* + userfaultfd-clear-the-inherited-uffd-bit-in-move_swap_pte.patch added to mm-hotfixes-unstable branch
@ 2026-10-04 20:08 Andrew Morton
0 siblings, 0 replies; 3+ messages in thread
From: Andrew Morton @ 2026-10-04 20:08 UTC (permalink / raw)
To: mm-commits, vbabka, surenb, stable, shuah, rppt, peterx, mhocko,
ljs, liam, kas, david, aarcange, donggeunyoo.kernel, akpm
The patch titled
Subject: userfaultfd: clear the inherited uffd bit in move_swap_pte()
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
userfaultfd-clear-the-inherited-uffd-bit-in-move_swap_pte.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/userfaultfd-clear-the-inherited-uffd-bit-in-move_swap_pte.patch
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days
------------------------------------------------------
From: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
Subject: userfaultfd: clear the inherited uffd bit in move_swap_pte()
Date: Sat, 3 Oct 2026 19:30:29 +0900
Patch series "userfaultfd: clear the inherited uffd bit in
move_swap_pte()", v4.
UFFDIO_MOVE on a swapped-out page installs the source PTE at the
destination unchanged, so a uffd bit set on a write-protected or
RWP-protected source lands in a destination VMA that was never registered
for either, and nothing clears it afterwards. Patch 1 clears the bit,
then re-arms it if the destination is RWP-registered, which is what the
present-page and zeropage move paths already do. Patch 2 adds the tests
that catch it.
This patch (of 2):
UFFDIO_MOVE on a swapped-out page installs the source PTE at the
destination unchanged, so a uffd bit set on a write-protected or
RWP-protected source lands in a destination VMA that was never
registered for either. Nothing clears it there, and userspace sees:
- /proc/<pid>/pagemap reports the page as uffd-tracked (bit 57), both
while it is swapped out and after it is faulted back in.
- MADV_COLLAPSE fails with EINVAL on a range containing it, because the
collapse scan bails on a swap entry with the uffd bit set.
- With CONFIG_PAGE_TABLE_CHECK, faulting the page in warns.
do_swap_page() carries the bit into the present PTE and, since the
destination isn't WP-registered, also makes it writable:
WARNING: mm/page_table_check.c:202 at __page_table_check_ptes_set+0x185/0x1e0
Call Trace:
set_ptes+0x67/0xc0
do_swap_page+0x990/0xfe0
__handle_mm_fault+0x7d0/0xeb0
handle_mm_fault+0x9c/0x250
do_user_addr_fault+0x207/0x650
exc_page_fault+0x65/0x150
asm_exc_page_fault+0x26/0x30
Reaching it takes UFFDIO_MOVE out of a WP- or RWP-protected area into
one that isn't, on a page that is swapped out at the time. It hasn't
been seen in practice.
A resident page doesn't carry the bit, because move_present_ptes() builds
the destination PTE from dst_vma->vm_page_prot. Clear it on the moved
swap entry as well, then re-arm it if the destination is RWP-registered.
The WP case has been there since v6.8, where UFFDIO_MOVE was added.
Link: https://lore.kernel.org/20261003103030.63380-1-donggeunyoo.kernel@gmail.com
Link: https://lore.kernel.org/20261003103030.63380-2-donggeunyoo.kernel@gmail.com
Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Assisted-by: LLM
Cc: Peter Xu <peterx@redhat.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: <stable@vger.kernel.org>
---
mm/userfaultfd.c | 1 +
1 file changed, 1 insertion(+)
--- a/mm/userfaultfd.c~userfaultfd-clear-the-inherited-uffd-bit-in-move_swap_pte
+++ a/mm/userfaultfd.c
@@ -1449,6 +1449,7 @@ static int move_swap_pte(struct mm_struc
orig_src_pte = ptep_get_and_clear(mm, src_addr, src_pte);
if (pgtable_supports_soft_dirty())
orig_src_pte = pte_swp_mksoft_dirty(orig_src_pte);
+ orig_src_pte = pte_swp_clear_uffd(orig_src_pte);
/* Re-arm RWP on the moved swap entry if dst_vma is RWP-registered. */
if (userfaultfd_rwp(dst_vma))
orig_src_pte = pte_swp_mkuffd(orig_src_pte);
_
Patches currently in -mm which might be from donggeunyoo.kernel@gmail.com are
userfaultfd-clear-the-inherited-uffd-bit-in-move_swap_pte.patch
selftests-mm-add-tests-for-uffdio_move-of-a-uffd-protected-swap-entry.patch
mm-damon-core-charge-only-the-part-of-a-region-the-filter-left.patch
mm-damon-tests-core-kunit-test-the-size-charged-for-a-filter-trimmed-region.patch
mm-damon-core-prevent-size-quota-overflow-in-the-temporal-goal-tuner.patch
mm-damon-tests-core-kunit-test-the-temporal-tuners-size-quota-conversion.patch
^ permalink raw reply [flat|nested] 3+ messages in thread* + userfaultfd-clear-the-inherited-uffd-bit-in-move_swap_pte.patch added to mm-hotfixes-unstable branch
@ 2026-09-27 21:38 Andrew Morton
0 siblings, 0 replies; 3+ messages in thread
From: Andrew Morton @ 2026-09-27 21:38 UTC (permalink / raw)
To: mm-commits, vbabka, surenb, stable, shuah, rppt, peterx, mhocko,
ljs, liam, kas, david, aarcange, donggeunyoo.kernel, akpm
The patch titled
Subject: userfaultfd: clear the inherited uffd bit in move_swap_pte()
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
userfaultfd-clear-the-inherited-uffd-bit-in-move_swap_pte.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/userfaultfd-clear-the-inherited-uffd-bit-in-move_swap_pte.patch
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days
------------------------------------------------------
From: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
Subject: userfaultfd: clear the inherited uffd bit in move_swap_pte()
Date: Sat, 26 Sep 2026 21:41:44 +0900
Patch series "userfaultfd: clear the inherited uffd bit in
move_swap_pte()", v3.
UFFDIO_MOVE on a swapped-out page installs the source PTE at the
destination unchanged, so a uffd bit set on a write-protected or
RWP-protected source lands in a destination VMA that was never registered
for either, and nothing clears it afterwards. Patch 1 clears the bit,
then re-arms it if the destination is RWP-registered, which is what the
present-page and zeropage move paths already do. Patch 2 adds the tests
that catch it.
This patch (of 2):
UFFDIO_MOVE on a swapped-out page installs the source PTE at the
destination unchanged, so a uffd bit set on a write-protected or
RWP-protected source lands in a destination VMA that was never registered
for either. Nothing clears it there, and userspace sees:
- /proc/<pid>/pagemap reports the page as uffd-tracked (bit 57), both
while it is swapped out and after it is faulted back in.
- MADV_COLLAPSE fails with EINVAL on a range containing it, because the
collapse scan bails on a swap entry with the uffd bit set.
- With CONFIG_PAGE_TABLE_CHECK, faulting the page in warns.
do_swap_page() carries the bit into the present PTE and, since the
destination isn't WP-registered, also makes it writable:
WARNING: mm/page_table_check.c:202 at __page_table_check_ptes_set+0x185/0x1e0
Call Trace:
set_ptes+0x67/0xc0
do_swap_page+0x990/0xfe0
__handle_mm_fault+0x7d0/0xeb0
handle_mm_fault+0x9c/0x250
do_user_addr_fault+0x207/0x650
exc_page_fault+0x65/0x150
asm_exc_page_fault+0x26/0x30
Reaching it takes UFFDIO_MOVE out of a WP- or RWP-protected area into one
that isn't, on a page that is swapped out at the time. It hasn't been
seen in practice.
A resident page doesn't carry the bit, because move_present_ptes() builds
the destination PTE from dst_vma->vm_page_prot. Clear it on the moved
swap entry as well, then re-arm it if the destination is RWP-registered.
The WP case has been there since v6.8, where UFFDIO_MOVE was added.
Link: https://lore.kernel.org/20260926124145.2878520-1-donggeunyoo.kernel@gmail.com
Link: https://lore.kernel.org/20260926124145.2878520-2-donggeunyoo.kernel@gmail.com
Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Assisted-by: LLM
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Peter Xu <peterx@redhat.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: <stable@vger.kernel.org>
---
mm/userfaultfd.c | 1 +
1 file changed, 1 insertion(+)
--- a/mm/userfaultfd.c~userfaultfd-clear-the-inherited-uffd-bit-in-move_swap_pte
+++ a/mm/userfaultfd.c
@@ -1449,6 +1449,7 @@ static int move_swap_pte(struct mm_struc
orig_src_pte = ptep_get_and_clear(mm, src_addr, src_pte);
if (pgtable_supports_soft_dirty())
orig_src_pte = pte_swp_mksoft_dirty(orig_src_pte);
+ orig_src_pte = pte_swp_clear_uffd(orig_src_pte);
/* Re-arm RWP on the moved swap entry if dst_vma is RWP-registered. */
if (userfaultfd_rwp(dst_vma))
orig_src_pte = pte_swp_mkuffd(orig_src_pte);
_
Patches currently in -mm which might be from donggeunyoo.kernel@gmail.com are
userfaultfd-clear-the-inherited-uffd-bit-in-move_swap_pte.patch
selftests-mm-add-tests-for-uffdio_move-of-a-uffd-protected-swap-entry.patch
mm-damon-core-charge-only-the-part-of-a-region-the-filter-left.patch
mm-damon-tests-core-kunit-test-the-size-charged-for-a-filter-trimmed-region.patch
^ permalink raw reply [flat|nested] 3+ messages in thread* + userfaultfd-clear-the-inherited-uffd-bit-in-move_swap_pte.patch added to mm-hotfixes-unstable branch
@ 2026-09-27 21:01 Andrew Morton
0 siblings, 0 replies; 3+ messages in thread
From: Andrew Morton @ 2026-09-27 21:01 UTC (permalink / raw)
To: mm-commits, vbabka, surenb, stable, shuah, rppt, peterx, mhocko,
ljs, liam, kas, david, aarcange, donggeunyoo.kernel, akpm
The patch titled
Subject: userfaultfd: clear the inherited uffd bit in move_swap_pte()
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
userfaultfd-clear-the-inherited-uffd-bit-in-move_swap_pte.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/userfaultfd-clear-the-inherited-uffd-bit-in-move_swap_pte.patch
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days
------------------------------------------------------
From: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
Subject: userfaultfd: clear the inherited uffd bit in move_swap_pte()
Date: Sat, 26 Sep 2026 21:41:44 +0900
Patch series "userfaultfd: clear the inherited uffd bit in
move_swap_pte()", v3.
UFFDIO_MOVE on a swapped-out page installs the source PTE at the
destination unchanged, so a uffd bit set on a write-protected or
RWP-protected source lands in a destination VMA that was never registered
for either, and nothing clears it afterwards. Patch 1 clears the bit,
then re-arms it if the destination is RWP-registered, which is what the
present-page and zeropage move paths already do. Patch 2 adds the tests
that catch it.
This patch (of 2):
UFFDIO_MOVE on a swapped-out page installs the source PTE at the
destination unchanged, so a uffd bit set on a write-protected or
RWP-protected source lands in a destination VMA that was never registered
for either. Nothing clears it there, and userspace sees:
- /proc/<pid>/pagemap reports the page as uffd-tracked (bit 57), both
while it is swapped out and after it is faulted back in.
- MADV_COLLAPSE fails with EINVAL on a range containing it, because the
collapse scan bails on a swap entry with the uffd bit set.
- With CONFIG_PAGE_TABLE_CHECK, faulting the page in warns.
do_swap_page() carries the bit into the present PTE and, since the
destination isn't WP-registered, also makes it writable:
WARNING: mm/page_table_check.c:202 at __page_table_check_ptes_set+0x185/0x1e0
Call Trace:
set_ptes+0x67/0xc0
do_swap_page+0x990/0xfe0
__handle_mm_fault+0x7d0/0xeb0
handle_mm_fault+0x9c/0x250
do_user_addr_fault+0x207/0x650
exc_page_fault+0x65/0x150
asm_exc_page_fault+0x26/0x30
Reaching it takes UFFDIO_MOVE out of a WP- or RWP-protected area into one
that isn't, on a page that is swapped out at the time. It hasn't been
seen in practice.
A resident page doesn't carry the bit, because move_present_ptes() builds
the destination PTE from dst_vma->vm_page_prot. Clear it on the moved
swap entry as well, then re-arm it if the destination is RWP-registered.
The WP case has been there since v6.8, where UFFDIO_MOVE was added.
Link: https://lore.kernel.org/20260926124145.2878520-1-donggeunyoo.kernel@gmail.com
Link: https://lore.kernel.org/20260926124145.2878520-2-donggeunyoo.kernel@gmail.com
Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Assisted-by: LLM
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Peter Xu <peterx@redhat.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: <stable@vger.kernel.org>
---
mm/userfaultfd.c | 1 +
1 file changed, 1 insertion(+)
--- a/mm/userfaultfd.c~userfaultfd-clear-the-inherited-uffd-bit-in-move_swap_pte
+++ a/mm/userfaultfd.c
@@ -1449,6 +1449,7 @@ static int move_swap_pte(struct mm_struc
orig_src_pte = ptep_get_and_clear(mm, src_addr, src_pte);
if (pgtable_supports_soft_dirty())
orig_src_pte = pte_swp_mksoft_dirty(orig_src_pte);
+ orig_src_pte = pte_swp_clear_uffd(orig_src_pte);
/* Re-arm RWP on the moved swap entry if dst_vma is RWP-registered. */
if (userfaultfd_rwp(dst_vma))
orig_src_pte = pte_swp_mkuffd(orig_src_pte);
_
Patches currently in -mm which might be from donggeunyoo.kernel@gmail.com are
userfaultfd-clear-the-inherited-uffd-bit-in-move_swap_pte.patch
selftests-mm-add-tests-for-uffdio_move-of-a-uffd-protected-swap-entry.patch
mm-damon-core-charge-only-the-part-of-a-region-the-filter-left.patch
mm-damon-tests-core-kunit-test-the-size-charged-for-a-filter-trimmed-region.patch
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-10-04 20:08 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-04 20:08 + userfaultfd-clear-the-inherited-uffd-bit-in-move_swap_pte.patch added to mm-hotfixes-unstable branch Andrew Morton
-- strict thread matches above, loose matches on Subject: below --
2026-09-27 21:38 Andrew Morton
2026-09-27 21:01 Andrew Morton
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.