Re: [PATCH 06/12] mm/huge_memory: build the moved huge zero PMD from the destination VMA

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Critical] mm: clean+writable PTEs and UFFD_WP bypass in
  move_present_ptes() [1]
--

commit a31e8bf5652b13454bb968641961e319c67afcd0
Author: Tal Zussman <tz2294@columbia.edu>

mm/huge_memory: build the moved huge zero PMD from the destination VMA

This commit builds the destination PMD for a moved huge zero page from
dst_vma->vm_page_prot instead of copying the source PMD.

> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> index 0d589be136d21..09176b290f768 100644
> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c
> @@ -2981,9 +2981,9 @@ int move_pages_huge_pmd(struct mm_struct *mm, pmd_t *dst_pmd, pmd_t *src_pmd, pm
>  		/* Follow mremap() behavior and treat the entry dirty after the move */
>  		_dst_pmd = pmd_mkwrite(pmd_mkdirty(_dst_pmd), dst_vma);
>  	} else {
> -		src_pmdval = pmdp_huge_clear_flush(src_vma, src_addr, src_pmd);
> -		_dst_pmd = move_soft_dirty_pmd(src_pmdval);
> -		_dst_pmd = clear_uffd_wp_pmd(_dst_pmd);
> +		pmdp_huge_clear_flush(src_vma, src_addr, src_pmd);
> +		_dst_pmd = folio_mk_pmd(huge_zero_folio, dst_vma->vm_page_prot);
> +		_dst_pmd = move_soft_dirty_pmd(pmd_mkspecial(_dst_pmd));
>  	}

[Severity: Critical]
This problem wasn't introduced by this patch, but in the src_folio branch
above and in move_present_ptes() [1], doesn't unconditionally calling
pmd_mkwrite() and pte_mkwrite() on the destination entry bypass userfaultfd
write-protection and create clean-but-writable page table entries?

mm/userfaultfd.c:move_present_ptes() {
	...
		orig_dst_pte = folio_mk_pte(src_folio, dst_vma->vm_page_prot);
		/* Set soft dirty bit so userspace can notice the pte was moved */
		if (pgtable_supports_soft_dirty())
			orig_dst_pte = pte_mksoft_dirty(orig_dst_pte);
		if (pte_dirty(orig_src_pte))
			orig_dst_pte = pte_mkdirty(orig_dst_pte);
		orig_dst_pte = pte_mkwrite(orig_dst_pte, dst_vma);
	...
}

Both functions drop userfaultfd write-protection from the source entry and
make the destination entry writable, allowing userspace to bypass
write-protection tracking by moving protected pages. In addition, when
move_present_ptes() moves a clean page, calling pte_mkwrite() without
pte_mkdirty() leaves orig_dst_pte clean and writable, so later writes can go
untracked and be lost on reclaim.

[1] https://sashiko.dev/#/bug/linux-6a04b397-aeb2-44a3-b8f5-9f235e068739

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111-uffd-state-fixes-v1-0-00713d368976@columbia.edu?part=6