From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1AE70329E61 for ; Mon, 5 Jan 2026 13:58:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767621505; cv=none; b=ArFmft/T3rung6lgY4so1zcmN/XkywCQ8c/pKMK6qhvQF8ehJ09O0CLDrRwaYvk990+Bk4qhSPF3u+ms/uNnHSRk/F6KpoJHsn6jERHs+JZMvFae9LdFBalse9q0R58T4m7t3QmcdSbePfZMvsf1LvvCRSIYIBZGWT/0X6gtzqc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767621505; c=relaxed/simple; bh=QTnubz3Q09tZC/gZaCqp9AGkEPTnUWbpPrf8ESuhyeE=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=mdHkNLGgZAOcqWQ1qnjw2rHS1AitXiFQHQ/UJC8BEob3EZlHgbEkpSyRsaEh/mWhgfkb4BuQxrcmPzVnctYNeH6xJkHE2+sD9cvKfDfh7VyRBRPAu0uznvGk78xkFjBMgpTATa+lGMUM3+toynGtJfLpn9keimvj4IHfZo9yS74= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=JldNfoCg; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="JldNfoCg" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1767621501; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=tAkRmahwDMj8glf3/6lkFxmOJSwV+a/ZJXhYLby36UQ=; b=JldNfoCge/au961IGWgDo8w95iOI/d6VBDhk/4DIAjFsn0r8mTD4BtEAiU6rBN+TR8ut5X +BJS1FrwRVn8F2Y+uNfSpLWMjfPjs6YN5i+/93Zi/HuDhy3j0O8YbgU8Ryy5D3B5ITPQly IPOdKsJMXWCMsj1QhDJ/Yw8sojhoXCM= Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-152-7ozuR_E_NR2ifjhmuXX-wA-1; Mon, 05 Jan 2026 08:58:20 -0500 X-MC-Unique: 7ozuR_E_NR2ifjhmuXX-wA-1 X-Mimecast-MFC-AGG-ID: 7ozuR_E_NR2ifjhmuXX-wA_1767621499 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 4E212195608A; Mon, 5 Jan 2026 13:58:18 +0000 (UTC) Received: from bfoster (unknown [10.22.64.153]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id C24CC1956048; Mon, 5 Jan 2026 13:58:15 +0000 (UTC) Date: Mon, 5 Jan 2026 08:58:08 -0500 From: Brian Foster To: Baolin Wang Cc: Barry Song <21cnbao@gmail.com>, Matthew Wilcox , akpm@linux-foundation.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Hugh Dickins , syzbot+178fff6149127421c2cc@syzkaller.appspotmail.com Subject: Re: [PATCH] mm/shmem: fix uninitialized folio in shmem_symlink Message-ID: References: <20251224094027.65842-1-21cnbao@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 On Thu, Dec 25, 2025 at 06:08:08PM +0800, Baolin Wang wrote: > > > On 2025/12/25 12:04, Barry Song wrote: > > On Thu, Dec 25, 2025 at 6:01 AM Matthew Wilcox wrote: > > > > > > On Wed, Dec 24, 2025 at 10:40:27PM +1300, Barry Song wrote: > > > > From: Barry Song > > > > > > > > Uninitialized folio allocated in shmem_symlink() may be accessed > > > > during swap-out, causing KMSAN BUG: > > > > > > This would be an unfortunate way to fix it. The vast majority of > > > symlinks are short, and we'll never access past the \0 in normal > > > operation, so we'll be dirtying a lot of cachelines essentially to (1) > > > shut up an automated tool and (2) optimise a corner case. > > > > > > How about this instead which delays zeroing to swapout? > > > > Matthew, thank you very much for your review, even during Christmas. > > I would like to wish you a happy holiday! > > > > I am not quite sure, as shm symlinks do not seem very common. Since > > allocating a folio requires a symname longer than 128 bytes (where > > 128 == SHORT_SYMLINK_LEN), such cases appear even rarer. > > > > BTW, do we need to migrate the owner_2 flag in folio_migrate_flags()? > > If so, I am not quite sure it is worth changing the hotpath to > > accommodate this. > > +1. At least for me, using the 'PG_owner_2' flag alone to mark this uncommon > case doesn't seem quite worthwhile. > Also JFYI the post-eof swapout zeroing work (still pending) looks to me like it would cover the swapout time case [1]. That's just if you wanted to go that route here; creation time zeroing for the large symlink case seems reasonable enough to me as well. Brian [1] https://lore.kernel.org/linux-mm/20251121152246.1023918-3-bfoster@redhat.com/ > > > diff --git a/mm/shmem.c b/mm/shmem.c > > > index ec6c01378e9d..f3b3be1b50fe 100644 > > > --- a/mm/shmem.c > > > +++ b/mm/shmem.c > > > @@ -1636,6 +1636,13 @@ int shmem_writeout(struct folio *folio, struct swap_iocb **plug, > > > folio_mark_uptodate(folio); > > > } > > > > > > + /* Zero out symlink tails to help with compression */ > > > + if (folio_test_owner_2(folio)) { > > > + struct inode *inode = folio->mapping->host; > > > + folio_zero_segment(folio, inode->i_size, folio_size(folio)); > > > + folio_clear_owner_2(folio); > > > + } > > > + > > > if (!folio_alloc_swap(folio)) { > > > bool first_swapped = shmem_recalc_inode(inode, 0, nr_pages); > > > int error; > > > @@ -4133,6 +4140,7 @@ static int shmem_symlink(struct mnt_idmap *idmap, struct inode *dir, > > > memcpy(folio_address(folio), symname, len); > > > folio_mark_uptodate(folio); > > > folio_mark_dirty(folio); > > > + folio_set_owner_2(folio); > > > folio_unlock(folio); > > > folio_put(folio); > > > } > > > > Thanks > > Barry > >