Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

["David Hildenbrand (Arm)" <david@kernel.org>]

On 11/11/26 04:19, Tal Zussman wrote:
> On 11/10/26 6:55 AM, David Hildenbrand (Arm) wrote:
>> On 11/10/26 12:54, n3rd wrote:
>>>
>>> Hello,
>>>
>>> I am reporting a security bug in the Linux kernel.
>>
>> Stop sending uffd problems as security bugs. STOP IT NOW.
>>
>> Tal has a long list of uffd-related fixes he is about to send out. CCing him.
>>
> So this issue was originally on my list and I had a fix for it... but it was
> REALLY ugly and a band-aid, so I dropped it.

Yeah, RWP is a mess.

> 
> I think the real solution is to just add actual markers for RWP and solve
> all of these issues at once... but that should be a separate series from my
> batch of fixes (which I'll be sending shortly). Is there a reason RWP
> markers weren't done in the first place that I'm missing?

Let's ask kiryl: why is it ok to drop RWP PTE bits during swapout, zap, collapse
etc?

https://kernel.org/doc/html/latest/admin-guide/mm/userfaultfd.html?utm_source=chatgpt.com

states "Unlike WP (which persists via PTE_MARKER_UFFD_WP), there is no
persistent RWP marker today. The user needs to re-arm the range with
UFFDIO_RWPROTECT after any operation that explicitly frees PTEs."

But requiring the user to re-arm is rather questionable design if the kernel can
just zap these page table entries.

@Jose, maybe you want to look into marker support for RWP to make RWP a bit less
horrible?


-- 
Cheers,

David