On Wed, Nov 12, 2025 at 08:20:34PM +0530, Deepanshu Kartikey wrote:
When allocating hugetlb folios for memfd, three initialization steps are missing:
- Folios are not zeroed, leading to kernel memory disclosure to userspace
- Folios are not marked uptodate before adding to page cache
- hugetlb_fault_mutex is not taken before hugetlb_add_to_page_cache()
The memfd allocation path bypasses the normal page fault handler (hugetlb_no_page) which would handle all of these initialization steps. This is problematic especially for udmabuf use cases where folios are pinned and directly accessed by userspace via DMA.
Fix by matching the initialization pattern used in hugetlb_no_page():
- Zero the folio using folio_zero_user() which is optimized for huge pages
- Mark it uptodate with folio_mark_uptodate()
- Take hugetlb_fault_mutex before adding to page cache to prevent races
The folio_zero_user() change also fixes a potential security issue where uninitialized kernel memory could be disclosed to userspace through read() or mmap() operations on the memfd.
Reported-by: syzbot+f64019ba229e3a5c411b@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/20251112031631.2315651-1-kartikey406@gmail.com/ [v1] Closes: https://syzkaller.appspot.com/bug?extid=f64019ba229e3a5c411b Fixes: 89c1905d9c14 ("mm/gup: introduce memfd_pin_folios() for pinning memfd folios") Cc: stable@vger.kernel.org Suggested-by: Oscar Salvador osalvador@suse.de Suggested-by: David Hildenbrand david@redhat.com Tested-by: syzbot+f64019ba229e3a5c411b@syzkaller.appspotmail.com Signed-off-by: Deepanshu Kartikey kartikey406@gmail.com
As David mentioned, we can drop the comment wrt. __folio_mark_uptodate. As for the addr_hint in folio_zero_user, I do not think it makes a difference in here. AFAIK, it serves the purpose that subpages belong to the addr_hint will be zeroed the latest to keep them in cache, but here it does not really apply, so '0' should just work?
Acked-by: Oscar Salvador osalvador@suse.de