From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794590406; b=zkm0L9RWLabBte2CAG6xMvbPsTyM1kE11m1qQ6DYS5ayQu981B23S+/JV0o7jpvB70mH q75nZUT2lcMnsUjCQBoeOF6zsyVvrBd/x0OeHpj2sX3cySvEZsT89VZV9C4gziLhxVbmn 5ky57auJjdJjPC0LRdsBCk3ZBmgUJ3iNsD2H2hYdUZleZDEIKBcnSAtcXgeH6SGMGjTjc FIwO7ZY3xHXHzVAgldQsPvA1k7no+he3R2XgyhAoxNYOUawyYRLkpN9LSj1dxvY5RdxCp mQUTF2LaWU/Ll0SHe3O/+rMIn9qHmZbfYGyfOQqBsLlcIsDnSfZRtN8FFBCXRupPKdQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794590406; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=LSyEWyjPs4t3MEG08rwgSe7G+8rVc/yqd8HN/ziItSI=; b=4DHvb9ZhhSJYn2QFTIMYSBxSUoZ/e+E7zgiQY52mJeDNmdLNCtMK994AHzej3Y+GhLYt qrqs9NtV9HC74jGg9F1WQ3+oNlgMiXsZ0wLg9nm/sKMd1dnCbba3sf9XOxJf5AMKHOGFy mJIdNWl0/WuHAgPMFClobDt5kuf+l98h3qpKGTdWCjq1cswaTTo9k8xZmX61sb8tqTXBW WdkixuUKyi7d8iZMr4o0/o0H7nUzW6WjHOVy6dO0uEiBARil/exF8PPrp/M2kRbZhBzIV UeadyaT1KtyXxh1FuQRkNm3G6ks/geCyTu2JctnWIXIy7+gCEu5Mzby1HQ8mYA/9J6Q== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=cSxXTmCo; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DF63B606B451; Fri, 13 Nov 2026 17:20:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=cSxXTmCo Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8F0C61F000C4; Fri, 13 Nov 2026 17:20:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794590405; bh=LSyEWyjPs4t3MEG08rwgSe7G+8rVc/yqd8HN/ziItSI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=cSxXTmCoKdoqk0NRYaRo7MqGMvMWYJDMLBmpTc7kLTuybTVUEc3q28v5dScK8EzNk kM3Cp95D1IUQJUjLY0+ukT//GKBPJ3pbAapzLawy02a0iDOydek0mB4dUMjopCCxaL rfUQotUDyFyQ1BPYkvyMX73GwPQGLZegnCXMSVK0= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Chris Mason , "Pratyush Yadav (Google)" , Samiullah Khawaja , Muhammad Usama Anjum , Lance Yang , "David Hildenbrand (Arm)" , Sasha Levin Subject: [PATCH 6.18 373/686] mm/gup: fix clearing folios in memfd_pin_folios() Date: Fri, 13 Nov 2026 10:48:26 -0500 Message-ID: <20261113153833.560952536@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153820.902362109@linuxfoundation.org> References: <20261113153820.902362109@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Chris Mason [ Upstream commit c83ee2fa5a94edb2e04102b9dd4f1ee0eeb2b932 ] memfd_pin_folios() pins folios obtained directly from the page cache without checking whether they are uptodate. However, shmem fallocate() can leave newly allocated folios uncleared and not uptodate. Callers such as udmabuf can then expose uninitialized memory to userspace. Clear non-uptodate folios and mark them uptodate under the folio lock before returning them to the caller. Fix generated by an LLM and sent by Chris Mason in private. Fixes: 89c1905d9c14 ("mm/gup: introduce memfd_pin_folios() for pinning memfd folios") Cc: stable@vger.kernel.org Signed-off-by: Chris Mason [ david: simplify description and comment ] Reviewed-by: Pratyush Yadav (Google) Reviewed-by: Samiullah Khawaja Tested-by: Samiullah Khawaja Tested-by: Muhammad Usama Anjum Link: https://patch.msgid.link/20261031-fixes_core-v3-20-d6437171ecc3@kernel.org Reviewed-by: Lance Yang Signed-off-by: David Hildenbrand (Arm) Signed-off-by: Sasha Levin --- mm/gup.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/mm/gup.c b/mm/gup.c index 50ff90775cbb8..6ea400b5b8c5e 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -3519,6 +3519,20 @@ long memfd_pin_folios(struct file *memfd, loff_t start, loff_t end, goto err; } + /* + * fallocate() can leave folios in the + * page cache that were never cleared. + */ + if (!folio_test_uptodate(folio)) { + folio_lock(folio); + if (!folio_test_uptodate(folio)) { + folio_zero_range(folio, 0, folio_size(folio)); + flush_dcache_folio(folio); + folio_mark_uptodate(folio); + } + folio_unlock(folio); + } + if (nr_folios == 0) *offset = offset_in_folio(folio, start); -- 2.53.0