Re: [PATCH v3 6/9] mm/mmu_notifier: add MMU_NOTIFIER_RANGE_PERM_UPGRADE

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] mm: change_protection() strips write bit for soft-dirty on
  perm upgrade
--

commit 292879801a9c3725b053aaa1391bad7e3b1f0588
Author: Carlos López <clopez@suse.de>

mm/mmu_notifier: add MMU_NOTIFIER_RANGE_PERM_UPGRADE

This commit adds the MMU_NOTIFIER_RANGE_PERM_UPGRADE flag to indicate that a
range invalidation only upgrades access permissions, and sets it in
change_protection() for permission upgrades and userfaultfd write-protect
resolves.

> diff --git a/mm/mprotect.c b/mm/mprotect.c
> index 70922e19c741d..ce3dd4b23c25b 100644
> --- a/mm/mprotect.c
> +++ b/mm/mprotect.c
> @@ -582,8 +582,9 @@ static inline long change_pud_range(struct mmu_gather *tlb,
>  			continue;
>  
>  		if (!range.start) {
> -			mmu_notifier_range_init(&range,
> -						MMU_NOTIFY_PROTECTION_VMA, 0,
> +			mmu_notifier_range_init(&range, MMU_NOTIFY_PROTECTION_VMA,
> +						mm_cp_is_perm_upgrade(cp_flags) ?
> +						MMU_NOTIFIER_RANGE_PERM_UPGRADE : 0,
>  						vma->vm_mm, addr, end);
>  			mmu_notifier_invalidate_range_start(&range);
>  		}

[Severity: Medium]
Can change_protection() still downgrade writable entries to read-only when
MMU_NOTIFIER_RANGE_PERM_UPGRADE is set on a VMA with soft-dirty tracking
enabled?

When vma_soft_dirty_enabled(vma) is true, newprot lacks the write bit, so
pte_modify(), pmd_modify(), and pud_modify() clear it.  When restoring
writability, set_write_prot_commit_flush_ptes() delegates to
maybe_change_pte_writable(), which returns false whenever
pte_needs_soft_dirty_wp() is true even if pte_write(oldpte) was set:

mm/mprotect.c:set_write_prot_commit_flush_ptes() {
	if (pte_write(oldpte)) {
		set_write = maybe_change_pte_writable(vma, ptent);
		prot_commit_flush_ptes(vma, addr, ptep, oldpte, ptent, nr_ptes,
				       /* idx = */ 0, set_write, tlb);
		return;
	}
    ...
}

can_change_pmd_writable() and can_change_pud_writable() similarly reject
entries lacking the soft-dirty bit before checking pmd_write(oldpmd) or
pud_write(oldpud).

Writing 4 (CLEAR_REFS_SOFT_DIRTY) to /proc/pid/clear_refs enables soft-dirty
tracking on all VMAs while clear_refs_test_walk() skips VM_PFNMAP VMAs, and
clear_soft_dirty() skips pinned PTEs via pte_is_pinned() (which can be
writable without the soft-dirty bit after a read swap-in of an exclusive
anonymous page).  A subsequent permission upgrade or userfaultfd resolve
then advertises MMU_NOTIFIER_RANGE_PERM_UPGRADE while write-protecting those
present entries, leaving secondary MMUs with stale writable mappings or
breaking CoW pin coherency.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112142039.907090-2-clopez@suse.de?part=6