[PATCH v3] userfaultfd: reset err to be 0 when move_pages_ptes succeeded

[PATCH v3] userfaultfd: reset err to be 0 when move_pages_ptes succeeded

[Foxie Flakey]

During move_pages() operation, when move_pages_ptes() returns EAGAIN,
the error code is not cleared even after we processed it. This leads
to a successful retry but then the same pages are retried again due to
the stale error code. This time move fails because pages are already
moved, loop is terminated and move_pages() reports a failure.
Clear the error code once we processes EAGAIN.

Fixes: 50944692052b ("userfaultfd: opportunistic TLB-flush batching for present pages in MOVE")
Assisted-by: ChatGPT:GPT-5.6-Luna
Signed-off-by: Bryan Lim <foxieflakey@gmail.com>
---
Changes in v3:
- Updated to use proper sign off.

Changes in v2:
- Updated on description to be easier to understood
- Reset err before retrying, instead of fixing right at the move_pages_ptes
  branch.
- Added Assisted-by, received an answer few days ago from linux-newbies IRC
  that even I just used AI/LLM as "fast path" of git bisect. I still need
  to add it following
  https://docs.kernel.org/process/coding-assistants.html doc.

---
 mm/userfaultfd.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index c3adedaaf7d5..ec5d511bd179 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -2085,8 +2085,10 @@ static ssize_t move_pages(struct userfaultfd_ctx *ctx, unsigned long dst_start,
 		}

 		if (err) {
-			if (err == -EAGAIN)
+			if (err == -EAGAIN) {
+				err = 0;
 				continue;
+			}
 			break;
 		}

-- 
2.55.0

Re: [PATCH v3] userfaultfd: reset err to be 0 when move_pages_ptes succeeded

[Andrew Morton]

On Wed, 19 Aug 2026 10:08:24 +0700 (WIB) Foxie Flakey <foxieflakey@gmail.com> wrote:

> 
> During move_pages() operation, when move_pages_ptes() returns EAGAIN,
> the error code is not cleared even after we processed it. This leads
> to a successful retry but then the same pages are retried again due to
> the stale error code. This time move fails because pages are already
> moved, loop is terminated and move_pages() reports a failure.
> Clear the error code once we processes EAGAIN.
> 
> Fixes: 50944692052b ("userfaultfd: opportunistic TLB-flush batching for present pages in MOVE")
> Assisted-by: ChatGPT:GPT-5.6-Luna
> Signed-off-by: Bryan Lim <foxieflakey@gmail.com>

Thanks, Bryan.

More paperwork: the signoff is supposed to match the Author:.  The way
to do this is to add an explicit From: line at start-of-changelog.  If
this is not present, we fall back to the email envelope's From:.

> --- a/mm/userfaultfd.c
> +++ b/mm/userfaultfd.c
> @@ -2085,8 +2085,10 @@ static ssize_t move_pages(struct userfaultfd_ctx *ctx, unsigned long dst_start,
>  		}
> 
>  		if (err) {
> -			if (err == -EAGAIN)
> +			if (err == -EAGAIN) {
> +				err = 0;
>  				continue;
> +			}
>  			break;
>  		}

I'll queue it, with an adjusted From:, as above.

Could reviewers please advise on whether we should backport this into
-stable kernels?

Re: [PATCH v3] userfaultfd: reset err to be 0 when move_pages_ptes succeeded

[Foxie Flakey]

On Tue, 18 Aug 2026, Andrew Morton wrote:

> On Wed, 19 Aug 2026 10:08:24 +0700 (WIB) Foxie Flakey <foxieflakey@gmail.com> wrote:
>
> >
> > During move_pages() operation, when move_pages_ptes() returns EAGAIN,
> > the error code is not cleared even after we processed it. This leads
> > to a successful retry but then the same pages are retried again due to
> > the stale error code. This time move fails because pages are already
> > moved, loop is terminated and move_pages() reports a failure.
> > Clear the error code once we processes EAGAIN.
> >
> > Fixes: 50944692052b ("userfaultfd: opportunistic TLB-flush batching for present pages in MOVE")
> > Assisted-by: ChatGPT:GPT-5.6-Luna
> > Signed-off-by: Bryan Lim <foxieflakey@gmail.com>
>
> Thanks, Bryan.

No, problem. Thank you for your time. If you don't mind this, I would
prefer keep to be called as Foxie unless its required to be Bryan Lim like
the sign off. Sorry, if it took a while for me to understand.

> More paperwork: the signoff is supposed to match the Author:.  The way
> to do this is to add an explicit From: line at start-of-changelog.  If
> this is not present, we fall back to the email envelope's From:.

Noted. I'll keep that in mind for my future patches.

> > --- a/mm/userfaultfd.c
> > +++ b/mm/userfaultfd.c
> > @@ -2085,8 +2085,10 @@ static ssize_t move_pages(struct userfaultfd_ctx *ctx, unsigned long dst_start,
> >  		}
> >
> >  		if (err) {
> > -			if (err == -EAGAIN)
> > +			if (err == -EAGAIN) {
> > +				err = 0;
> >  				continue;
> > +			}
> >  			break;
> >  		}
>
> I'll queue it, with an adjusted From:, as above.

Thank you!

> Could reviewers please advise on whether we should backport this into
> -stable kernels?
>
>

Re: [PATCH v3] userfaultfd: reset err to be 0 when move_pages_ptes succeeded

[Suren Baghdasaryan]

On Tue, Aug 18, 2026 at 8:27 PM Andrew Morton <akpm@linux-foundation.org> wrote:
>
> On Wed, 19 Aug 2026 10:08:24 +0700 (WIB) Foxie Flakey <foxieflakey@gmail.com> wrote:
>
> >
> > During move_pages() operation, when move_pages_ptes() returns EAGAIN,
> > the error code is not cleared even after we processed it. This leads
> > to a successful retry but then the same pages are retried again due to
> > the stale error code. This time move fails because pages are already
> > moved, loop is terminated and move_pages() reports a failure.
> > Clear the error code once we processes EAGAIN.
> >
> > Fixes: 50944692052b ("userfaultfd: opportunistic TLB-flush batching for present pages in MOVE")
> > Assisted-by: ChatGPT:GPT-5.6-Luna
> > Signed-off-by: Bryan Lim <foxieflakey@gmail.com>

Reviewed-by: Suren Baghdasaryan <surenb@google.com>

>
> Thanks, Bryan.
>
> More paperwork: the signoff is supposed to match the Author:.  The way
> to do this is to add an explicit From: line at start-of-changelog.  If
> this is not present, we fall back to the email envelope's From:.
>
> > --- a/mm/userfaultfd.c
> > +++ b/mm/userfaultfd.c
> > @@ -2085,8 +2085,10 @@ static ssize_t move_pages(struct userfaultfd_ctx *ctx, unsigned long dst_start,
> >               }
> >
> >               if (err) {
> > -                     if (err == -EAGAIN)
> > +                     if (err == -EAGAIN) {
> > +                             err = 0;
> >                               continue;
> > +                     }
> >                       break;
> >               }
>
> I'll queue it, with an adjusted From:, as above.
>
> Could reviewers please advise on whether we should backport this into
> -stable kernels?

Yes please. The first version where the bug appears is 6.18.
Thanks!

>
>

Re: [PATCH v3] userfaultfd: reset err to be 0 when move_pages_ptes succeeded

[Mike Rapoport]

Hi Foxie,

On Wed, Aug 19, 2026 at 10:08:24AM +0700, Foxie Flakey wrote:
> 
> During move_pages() operation, when move_pages_ptes() returns EAGAIN,
> the error code is not cleared even after we processed it. This leads
> to a successful retry but then the same pages are retried again due to
> the stale error code. This time move fails because pages are already
> moved, loop is terminated and move_pages() reports a failure.
> Clear the error code once we processes EAGAIN.
> 
> Fixes: 50944692052b ("userfaultfd: opportunistic TLB-flush batching for present pages in MOVE")
> Assisted-by: ChatGPT:GPT-5.6-Luna
> Signed-off-by: Bryan Lim <foxieflakey@gmail.com>

With the authorship changes that Andrew requested

Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>

> ---
> Changes in v3:
> - Updated to use proper sign off.
> 
> Changes in v2:
> - Updated on description to be easier to understood
> - Reset err before retrying, instead of fixing right at the move_pages_ptes
>   branch.
> - Added Assisted-by, received an answer few days ago from linux-newbies IRC
>   that even I just used AI/LLM as "fast path" of git bisect. I still need
>   to add it following
>   https://docs.kernel.org/process/coding-assistants.html doc.
> 
> ---
>  mm/userfaultfd.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
> index c3adedaaf7d5..ec5d511bd179 100644
> --- a/mm/userfaultfd.c
> +++ b/mm/userfaultfd.c
> @@ -2085,8 +2085,10 @@ static ssize_t move_pages(struct userfaultfd_ctx *ctx, unsigned long dst_start,
>  		}
> 
>  		if (err) {
> -			if (err == -EAGAIN)
> +			if (err == -EAGAIN) {
> +				err = 0;
>  				continue;
> +			}
>  			break;
>  		}
> 
> -- 
> 2.55.0
> 

-- 
Sincerely yours,
Mike.