On Wed, Mar 31, 2021 at 07:07:39AM +0100, Matthew Wilcox wrote:

On Wed, Mar 31, 2021 at 01:52:59AM +0000, HORIGUCHI NAOYA(堀口 直也) wrote:

quoted

If we successfully unmapped but failed in truncate_error_page() for example,
the processes mapping the page would get -EFAULT as expected.  But even in
this case, other processes could reach the error page via page cache and
__get_user_pages_locked() for them could return the hwpoisoned page.

How would that happen?  We check PageHWPoison before inserting a page
into the page tables.  See, eg, filemap_map_pages() and __do_fault().

Ah, you're right, that never happens. I misread the code.
Thanks for correcting me.