Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

[Kiryl Shutsemau <kas@kernel.org>]

On Wed, Nov 11, 2026 at 08:29:50AM +0100, David Hildenbrand (Arm) wrote:
> On 11/11/26 04:19, Tal Zussman wrote:
> > On 11/10/26 6:55 AM, David Hildenbrand (Arm) wrote:
> >> On 11/10/26 12:54, n3rd wrote:
> >>>
> >>> Hello,
> >>>
> >>> I am reporting a security bug in the Linux kernel.
> >>
> >> Stop sending uffd problems as security bugs. STOP IT NOW.
> >>
> >> Tal has a long list of uffd-related fixes he is about to send out. CCing him.
> >>
> > So this issue was originally on my list and I had a fix for it... but it was
> > REALLY ugly and a band-aid, so I dropped it.
> 
> Yeah, RWP is a mess.
> 
> > 
> > I think the real solution is to just add actual markers for RWP and solve
> > all of these issues at once... but that should be a separate series from my
> > batch of fixes (which I'll be sending shortly). Is there a reason RWP
> > markers weren't done in the first place that I'm missing?
> 
> Let's ask kiryl: why is it ok to drop RWP PTE bits during swapout, zap, collapse
> etc?
> 
> https://kernel.org/doc/html/latest/admin-guide/mm/userfaultfd.html?utm_source=chatgpt.com
> 
> states "Unlike WP (which persists via PTE_MARKER_UFFD_WP), there is no
> persistent RWP marker today. The user needs to re-arm the range with
> UFFDIO_RWPROTECT after any operation that explicitly frees PTEs."
> 
> But requiring the user to re-arm is rather questionable design if the kernel can
> just zap these page table entries.

There is no need to re-arm. 

Once the PTE is zapped, the next access faults, and userfaultfd already
has a mode for that fault: MINOR if the page is still in the page cache
or in swap, MISSING if it is gone. Register the range with RWP|MINOR and
the first access after collapse, shmem reclaim or MADV_DONTNEED arrives
as a minor fault. The monitor counts it as an access and resolves it
with UFFDIO_CONTINUE.

That is why there is no RWP marker: MINOR already covers it. WP needs a
marker because MINOR would trap reads as well, and a WP user does not
want those.

Anon has no MINOR mode, so there the bit stays wherever the page
survives: it is carried on swap and migration entries, and anon
collapse bails on uffd PTEs with SCAN_PTE_UFFD. MADV_DONTNEED frees the
page, so the next access is a MISSING fault.

The report registers RWP alone. That is the only setup where the access
after collapse goes unreported.

-- 
  Kiryl Shutsemau / Kirill A. Shutemov