From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C99AB38F947; Sun, 4 Oct 2026 20:08:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791144515; cv=none; b=Kzu0QMJejfwkNEWrt43rlBylCwv95y4EyE903DRU/LS8jDADoJBr4iWjCHj6G5RIn+3miBtQbsQIFRVNec+/9wdvY9wVQb6sWca9GEhzRF8zRdHxVbRuP/mcYFzuOXdslB71Kbl/vw4O+XvQuWDkRzacuHgfKRky3T1CPb8FjMk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791144515; c=relaxed/simple; bh=Mr/2io6B/3cuhwSfHNImjIpSas/+kIagGwy4rZP8jK8=; h=Date:To:From:Subject:Message-Id; b=UWk5qKl6p1wtmvskydlbvBn0xZN0SfSqgJbiWNyfFAYjQdqKLGFqTmWX71+D9jkmL340aofjlLWsmBo4/jxFKysSm42NGJA8QN1f0NAslYgQ0HObcb9HWYCqkcagWyqNWrUt+nnqnb7dbnCfVJy41iWML2lX7Xlhld3tOGxhXVA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=qbtNZG2B; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="qbtNZG2B" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 622691F00893; Sun, 4 Oct 2026 20:08:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-foundation.org; s=korg; t=1791144513; bh=oyfQEDe5LLvOHuhpIL4Z0qUePRtpTKpUVvfiqEsI6Is=; h=Date:To:From:Subject; b=qbtNZG2BoTY+UeSLIvYsnGb+cmX2x5ccACsZGp0VBDCvq09+jPftjIoEsxQmh829s Odt8WXbrHk00W4KMsPjMaOM6XZwOZK+HwQN3mMpk/aP5kQ64W6dnQV8UdIWtw0HKqe TB/TxYYvdYLatYyaMGwAhpzO4vJqMu0NMVmF2U+Q= Date: Sun, 04 Oct 2026 13:08:32 -0700 To: mm-commits@vger.kernel.org,vbabka@kernel.org,surenb@google.com,stable@vger.kernel.org,shuah@kernel.org,rppt@kernel.org,peterx@redhat.com,mhocko@suse.com,ljs@kernel.org,liam@infradead.org,kas@kernel.org,david@kernel.org,aarcange@redhat.com,donggeunyoo.kernel@gmail.com,akpm@linux-foundation.org From: Andrew Morton Subject: + userfaultfd-clear-the-inherited-uffd-bit-in-move_swap_pte.patch added to mm-hotfixes-unstable branch Message-Id: <20261004200833.622691F00893@smtp.kernel.org> Precedence: bulk X-Mailing-List: mm-commits@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: The patch titled Subject: userfaultfd: clear the inherited uffd bit in move_swap_pte() has been added to the -mm mm-hotfixes-unstable branch. Its filename is userfaultfd-clear-the-inherited-uffd-bit-in-move_swap_pte.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/userfaultfd-clear-the-inherited-uffd-bit-in-move_swap_pte.patch This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via various branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there most days ------------------------------------------------------ From: Donggeun Yoo Subject: userfaultfd: clear the inherited uffd bit in move_swap_pte() Date: Sat, 3 Oct 2026 19:30:29 +0900 Patch series "userfaultfd: clear the inherited uffd bit in move_swap_pte()", v4. UFFDIO_MOVE on a swapped-out page installs the source PTE at the destination unchanged, so a uffd bit set on a write-protected or RWP-protected source lands in a destination VMA that was never registered for either, and nothing clears it afterwards. Patch 1 clears the bit, then re-arms it if the destination is RWP-registered, which is what the present-page and zeropage move paths already do. Patch 2 adds the tests that catch it. This patch (of 2): UFFDIO_MOVE on a swapped-out page installs the source PTE at the destination unchanged, so a uffd bit set on a write-protected or RWP-protected source lands in a destination VMA that was never registered for either. Nothing clears it there, and userspace sees: - /proc//pagemap reports the page as uffd-tracked (bit 57), both while it is swapped out and after it is faulted back in. - MADV_COLLAPSE fails with EINVAL on a range containing it, because the collapse scan bails on a swap entry with the uffd bit set. - With CONFIG_PAGE_TABLE_CHECK, faulting the page in warns. do_swap_page() carries the bit into the present PTE and, since the destination isn't WP-registered, also makes it writable: WARNING: mm/page_table_check.c:202 at __page_table_check_ptes_set+0x185/0x1e0 Call Trace: set_ptes+0x67/0xc0 do_swap_page+0x990/0xfe0 __handle_mm_fault+0x7d0/0xeb0 handle_mm_fault+0x9c/0x250 do_user_addr_fault+0x207/0x650 exc_page_fault+0x65/0x150 asm_exc_page_fault+0x26/0x30 Reaching it takes UFFDIO_MOVE out of a WP- or RWP-protected area into one that isn't, on a page that is swapped out at the time. It hasn't been seen in practice. A resident page doesn't carry the bit, because move_present_ptes() builds the destination PTE from dst_vma->vm_page_prot. Clear it on the moved swap entry as well, then re-arm it if the destination is RWP-registered. The WP case has been there since v6.8, where UFFDIO_MOVE was added. Link: https://lore.kernel.org/20261003103030.63380-1-donggeunyoo.kernel@gmail.com Link: https://lore.kernel.org/20261003103030.63380-2-donggeunyoo.kernel@gmail.com Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI") Signed-off-by: Donggeun Yoo Signed-off-by: Andrew Morton Acked-by: David Hildenbrand (Arm) Acked-by: Mike Rapoport (Microsoft) Assisted-by: LLM Cc: Peter Xu Cc: Suren Baghdasaryan Cc: Andrea Arcangeli Cc: Lorenzo Stoakes Cc: Liam R. Howlett Cc: Vlastimil Babka Cc: Michal Hocko Cc: Shuah Khan Cc: Kiryl Shutsemau Cc: --- mm/userfaultfd.c | 1 + 1 file changed, 1 insertion(+) --- a/mm/userfaultfd.c~userfaultfd-clear-the-inherited-uffd-bit-in-move_swap_pte +++ a/mm/userfaultfd.c @@ -1449,6 +1449,7 @@ static int move_swap_pte(struct mm_struc orig_src_pte = ptep_get_and_clear(mm, src_addr, src_pte); if (pgtable_supports_soft_dirty()) orig_src_pte = pte_swp_mksoft_dirty(orig_src_pte); + orig_src_pte = pte_swp_clear_uffd(orig_src_pte); /* Re-arm RWP on the moved swap entry if dst_vma is RWP-registered. */ if (userfaultfd_rwp(dst_vma)) orig_src_pte = pte_swp_mkuffd(orig_src_pte); _ Patches currently in -mm which might be from donggeunyoo.kernel@gmail.com are userfaultfd-clear-the-inherited-uffd-bit-in-move_swap_pte.patch selftests-mm-add-tests-for-uffdio_move-of-a-uffd-protected-swap-entry.patch mm-damon-core-charge-only-the-part-of-a-region-the-filter-left.patch mm-damon-tests-core-kunit-test-the-size-charged-for-a-filter-trimmed-region.patch mm-damon-core-prevent-size-quota-overflow-in-the-temporal-goal-tuner.patch mm-damon-tests-core-kunit-test-the-temporal-tuners-size-quota-conversion.patch