Re: [PATCH v3] mm/memory: refuse to map page cache folios that are not uptodate

[Pedro Falcato]

On Wed, Nov 11, 2026 at 06:24:43PM +0000, Kiryl Shutsemau (Meta) wrote:
> A page cache folio that is not uptodate holds data that was never read
> in or cleared. shmem fallocate(2), for one, adds such folios and clears
> them only on first use. Mapping one hands userspace whatever the memory
> held before.
> 
> Each path that maps page cache checks for this itself: fault-around in
> next_uptodate_folio(), a fault in filemap_fault() or shmem_get_folio().
> Nothing in the mapping code does, so a caller that misses the check
> leaks stale memory silently. MADV_COLLAPSE did exactly that with
> fallocated shmem THPs until recently.
> 
> Warn and refuse the mapping in __do_fault() and do_set_pmd().
> 
> __do_fault() checks the folio ->fault() returned while it is still
> locked. For CoW, that is the page cache folio that do_cow_fault()
> copies from. do_set_pmd() covers MADV_COLLAPSE, which maps without a
> fault.
> 
> do_shared_fault() then unlocks the folio for ->page_mkwrite(). A
> filesystem that clears PG_uptodate on a folio in the page cache is
> buggy, so that window gets no check of its own.
> 
> The fault gets SIGBUS, as for a folio that fails to read in.
> MADV_COLLAPSE fails and leaves the range to be faulted in.
> 
> Suggested-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>
> Signed-off-by: Kiryl Shutsemau (Meta) <kas@xxxxxxxxxx>

Reviewed-by: Pedro Falcato <pfalcato@xxxxxxx>
 

-- 
Pedro