Re: [PATCH v9 13/15] userfaultfd: add UFFDIO_SET_MODE for runtime sync/async toggle

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The newly introduced UFFDIO_SET_MODE ioctl iterates over the VMA tree of an external mm_struct without calling check_stable_address_space(mm), risking crashes if the VMA tree has been destabilized by an OOM reap or failed dup_mmap().
--

commit b1666c80355a8be527727cc3ee914087739f01c2
Author: Kiryl Shutsemau (Meta) <kas@kernel.org>

userfaultfd: add UFFDIO_SET_MODE for runtime sync/async toggle

This commit adds a UFFDIO_SET_MODE ioctl to toggle UFFD_FEATURE_RWP_ASYNC
on an existing userfaultfd at runtime. It synchronizes the mode switch by
taking the mmap write lock and calling vma_start_write() on all armed VMAs.

> diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
> index 763897f596783..c96cfe0871dd0 100644
> --- a/mm/userfaultfd.c
> +++ b/mm/userfaultfd.c
[ ... ]
> @@ -4299,6 +4309,109 @@ static int userfaultfd_rwprotect(struct userfaultfd_ctx *ctx,
[ ... ]
> +static int userfaultfd_set_mode(struct userfaultfd_ctx *ctx,
> +				unsigned long arg)
> +{
[ ... ]
> +	mmap_write_lock(mm);
> +	{
> +		struct vm_area_struct *vma;
> +		VMA_ITERATOR(vmi, mm, 0);
> +
> +		for_each_vma(vmi, vma) {
> +			if (vma->vm_userfaultfd_ctx.ctx == ctx)

[Severity: High]
Does this code need to call check_stable_address_space(mm) before traversing
the VMA tree?

Since this iterates over the VMA tree of an external mm_struct, if the VMA
tree has been destabilized by an OOM reap or a failed dup_mmap() (which
inserts XA_ZERO_ENTRY markers and sets MMF_UNSTABLE), iterating the maple tree
might cause an illegal pointer dereference when accessing
vma->vm_userfaultfd_ctx.ctx.

> +				vma_start_write(vma);
> +		}
> +	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260706084805.8400-1-kirill@shutemov.name?part=13