From 23f2a880c0b9518fcb7e7e2ad54a29c0a2c4fba0 Mon Sep 17 00:00:00 2001 From: "David Hildenbrand (Arm)" Date: Thu, 29 Oct 2026 11:43:30 +0100 Subject: [PATCH] mm/shmem: discard whole new large folios on fallocate rollback When undoing a failed fallocate(), shmem_undo_range() must discard each newly allocated folio. Its second scan instead passes large folios to truncate_inode_partial_folio(), which does not necessarily discard the entire large folio, but instead tries splitting it to discard only the requested range. For example, with huge=always, a failed allocation starting at offset 4 KiB can leave page 0 allocated in an otherwise empty file. Discard the whole folio when unfalloc is set. Note that we enter this path only for folios that are not uptodate, and can consequently be dropped without losing any data. Fixes: 55ac8bbe358b ("mm/shmem: fix race in shmem_undo_range w/THP") Cc: stable@vger.kernel.org Reviewed-by: Zi Yan Acked-by: Kiryl Shutsemau (Meta) Reviewed-by: Baolin Wang Tested-by: Gregory Price (Meta) Link: https://patch.msgid.link/20261029-fixes_shmem-v4-9-392fc715d8f6@kernel.org Signed-off-by: David Hildenbrand (Arm) --- mm/shmem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/shmem.c b/mm/shmem.c index 11c3e6b1aa76..151704b2091d 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -1473,7 +1473,7 @@ static void shmem_undo_range(struct inode *inode, loff_t lstart, uoff_t lend, if (!unfalloc && folio_test_large(folio)) folio_mark_dirty(folio); - if (!folio_test_large(folio)) { + if (unfalloc || !folio_test_large(folio)) { truncate_inode_folio(mapping, folio); } else if (truncate_inode_partial_folio(folio, lstart, lend, NULL, NULL)) {