On Wed, Mar 31, 2021 at 01:52:59AM +0000, HORIGUCHI NAOYA(堀口 直也) wrote: > If we successfully unmapped but failed in truncate_error_page() for example, > the processes mapping the page would get -EFAULT as expected. But even in > this case, other processes could reach the error page via page cache and > __get_user_pages_locked() for them could return the hwpoisoned page.
How would that happen? We check PageHWPoison before inserting a page into the page tables. See, eg, filemap_map_pages() and __do_fault().
