From c83ee2fa5a94edb2e04102b9dd4f1ee0eeb2b932 Mon Sep 17 00:00:00 2001 From: Chris Mason Date: Sat, 31 Oct 2026 10:39:49 +0100 Subject: [PATCH] mm/gup: fix clearing folios in memfd_pin_folios() memfd_pin_folios() pins folios obtained directly from the page cache without checking whether they are uptodate. However, shmem fallocate() can leave newly allocated folios uncleared and not uptodate. Callers such as udmabuf can then expose uninitialized memory to userspace. Clear non-uptodate folios and mark them uptodate under the folio lock before returning them to the caller. Fix generated by an LLM and sent by Chris Mason in private. Fixes: 89c1905d9c14 ("mm/gup: introduce memfd_pin_folios() for pinning memfd folios") Cc: stable@vger.kernel.org Signed-off-by: Chris Mason [ david: simplify description and comment ] Reviewed-by: Pratyush Yadav (Google) Reviewed-by: Samiullah Khawaja Tested-by: Samiullah Khawaja Tested-by: Muhammad Usama Anjum Link: https://patch.msgid.link/20261031-fixes_core-v3-20-d6437171ecc3@kernel.org Reviewed-by: Lance Yang Signed-off-by: David Hildenbrand (Arm) --- mm/gup.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/mm/gup.c b/mm/gup.c index f809361227e7..cc4fa18783ce 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -3527,6 +3527,20 @@ long memfd_pin_folios(struct file *memfd, loff_t start, loff_t end, goto err; } + /* + * fallocate() can leave folios in the + * page cache that were never cleared. + */ + if (!folio_test_uptodate(folio)) { + folio_lock(folio); + if (!folio_test_uptodate(folio)) { + folio_zero_range(folio, 0, folio_size(folio)); + flush_dcache_folio(folio); + folio_mark_uptodate(folio); + } + folio_unlock(folio); + } + if (nr_folios == 0) *offset = offset_in_folio(folio, start);