Re: [PATCH 09/10] mm/hugetlb: don't leave a uffd-wp marker when zapping an RWP entry

["Lorenzo Stoakes (ARM)" <ljs@kernel.org>]

On Thu, Oct 15, 2026 at 06:07:15PM +0200, David Hildenbrand (Arm) wrote:
> From: Josef Bacik <josef@toxicpanda.com>
>
> An entry that is protected with UFFDIO_RWPROTECT is PAGE_NONE with the
> uffd bit set, the bit that userfaultfd write protection uses too.  When
> __unmap_hugepage_range() zaps an entry with that bit it leaves a
> PTE_MARKER_UFFD_WP behind, whatever the VMA is registered for.
>
> In a VMA registered with UFFDIO_REGISTER_MODE_RWP that marker means
> nothing.  The next fault has hugetlb_no_page() turn it into a present,
> read-only entry with the uffd bit.  That is not an RWP entry, since it is
> not PAGE_NONE, and the VMA has no VM_UFFD_WP (the two modes can not be
> registered together).  An earlier fix solved some side effects, now just
> stop the zap from wrongly installing a marker.
>
> Leave a marker only if the VMA is registered for write protection, both
> for present and for non-present entries.  The zap of ordinary page
> tables has the same test, in cond_install_uffd_wp_ptes(), and
> hugetlb_change_protection() says that "uffd_rwp does not install markers".
>
> After a zap the range of an RWP VMA is simply empty, as it is for
> anonymous memory and shmem.  Nothing changes for VMAs with VM_UFFD_WP.  In
> a VMA that is not registered at all a leftover uffd bit or marker is now
> dropped by the zap and no longer kept alive.
>
> Original fix generated by an LLM and sent in private by Josef.
>
> Fixes: 2d427bb01639 ("mm/userfaultfd: add RWP fault delivery and expose UFFDIO_REGISTER_MODE_RWP")
> Cc: stable@vger.kernel.org
> Reported-by: Chris Mason <mason@kernel.org>
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
> [ david: a bit of description overhaul+simplification ]
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>

Seems sensible to me so:

Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>

> ---
>  mm/hugetlb.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/mm/hugetlb.c b/mm/hugetlb.c
> index 1548a6156206b..fb51f7d02cebf 100644
> --- a/mm/hugetlb.c
> +++ b/mm/hugetlb.c
> @@ -5267,7 +5267,7 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma,
>  			 * drop the uffd-wp bit in this zap, then replace the
>  			 * pte with a marker.
>  			 */
> -			if (pte_swp_uffd_any(pte) &&
> +			if (userfaultfd_wp(vma) && pte_swp_uffd_any(pte) &&
>  			    !(zap_flags & ZAP_FLAG_DROP_MARKER))
>  				set_huge_pte_at(mm, address, ptep,
>  						make_pte_marker(PTE_MARKER_UFFD_WP),
> @@ -5303,7 +5303,7 @@ void __unmap_hugepage_range(struct mmu_gather *tlb, struct vm_area_struct *vma,
>  		if (huge_pte_dirty(pte))
>  			folio_mark_dirty(folio);
>  		/* Leave a uffd-wp pte marker if needed */
> -		if (huge_pte_uffd(pte) &&
> +		if (userfaultfd_wp(vma) && huge_pte_uffd(pte) &&
>  		    !(zap_flags & ZAP_FLAG_DROP_MARKER))
>  			set_huge_pte_at(mm, address, ptep,
>  					make_pte_marker(PTE_MARKER_UFFD_WP),
>
> --
> 2.43.0
>

--
Cheers, Lorenzo