* [PATCH] userfaultfd: preserve write protection across UFFDIO_MOVE
@ 2026-04-09 15:28 Gregory Price
2026-04-09 20:09 ` Suren Baghdasaryan
2026-04-10 7:55 ` Mike Rapoport
0 siblings, 2 replies; 3+ messages in thread
From: Gregory Price @ 2026-04-09 15:28 UTC (permalink / raw)
To: linux-mm
Cc: linux-kernel, kernel-team, akpm, rppt, peterx, surenb, aarcange,
stable
move_present_ptes() unconditionally makes the destination PTE writable,
dropping uffd-wp write-protection from the source PTE.
The original intent was to follow mremap() behavior, but mremap()'s
move_ptes() preserves the source write state unconditionally.
Modify uffd to preserve the source write state and check the uffd-wp
condition of the source before setting writable on the destination.
Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
Cc: stable@vger.kernel.org
Signed-off-by: Gregory Price <gourry@gourry.net>
---
mm/userfaultfd.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index e6dfd5f28acd..783ca68aed88 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -1123,7 +1123,10 @@ static long move_present_ptes(struct mm_struct *mm,
orig_dst_pte = pte_mksoft_dirty(orig_dst_pte);
if (pte_dirty(orig_src_pte))
orig_dst_pte = pte_mkdirty(orig_dst_pte);
- orig_dst_pte = pte_mkwrite(orig_dst_pte, dst_vma);
+ if (pte_write(orig_src_pte))
+ orig_dst_pte = pte_mkwrite(orig_dst_pte, dst_vma);
+ if (pte_uffd_wp(orig_src_pte))
+ orig_dst_pte = pte_mkuffd_wp(orig_dst_pte);
set_pte_at(mm, dst_addr, dst_pte, orig_dst_pte);
src_addr += PAGE_SIZE;
--
2.52.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] userfaultfd: preserve write protection across UFFDIO_MOVE
2026-04-09 15:28 [PATCH] userfaultfd: preserve write protection across UFFDIO_MOVE Gregory Price
@ 2026-04-09 20:09 ` Suren Baghdasaryan
2026-04-10 7:55 ` Mike Rapoport
1 sibling, 0 replies; 3+ messages in thread
From: Suren Baghdasaryan @ 2026-04-09 20:09 UTC (permalink / raw)
To: Gregory Price
Cc: linux-mm, linux-kernel, kernel-team, akpm, rppt, peterx, aarcange,
stable
On Thu, Apr 9, 2026 at 8:28 AM Gregory Price <gourry@gourry.net> wrote:
>
> move_present_ptes() unconditionally makes the destination PTE writable,
> dropping uffd-wp write-protection from the source PTE.
>
> The original intent was to follow mremap() behavior, but mremap()'s
> move_ptes() preserves the source write state unconditionally.
>
> Modify uffd to preserve the source write state and check the uffd-wp
> condition of the source before setting writable on the destination.
>
> Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
> Cc: stable@vger.kernel.org
> Signed-off-by: Gregory Price <gourry@gourry.net>
Reviewed-by: Suren Baghdasaryan <surenb@google.com>
> ---
> mm/userfaultfd.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
> index e6dfd5f28acd..783ca68aed88 100644
> --- a/mm/userfaultfd.c
> +++ b/mm/userfaultfd.c
> @@ -1123,7 +1123,10 @@ static long move_present_ptes(struct mm_struct *mm,
> orig_dst_pte = pte_mksoft_dirty(orig_dst_pte);
> if (pte_dirty(orig_src_pte))
> orig_dst_pte = pte_mkdirty(orig_dst_pte);
> - orig_dst_pte = pte_mkwrite(orig_dst_pte, dst_vma);
> + if (pte_write(orig_src_pte))
> + orig_dst_pte = pte_mkwrite(orig_dst_pte, dst_vma);
> + if (pte_uffd_wp(orig_src_pte))
> + orig_dst_pte = pte_mkuffd_wp(orig_dst_pte);
> set_pte_at(mm, dst_addr, dst_pte, orig_dst_pte);
>
> src_addr += PAGE_SIZE;
> --
> 2.52.0
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] userfaultfd: preserve write protection across UFFDIO_MOVE
2026-04-09 15:28 [PATCH] userfaultfd: preserve write protection across UFFDIO_MOVE Gregory Price
2026-04-09 20:09 ` Suren Baghdasaryan
@ 2026-04-10 7:55 ` Mike Rapoport
1 sibling, 0 replies; 3+ messages in thread
From: Mike Rapoport @ 2026-04-10 7:55 UTC (permalink / raw)
To: Gregory Price
Cc: linux-mm, linux-kernel, kernel-team, akpm, peterx, surenb,
aarcange, stable
On Thu, Apr 09, 2026 at 11:28:22AM -0400, Gregory Price wrote:
> move_present_ptes() unconditionally makes the destination PTE writable,
> dropping uffd-wp write-protection from the source PTE.
>
> The original intent was to follow mremap() behavior, but mremap()'s
> move_ptes() preserves the source write state unconditionally.
>
> Modify uffd to preserve the source write state and check the uffd-wp
> condition of the source before setting writable on the destination.
>
> Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
> Cc: stable@vger.kernel.org
> Signed-off-by: Gregory Price <gourry@gourry.net>
Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
> ---
> mm/userfaultfd.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
> index e6dfd5f28acd..783ca68aed88 100644
> --- a/mm/userfaultfd.c
> +++ b/mm/userfaultfd.c
> @@ -1123,7 +1123,10 @@ static long move_present_ptes(struct mm_struct *mm,
> orig_dst_pte = pte_mksoft_dirty(orig_dst_pte);
> if (pte_dirty(orig_src_pte))
> orig_dst_pte = pte_mkdirty(orig_dst_pte);
> - orig_dst_pte = pte_mkwrite(orig_dst_pte, dst_vma);
> + if (pte_write(orig_src_pte))
> + orig_dst_pte = pte_mkwrite(orig_dst_pte, dst_vma);
> + if (pte_uffd_wp(orig_src_pte))
> + orig_dst_pte = pte_mkuffd_wp(orig_dst_pte);
> set_pte_at(mm, dst_addr, dst_pte, orig_dst_pte);
>
> src_addr += PAGE_SIZE;
> --
> 2.52.0
>
--
Sincerely yours,
Mike.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-04-10 7:55 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-09 15:28 [PATCH] userfaultfd: preserve write protection across UFFDIO_MOVE Gregory Price
2026-04-09 20:09 ` Suren Baghdasaryan
2026-04-10 7:55 ` Mike Rapoport
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox