Re: [PATCH v7 06/15] mm: add MM_CP_UFFD_RWP change_protection() flag

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] MM_CP_UFFD_RWP silently destroys RWP protection and unmaps file-backed THPs.
--

commit 82229f238feb5343260ad7c878148b9a54c5893a
Author: Kiryl Shutsemau (Meta) <kas@kernel.org>

mm: add MM_CP_UFFD_RWP change_protection() flag

This patch introduces the MM_CP_UFFD_RWP and MM_CP_UFFD_RWP_RESOLVE flags
for userfaultfd RWP. The flags are wired through change_pte_range,
change_huge_pmd, and hugetlb_change_protection to install PROT_NONE with
a userfaultfd marker.

> diff --git a/mm/mprotect.c b/mm/mprotect.c
> index 8340c8b228c67..7dcc94e7bfd60 100644
> --- a/mm/mprotect.c
> +++ b/mm/mprotect.c
[ ... ]
> @@ -428,7 +441,7 @@ pgtable_split_needed(struct vm_area_struct *vma, unsigned long cp_flags)
>  	 * (e.g. 2M shmem) because file thp is handled differently when
>  	 * split by erasing the pmd so far.
>  	 */
> -	return (cp_flags & MM_CP_UFFD_WP) && !vma_is_anonymous(vma);
> +	return (cp_flags & (MM_CP_UFFD_WP | MM_CP_UFFD_RWP)) && !vma_is_anonymous(vma);
>  }

[Severity: High]
When a file-backed THP is split because pgtable_split_needed() returns true
here, __split_huge_pmd() clears the PMD and change_pmd_prepare() allocates
an empty PTE table with all none PTEs.

Then change_pte_range() processes these none PTEs, but it has this check:

mm/mprotect.c:change_pte_range() {
    ...
		} else if (pte_none(oldpte)) {
			/*
			 * Nobody plays with any none ptes besides
			 * userfaultfd when applying the protections.
			 */
			if (likely(!uffd_wp))
				continue;
    ...
}

Since uffd_wp is false during an MM_CP_UFFD_RWP operation, won't this cause
the none PTEs resulting from the THP split to be silently skipped?

This would leave the previously populated file-backed THP pages unmapped and
without any RWP protection markers. When they are accessed again, they might
fault back in with default permissions, bypassing the requested RWP tracking.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260629120749.566063-1-kirill@shutemov.name?part=6