm)" , Sasha Levin Subject: [PATCH 7.3 308/507] mm/gup: fix clearing folios in memfd_pin_folios() Date: Fri, 13 Nov 2026 10:50:12 -0500 Message-ID: <20261113153805.741581879@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153753.358973689@linuxfoundation.org> References: <20261113153753.358973689@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Chris Mason [ Upstream commit c83ee2fa5a94edb2e04102b9dd4f1ee0eeb2b932 ] memfd_pin_folios() pins folios obtained directly from the page cache without checking whether they are uptodate. However, shmem fallocate() can leave newly allocated folios uncleared and not uptodate. Callers such as udmabuf can then expose uninitialized memory to userspace. Clear non-uptodate folios and mark them uptodate under the folio lock before returning them to the caller. Fix generated by an LLM and sent by Chris Mason in private. Fixes: 89c1905d9c14 ("mm/gup: introduce memfd_pin_folios() for pinning memfd folios") Cc: stable@vger.kernel.org Signed-off-by: Chris Mason [ david: simplify description and comment ] Reviewed-by: Pratyush Yadav (Google) Reviewed-by: Samiullah Khawaja Tested-by: Samiullah Khawaja Tested-by: Muhammad Usama Anjum Link: https://patch.msgid.link/20261031-fixes_core-v3-20-d6437171ecc3@kernel.org Reviewed-by: Lance Yang Signed-off-by: David Hildenbrand (Arm) Signed-off-by: Sasha Levin --- mm/gup.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/mm/gup.c b/mm/gup.c index 6a101ff74a29f..cc63c6a0e5f37 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -3502,6 +3502,20 @@ long memfd_pin_folios(struct file *memfd, loff_t start, loff_t end, goto err; } + /* + * fallocate() can leave folios in the + * page cache that were never cleared. + */ + if (!folio_test_uptodate(folio)) { + folio_lock(folio); + if (!folio_test_uptodate(folio)) { + folio_zero_range(folio, 0, folio_size(folio)); + flush_dcache_folio(folio); + folio_mark_uptodate(folio); + } + folio_unlock(folio); + } + if (nr_folios == 0) *offset = offset_in_folio(folio, start); -- 2.53.0