[RFC PATCH v2 1/3] mm/huge_memory: make persistent huge zero folio read-only

[David Hildenbrand (Arm)]

On 6/10/26 04:15, Lance Yang wrote:
> 
> On Tue, Jun 09, 2026 at 12:45:49PM -0700, Andrew Morton wrote:
>> On Tue,  9 Jun 2026 22:37:59 +0800 Xueyuan Chen <xueyuan.chen21 at gmail.com> wrote:
>>
>>> The huge zero folio is shared globally, and its contents should never
>>> change after initialization. As Jann Horn pointed out[1], the kernel has
>>> had bugs, including security bugs, where read-only pages were later written
>>> to. If the persistent huge zero folio is read-only in the direct map, such
>>> writes fault instead of silently corrupting the shared zero contents.
>>>
>>> Add arch_make_pages_readonly() so mm code can request read-only direct-map
>>> protection for a page range. Direct-map protection is
>>> architecture-specific, so the generic weak implementation does nothing.
>>>
>>> This was inspired by Jann Horn's read-only zero page work[1] and follow-up
>>> discussion[2] with Yang Shi.
>>>
>>> [1] https://lore.kernel.org/linux-mm/20260508-ro-zeropage-v1-1-9808abc20b49@google.com/
>>> [2] https://lore.kernel.org/linux-mm/CAHbLzkrXXe7r3n3jXgDKtwZhRqj=jDx9E6dLOULohnhBguvi9A@mail.gmail.com/
>>>
>>> ...
>>>
>>> --- a/mm/huge_memory.c
>>> +++ b/mm/huge_memory.c
>>> @@ -308,6 +308,11 @@ static unsigned long shrink_huge_zero_folio_scan(struct shrinker *shrink,
>>>  	return 0;
>>>  }
>>>  
>>> +bool __weak arch_make_pages_readonly(struct page *page, int nr_pages)
>>> +{
>>> +	return false;
>>> +}
>>> +
>>>  static struct shrinker *huge_zero_folio_shrinker;
>>>  
>>>  #ifdef CONFIG_SYSFS
>>> @@ -982,8 +987,14 @@ static int __init thp_shrinker_init(void)
>>>  		 * that get_huge_zero_folio() will most likely not fail as
>>>  		 * thp_shrinker_init() is invoked early on during boot.
>>>  		 */
>>> -		if (!get_huge_zero_folio())
>>> +		if (!get_huge_zero_folio()) {
>>>  			pr_warn("Allocating persistent huge zero folio failed\n");
>>> +			return 0;
>>> +		}
>>> +
>>> +		arch_make_pages_readonly(folio_page(huge_zero_folio, 0),
>>> +					HPAGE_PMD_NR);
>>
>> Can it simply pass the folio?
> 
> Right, this came from the RFC v1 discussion[1]. David preferred a page-
> range helper for possible future non-folio callers, not something folio-
> only.
> 
> Of course, we could also add a folio wrapper on top of that if needed :)

Best to document that as part of the patch description: we don't really expect
to have a lot of read-only folios in the near future (zero page is rather
special; maybe it won't even be a folio in the future).

-- 
Cheers,

David