linux-kernel - Re: [PATCH] mm/memfd: clear hugetlb pages on allocation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CADhLXY6keq6+0NY_=xiugguHNFGpFGc07ePWbiTTFU3qO534rg@mail.gmail.com>
Date: Wed, 12 Nov 2025 17:36:27 +0530
From: Deepanshu Kartikey <kartikey406@...il.com>
To: Oscar Salvador <osalvador@...e.de>
Cc: "David Hildenbrand (Red Hat)" <david@...nel.org>, Hugh Dickins <hughd@...gle.com>, 
	Muchun Song <muchun.song@...ux.dev>, Vivek Kasireddy <vivek.kasireddy@...el.com>, 
	baolin.wang@...ux.alibaba.com, akpm@...ux-foundation.org, linux-mm@...ck.org, 
	linux-kernel@...r.kernel.org, 
	syzbot+f64019ba229e3a5c411b@...kaller.appspotmail.com
Subject: Re: [PATCH] mm/memfd: clear hugetlb pages on allocation

Hi Oscar and David,

Thanks for the guidance!

> I guess it is worth looking into it, I shall fiddle with it.

Great, I'll focus on fixing the immediate bugs in v2 and you can handle
the refactoring in a follow-up. This keeps my patch focused on the
security fix + the missing initialization steps.

> Yes, I would go with folio_zero_user() as well, to match what we do in
> all paths.

Understood. I'll use folio_zero_user() in v2.

So for v2, I'll add:
1. folio_zero_user() instead of folio_zero_range()
2. folio_mark_uptodate()
3. hugetlb_fault_mutex locking around hugetlb_add_to_page_cache()

This will match the pattern in hugetlb_no_page() and fix the information
leak, missing uptodate flag, and locking issue.

I'll send v2 shortly after testing.

Thanks,
Deepanshu