Re: [PATCH v2 2/2] mm/memory: refuse to map page cache folios that are not uptodate

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] mm: reachable WARN_ON_ONCE in do_set_pmd() via MADV_COLLAPSE
--

commit 46c971cfbe24534d9e4da886ac3a3c5691497ddc
Author: Kiryl Shutsemau (Meta) <kas@kernel.org>

mm/memory: refuse to map page cache folios that are not uptodate

This commit adds WARN_ON_ONCE(file_folio_not_uptodate(folio)) checks in
__do_fault() and do_set_pmd() to refuse mapping page cache folios that are
not uptodate and return VM_FAULT_SIGBUS.

> diff --git a/mm/memory.c b/mm/memory.c
> index cc1d0b7d15c75..2324c04d632f5 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c

[ ... ]

> @@ -5727,6 +5734,9 @@ vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *pa
>  		return ret;
>  	page = &folio->page;
>  
> +	if (WARN_ON_ONCE(file_folio_not_uptodate(folio)))
> +		return VM_FAULT_SIGBUS;

[Severity: Medium]
Can an unprivileged user trigger this WARN_ON_ONCE() via madvise(MADV_COLLAPSE)
on a fallocated shmem THP?

shmem_fallocate() inserts PMD-order folios into the page cache with
PG_uptodate clear.  When madvise(MADV_COLLAPSE) runs on that range,
collapse_scan_file() sees a PMD-order folio and returns
SCAN_PTE_MAPPED_HUGEPAGE without checking folio_test_uptodate():

mm/khugepaged.c:collapse_scan_file() {
	...
		if (is_pmd_order(folio_order(folio))) {
			result = SCAN_PTE_MAPPED_HUGEPAGE;
			failed_pfn = folio_pfn(folio);
			/*
			 * PMD-sized THP implies that we can only try
			 * retracting the PTE table.
			 */
			folio_put(folio);
			break;
		}
	...
}

collapse_pmd() then skips collapse_file() and calls
try_collapse_pte_mapped_thp() -> set_huge_pmd() -> do_set_pmd(), which also
does not check folio_test_uptodate().  This hits the WARN_ON_ONCE() and
makes MADV_COLLAPSE fail with -EINVAL instead of instantiating the
fallocated THP.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109120403.82361-1-kas@kernel.org?part=2