From: Kiryl Shutsemau <kirill@shutemov.name>
To: shaos <shawnq1@163.com>
Cc: akpm@linux-foundation.org, Mike Rapoport <rppt@kernel.org>,
David Hildenbrand <david@kernel.org>,
Peter Xu <peterx@redhat.com>,
linux-mm@kvack.org, linux-kernel@vger.kernel.org
Subject: Re: [BUG] mm: userfaultfd RWP drops a populated shmem PMD
Date: Wed, 21 Oct 2026 10:11:23 +0100 [thread overview]
Message-ID: <atiAML2RPQlCEhbB@thinkstation> (raw)
In-Reply-To: <20261020110759.960089-1-shawnq1@163.com>
On Tue, Oct 20, 2026 at 11:07:59AM +0000, shaos wrote:
> Hello,
>
> UFFDIO_RWPROTECT_MODE_RWP can return success for a present shmem THP
> mapping while dropping the PMD mapping instead of leaving the
> populated page resident and write-protected. The next read refaults
> the page and completes without a UFFD_PAGEFAULT_FLAG_RWP event.
RWP only traps accesses to present PTEs. Arming a PMD-mapped shmem THP
splits the PMD, and splitting a file PMD unmaps it, so nothing is left
to protect. Populating the page table would not help: the PTEs are
empty and there is no RWP marker to put in them.
I think the right way to deal with it is for userspace to register the
range with UFFDIO_REGISTER_MODE_MINOR as well, and count the MINOR fault
that follows as an access.
--
Kiryl Shutsemau / Kirill A. Shutemov
prev parent reply other threads:[~2026-10-21 9:11 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-20 11:07 [BUG] mm: userfaultfd RWP drops a populated shmem PMD shaos
2026-10-20 13:00 ` David Hildenbrand (Arm)
2026-10-21 9:11 ` Kiryl Shutsemau [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=atiAML2RPQlCEhbB@thinkstation \
--to=kirill@shutemov.name \
--cc=akpm@linux-foundation.org \
--cc=david@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=peterx@redhat.com \
--cc=rppt@kernel.org \
--cc=shawnq1@163.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.