Re: [PATCH v2 1/2] userfaultfd: clear the inherited uffd bit in move_swap_pte()

[Donggeun Yoo <donggeunyoo.kernel@gmail.com>]

On Fri, 25 Sep 2026 09:36:26 +0200, David Hildenbrand (Arm) wrote:
> It would also be helpful to describe if this was actually hit in practice so
> far. IOW, how relevant is this in practice.

Not that I know of.  An LLM found it reading the code, and I couldn't find
a report of it on linux-mm or lkml.

> Will this trigger a kernel splat later?

Yes, with CONFIG_PAGE_TABLE_CHECK.  When the moved page is faulted in at
the destination, do_swap_page() copies the uffd bit to the present PTE and,
because the destination isn't WP-registered, also makes it writable.  A
read fault is enough:

  WARNING: mm/page_table_check.c:202 at __page_table_check_ptes_set+0x185/0x1e0
  Call Trace:
   set_ptes+0x67/0xc0
   do_swap_page+0x990/0xfe0
   __handle_mm_fault+0x7d0/0xeb0
   handle_mm_fault+0x9c/0x250
   do_user_addr_fault+0x207/0x650
   exc_page_fault+0x65/0x150
   asm_exc_page_fault+0x26/0x30

That's on 7.3-rc4 in QEMU, from a WP- or RWP-armed source; with this
patch applied it doesn't fire.  I'll put it in the v3 changelog.

Thanks,
Donggeun