Re: [PATCH v8 05/15] mm: add VM_UFFD_RWP VMA flag

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] uffd_disable_fault_around() does not disable fault-around for VM_UFFD_RWP, allowing silent bypass of read-write protection.
--

commit ed61c5fa2ad8a9cc1e93f82dbad086bff3df2b4c
Author: Kiryl Shutsemau (Meta) <kas@kernel.org>

mm: add VM_UFFD_RWP VMA flag

Preparatory patch for userfaultfd read-write protection (RWP). RWP
extends userfaultfd protection from plain write-protection (WP) to
full read-write protection: accesses to an RWP-protected range --
reads as well as writes -- trap through userfaultfd.

> diff --git a/include/linux/userfaultfd_k.h b/include/linux/userfaultfd_k.h
> index c4f2cc6dfcf01..61ea83dbd0268 100644
> --- a/include/linux/userfaultfd_k.h
> +++ b/include/linux/userfaultfd_k.h

[ ... ]

> @@ -179,7 +180,8 @@ static inline bool is_mergeable_vm_userfaultfd_ctx(struct vm_area_struct *vma,
>  static inline bool uffd_disable_huge_pmd_share(struct vm_area_struct *vma)
>  {
>  	return vma_test_any_mask(vma,
> -		mk_vma_flags_from_masks(VMA_UFFD_WP, VMA_UFFD_MINOR));
> +		mk_vma_flags_from_masks(VMA_UFFD_WP, VMA_UFFD_MINOR,
> +					VMA_UFFD_RWP));
>  }
>  
>  /*

[Severity: High]
Should VMA_UFFD_RWP also be added to uffd_disable_fault_around() which is
defined just below this function?

Looking at uffd_disable_fault_around() in include/linux/userfaultfd_k.h:

static inline bool uffd_disable_fault_around(struct vm_area_struct *vma)
{
	return vma_test_any_mask(vma,
		mk_vma_flags_from_masks(VMA_UFFD_WP, VMA_UFFD_MINOR));
}

If VMA_UFFD_RWP is missing from this check, will it allow filemap_map_pages()
to bypass the read-write protection?

When a VMM registers a file-backed or shmem VMA with UFFDIO_REGISTER_MODE_RWP
and a guest accesses a missing page, do_read_fault() calls
should_fault_around().

Because VMA_UFFD_RWP is not checked in uffd_disable_fault_around(),
it proceeds to do_fault_around().

This allows filemap_map_pages() to preemptively install up to 15 neighboring
PTEs with standard readable permissions and no _PAGE_UFFD marker. 

Subsequent accesses to the fault-around populated pages will succeed natively
without delivering a message to the userfaultfd handler, which causes a
regression in the RWP sync trap guarantee.

In async mode, PAGEMAP_SCAN will falsely report these unaccessed pages as
PAGE_IS_ACCESSED.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703133615.1039465-1-kirill@shutemov.name?part=5