Re: [PATCH v2] userfaultfd: prevent registration of special VMAs

[Lorenzo Stoakes <ljs@kernel.org>]

On Thu, Jun 18, 2026 at 12:50:17PM +0300, Mike Rapoport wrote:
> From: "Mike Rapoport (Microsoft)" <rppt@kernel.org>
>
> Vova Tokarev says:
>
>   userfaultfd allows registration on shadow stack VMAs.  With userfaultfd
>   access, you can register on the shadow stack, discard a page ... and
>   inject a page with chosen return addresses via UFFDIO_COPY.
>
> Update vma_can_userfault() to reject VM_SHADOW_STACK.
>
> While on it, also reject VM_SPECIAL so that if a driver would implement
> vm_uffd_ops, it wouldn't be possible to register special VMAs with
> userfaultfd.
>
> Since VM_SPECIAL includes VM_DONTEXPAND which is set but hugetlb,
> exclude hugetlb VMAs from the check for VM_SPECIAL.
>
> Reported-by: vova tokarev <vladimirelitokarev@gmail.com>
> Fixes: 54007f818206 ("mm: Introduce VM_SHADOW_STACK for shadow stack memory")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>

LGTM, so:

Reviewed-by: Lorenzo Stoakes <ljs@kernel.org>

I'm working on a series to take care of the issues discussed at [0].

[0]:https://lore.kernel.org/all/20260618183442.BBCD71F000E9@smtp.kernel.org

> ---
>
> v2 changes:
> * reject all VM_SPECIAL except hugetlb
>
> v1: https://lore.kernel.org/all/20260617194059.2529406-1-rppt@kernel.org
>
>  mm/userfaultfd.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
> index 246af12bf801..c3adedaaf7d5 100644
> --- a/mm/userfaultfd.c
> +++ b/mm/userfaultfd.c
> @@ -2111,7 +2111,10 @@ static bool vma_can_userfault(struct vm_area_struct *vma, vm_flags_t vm_flags,
>  {
>  	const struct vm_uffd_ops *ops = vma_uffd_ops(vma);
>
> -	if (vma->vm_flags & VM_DROPPABLE)
> +	if (vma->vm_flags & (VM_DROPPABLE | VM_SHADOW_STACK))
> +		return false;
> +
> +	if (!is_vm_hugetlb_page(vma) && (vma->vm_flags & VM_SPECIAL))
>  		return false;
>
>  	vm_flags &= __VM_UFFD_FLAGS;
>
> base-commit: e3d8707358ea76b78bdec9928937bb9a797f2c8f
> --
> 2.53.0
>
>

Cheers, Lorenzo