From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794591187; b=LOf5BewVXc5TNokFY/xWLjmsA5kiPP/3cvsQPOweJOH59sPTTDlWnFHs0dkLHTK9Hjgj jHFMTyP+3ErfANp9hpbjTYw487qeH7tzNlpGeWL9Xpe8OvcnpmQHhqQgoZCVMt3GmHiuV vH0fdBP7WV57yDtoGmBBaStqyintCDg4SLzOtsg+8prW+6GndkL0XNwhPcE/Rw8s0hEJQ t/ipLObmULhanF6LEUgZWXyXTlwgpVvnHtQjsh8ngZmLdADHK9W0sElJpwDBUIQGRD5OI 92fCsbRe30Ig/kTiUwLxq6lKKtKaJfTmD2CPnc8dgqfJ7eWrW1pP1kHenmji3Bpj2MQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794591187; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=IbT+Yt3Pf4b9bViiWb6wAoVOc9SBahCiOgOnc0Si7M0=; b=UR6uYiWVjfjshUUeFHEDcHTu2ZM8WF5QTTw78NU6sP7jvX15xCUD+PLukWWhZWEO7emq pOv4QRv7GFpJJldIptWY8VymwiCclCFIJYjHToJQoP0upYA6EVhKybVlFN4D0aSgkKD68 Imj1kQ37Mj6jcCsfli01QnBIzndUs6qml0mTaYKdDJlDPaamzdu4K4jkZdo2FJzAtIc0B 5/4rf/YzfMwBBsN/2I4hbFcbAKpv659W4gM/58IP/2AmTVv7Bahoab+KD99sjnWaLgWOK N/I8nueAQfr0BNHy/Gp7xY2OCgGgp9UwKpWVLugwQKJqD2moWLvQcH4T4r0uiZ6kMIw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=JyO81OzQ; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 136B86073FD8; Fri, 13 Nov 2026 17:33:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=JyO81OzQ Received: by smtp.kernel.org (Postfix) with ESMTPSA id 830B81F000C4; Fri, 13 Nov 2026 17:33:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794591186; bh=IbT+Yt3Pf4b9bViiWb6wAoVOc9SBahCiOgOnc0Si7M0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=JyO81OzQj9PIWwzbg+r/ec8rFrW536E+PFTmCNzJtODwn4HQf8JgrvPFoZwaKVa6r Tovfl6CsWxOedmHFvkNX00vGZtlri3yQJpAfRKkHwlYv8/YQX8MAacNFrUdHfrRu95 nH26zkaftSskqcOAxN/eXVAolv/iJm1L+ymx3NUs= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Chris Mason , "Pratyush Yadav (Google)" , Samiullah Khawaja , Muhammad Usama Anjum , Lance Yang , "David Hildenbrand (Arm)" , Sasha Levin Subject: [PATCH 6.12 323/670] mm/gup: fix clearing folios in memfd_pin_folios() Date: Fri, 13 Nov 2026 10:48:07 -0500 Message-ID: <20261113153822.839456274@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153811.177190860@linuxfoundation.org> References: <20261113153811.177190860@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Chris Mason [ Upstream commit c83ee2fa5a94edb2e04102b9dd4f1ee0eeb2b932 ] memfd_pin_folios() pins folios obtained directly from the page cache without checking whether they are uptodate. However, shmem fallocate() can leave newly allocated folios uncleared and not uptodate. Callers such as udmabuf can then expose uninitialized memory to userspace. Clear non-uptodate folios and mark them uptodate under the folio lock before returning them to the caller. Fix generated by an LLM and sent by Chris Mason in private. Fixes: 89c1905d9c14 ("mm/gup: introduce memfd_pin_folios() for pinning memfd folios") Cc: stable@vger.kernel.org Signed-off-by: Chris Mason [ david: simplify description and comment ] Reviewed-by: Pratyush Yadav (Google) Reviewed-by: Samiullah Khawaja Tested-by: Samiullah Khawaja Tested-by: Muhammad Usama Anjum Link: https://patch.msgid.link/20261031-fixes_core-v3-20-d6437171ecc3@kernel.org Reviewed-by: Lance Yang Signed-off-by: David Hildenbrand (Arm) Signed-off-by: Sasha Levin --- mm/gup.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/mm/gup.c b/mm/gup.c index 810a4c32ee870..b4746ab82dd15 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -3774,6 +3774,20 @@ long memfd_pin_folios(struct file *memfd, loff_t start, loff_t end, goto err; } + /* + * fallocate() can leave folios in the + * page cache that were never cleared. + */ + if (!folio_test_uptodate(folio)) { + folio_lock(folio); + if (!folio_test_uptodate(folio)) { + folio_zero_range(folio, 0, folio_size(folio)); + flush_dcache_folio(folio); + folio_mark_uptodate(folio); + } + folio_unlock(folio); + } + if (nr_folios == 0) *offset = offset_in_folio(folio, start); -- 2.53.0