Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

["Jose A. Perez de Azpillaga" <azpijr@gmail.com>]

On 11/11/26 8:29 AM, David Hildenbrand (Arm) wrote:
> On 11/11/26 04:19, Tal Zussman wrote:
>> On 11/10/26 6:55 AM, David Hildenbrand (Arm) wrote:
>>> On 11/10/26 12:54, n3rd wrote:
>>>>
>>>> Hello,
>>>>
>>>> I am reporting a security bug in the Linux kernel.
>>>
>>> Stop sending uffd problems as security bugs. STOP IT NOW.
>>>
>>> Tal has a long list of uffd-related fixes he is about to send out. CCing him.
>>>
>> So this issue was originally on my list and I had a fix for it... but it was
>> REALLY ugly and a band-aid, so I dropped it.
> 
> Yeah, RWP is a mess.
> 
>>
>> I think the real solution is to just add actual markers for RWP and solve
>> all of these issues at once... but that should be a separate series from my
>> batch of fixes (which I'll be sending shortly). Is there a reason RWP
>> markers weren't done in the first place that I'm missing?
> 
> Let's ask kiryl: why is it ok to drop RWP PTE bits during swapout, zap, collapse
> etc?
> 
> https://kernel.org/doc/html/latest/admin-guide/mm/userfaultfd.html?utm_source=chatgpt.com
> 
> states "Unlike WP (which persists via PTE_MARKER_UFFD_WP), there is no
> persistent RWP marker today. The user needs to re-arm the range with
> UFFDIO_RWPROTECT after any operation that explicitly frees PTEs."
> 
> But requiring the user to re-arm is rather questionable design if the kernel can
> just zap these page table entries.
> 
> @Jose, maybe you want to look into marker support for RWP to make RWP a bit less
> horrible?

oops. I overlooked the thread because of the AI report...

IMHO (and after reading Kiryl's email), I'd fix the doc instead. "Scope 
of protection" doesn't mention collapse or shmem reclaim, and it still 
tells the user to re-arm.

I could work on that patch :)

-- 
cheers,
jose a. p-a