Re: [PATCH 09/10] mm/hugetlb: don't leave a uffd-wp marker when zapping an RWP entry

[Lance Yang <lance.yang@linux.dev>]

On Thu, Oct 15, 2026 at 06:07:15PM +0200, David Hildenbrand (Arm) wrote:
>From: Josef Bacik <josef@toxicpanda.com>
>
>An entry that is protected with UFFDIO_RWPROTECT is PAGE_NONE with the
>uffd bit set, the bit that userfaultfd write protection uses too.  When
>__unmap_hugepage_range() zaps an entry with that bit it leaves a
>PTE_MARKER_UFFD_WP behind, whatever the VMA is registered for.
>
>In a VMA registered with UFFDIO_REGISTER_MODE_RWP that marker means
>nothing.  The next fault has hugetlb_no_page() turn it into a present,
>read-only entry with the uffd bit.  That is not an RWP entry, since it is
>not PAGE_NONE, and the VMA has no VM_UFFD_WP (the two modes can not be
>registered together).  An earlier fix solved some side effects, now just
>stop the zap from wrongly installing a marker.
>
>Leave a marker only if the VMA is registered for write protection, both
>for present and for non-present entries.  The zap of ordinary page
>tables has the same test, in cond_install_uffd_wp_ptes(), and
>hugetlb_change_protection() says that "uffd_rwp does not install markers".
>
>After a zap the range of an RWP VMA is simply empty, as it is for
>anonymous memory and shmem.  Nothing changes for VMAs with VM_UFFD_WP.  In
>a VMA that is not registered at all a leftover uffd bit or marker is now
>dropped by the zap and no longer kept alive.
>
>Original fix generated by an LLM and sent in private by Josef.
>
>Fixes: 2d427bb01639 ("mm/userfaultfd: add RWP fault delivery and expose UFFDIO_REGISTER_MODE_RWP")
>Cc: stable@vger.kernel.org
>Reported-by: Chris Mason <mason@kernel.org>
>Signed-off-by: Josef Bacik <josef@toxicpanda.com>
>[ david: a bit of description overhaul+simplification ]
>Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
>---

Reviewed-by: Lance Yang <lance.yang@linux.dev>