[PATCH] userfaultfd: reset err when move_pages_ptes succeeded

[PATCH] userfaultfd: reset err when move_pages_ptes succeeded

[Foxie Flakey]

There is an edge case when move_pages_ptes fails with EAGAIN and then outer
loop attempt to retry and succeeded but "err" isn't reset. This leads to
outer loop retry erroneously on same set of pages that was successfully
moved. This is fixed by resetting "err" when move_pages_ptes succeeded.

Fixes: 50944692052b ("userfaultfd: opportunistic TLB-flush batching for present pages in MOVE")
Signed-off-by: Foxie Flakey <foxieflakey@gmail.com>
Assisted-by: ChatGPT:GPT-5.6-Luna
---
 mm/userfaultfd.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index c3adedaaf7d5..595e7e232f90 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -2069,10 +2069,12 @@ static ssize_t move_pages(struct userfaultfd_ctx *ctx, unsigned long dst_start,
 			ret = move_pages_ptes(mm, dst_pmd, src_pmd,
 					      dst_vma, src_vma, dst_addr,
 					      src_addr, src_end - src_addr, mode);
-			if (ret < 0)
+			if (ret < 0) {
 				err = ret;
-			else
+			} else {
+				err = 0;
 				step_size = ret;
+			}
 		}

 		cond_resched();

base-commit: 62cc90241548d5570ee68e01aaba6506964e9811
-- 
2.55.0

Re: [PATCH] userfaultfd: reset err when move_pages_ptes succeeded

[Ali Nasrolahi]

On 26/08/15 09:13PM, Foxie Flakey wrote:
> 
> There is an edge case when move_pages_ptes fails with EAGAIN and then outer
> loop attempt to retry and succeeded but "err" isn't reset. This leads to
> outer loop retry erroneously on same set of pages that was successfully
> moved. This is fixed by resetting "err" when move_pages_ptes succeeded.
> 
> Fixes: 50944692052b ("userfaultfd: opportunistic TLB-flush batching for present pages in MOVE")
> Signed-off-by: Foxie Flakey <foxieflakey@gmail.com>
> Assisted-by: ChatGPT:GPT-5.6-Luna
> ---
>  mm/userfaultfd.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
> index c3adedaaf7d5..595e7e232f90 100644
> --- a/mm/userfaultfd.c
> +++ b/mm/userfaultfd.c
> @@ -2069,10 +2069,12 @@ static ssize_t move_pages(struct userfaultfd_ctx *ctx, unsigned long dst_start,
>  			ret = move_pages_ptes(mm, dst_pmd, src_pmd,
>  					      dst_vma, src_vma, dst_addr,
>  					      src_addr, src_end - src_addr, mode);
> -			if (ret < 0)
> +			if (ret < 0) {
>  				err = ret;
> -			else
> +			} else {
> +				err = 0;
>  				step_size = ret;
> +			}
>  		}
> 
>  		cond_resched();
> 
> base-commit: 62cc90241548d5570ee68e01aaba6506964e9811
> -- 
> 2.55.0
> 
> 

Hi,

Use `./scripts/get_maintainer.pl <file>` to figure out to which mailing
list you should send your patches. Also don't forget to CC the subsytem
and the file maintainer. I don't think this is the correct mailing list
for your patch :)

Cheers,
    Ali

Re: [PATCH] userfaultfd: reset err when move_pages_ptes succeeded

[Foxie Flakey]

On Sat, 15 Aug 2026, Ali Nasrolahi wrote:

> Hi,
>
> Use `./scripts/get_maintainer.pl <file>` to figure out to which mailing
> list you should send your patches. Also don't forget to CC the subsytem
> and the file maintainer. I don't think this is the correct mailing list
> for your patch :)

Thanks! I already sent it previously but there was few issues pointed
by someone on IRC and I was sending here so they can check.

> Cheers,
>     Ali
>

[PATCH] userfaultfd: reset err when move_pages_ptes succeeded

[Foxie Flakey]

There is an edge case when move_pages_ptes fails with EAGAIN and then outer
loop attempt to retry and succeeded but "err" isn't reset, outer loop did
retry erroneously on same set of pages that was successfully moved. This is
fixed by resetting "err" when move_pages_ptes succeeded.

Fixes: 50944692052b ("userfaultfd: opportunistic TLB-flush batching for present pages in MOVE")
Signed-off-by: Foxie Flakey <foxieflakey@gmail.com>
Assisted-by: ChatGPT:GPT-5.6-Luna
---
 mm/userfaultfd.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index c3adedaaf7d5..595e7e232f90 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -2069,10 +2069,12 @@ static ssize_t move_pages(struct userfaultfd_ctx *ctx, unsigned long dst_start,
 			ret = move_pages_ptes(mm, dst_pmd, src_pmd,
 					      dst_vma, src_vma, dst_addr,
 					      src_addr, src_end - src_addr, mode);
-			if (ret < 0)
+			if (ret < 0) {
 				err = ret;
-			else
+			} else {
+				err = 0;
 				step_size = ret;
+			}
 		}

 		cond_resched();

base-commit: 62cc90241548d5570ee68e01aaba6506964e9811
-- 
2.55.0

[PATCH] userfaultfd: reset err when move_pages_ptes succeeded

[Foxie Flakey]

When UFFDIO_MOVE moves non huge pages and temporarily fails, then the outer
loop retries again and succeeded but in that path "err" isn't reset to 0.
Later, when checked for EAGAIN error, the loop mistakenly retries moving
same page again which will fail because its already moved.

When the UFFDIO_MOVE returned, this is what userspace observed.

Source:      [ .. unmapped  .. ][ .. mapped    ..]
Destination: [ .. mapped    .. ][ .. unmapped  ..]
                          ^     ^
                          \     Kernel moved this far in actuality
                           What is reported to userspace on struct
                           uffdio_move's move field

When the previous behaviour is
Source:      [ .. unmapped  .. ][ .. mapped    ..]
Destination: [ .. mapped    .. ][ .. unmapped  ..]
                                ^
                                Reported to user space via uffdio_move's
                                move field

Fixes: 50944692052b ("userfaultfd: opportunistic TLB-flush batching for present pages in MOVE")
Signed-off-by: Foxie Flakey <foxieflakey@gmail.com>
Assisted-by: ChatGPT:GPT-5.6-Luna
---
 mm/userfaultfd.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index c3adedaaf7d5..595e7e232f90 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -2069,10 +2069,12 @@ static ssize_t move_pages(struct userfaultfd_ctx *ctx, unsigned long dst_start,
 			ret = move_pages_ptes(mm, dst_pmd, src_pmd,
 					      dst_vma, src_vma, dst_addr,
 					      src_addr, src_end - src_addr, mode);
-			if (ret < 0)
+			if (ret < 0) {
 				err = ret;
-			else
+			} else {
+				err = 0;
 				step_size = ret;
+			}
 		}

 		cond_resched();

base-commit: 62cc90241548d5570ee68e01aaba6506964e9811
-- 
2.55.0