Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

[David Hildenbrand (Arm)]

On 11/10/26 12:54, n3rd wrote:
> 
> Hello,
> 
> I am reporting a security bug in the Linux kernel.

Stop sending uffd problems as security bugs. STOP IT NOW.

Tal has a long list of uffd-related fixes he is about to send out. CCing him.

-- 
Cheers,

David

Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

[Tal Zussman]

On 11/10/26 6:55 AM, David Hildenbrand (Arm) wrote:
> On 11/10/26 12:54, n3rd wrote:
>> 
>> Hello,
>> 
>> I am reporting a security bug in the Linux kernel.
> 
> Stop sending uffd problems as security bugs. STOP IT NOW.
> 
> Tal has a long list of uffd-related fixes he is about to send out. CCing him.
> 
So this issue was originally on my list and I had a fix for it... but it was
REALLY ugly and a band-aid, so I dropped it.

I think the real solution is to just add actual markers for RWP and solve
all of these issues at once... but that should be a separate series from my
batch of fixes (which I'll be sending shortly). Is there a reason RWP
markers weren't done in the first place that I'm missing?

Thanks,
Tal

Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

[David Hildenbrand (Arm)]

On 11/11/26 04:19, Tal Zussman wrote:
> On 11/10/26 6:55 AM, David Hildenbrand (Arm) wrote:
>> On 11/10/26 12:54, n3rd wrote:
>>>
>>> Hello,
>>>
>>> I am reporting a security bug in the Linux kernel.
>>
>> Stop sending uffd problems as security bugs. STOP IT NOW.
>>
>> Tal has a long list of uffd-related fixes he is about to send out. CCing him.
>>
> So this issue was originally on my list and I had a fix for it... but it was
> REALLY ugly and a band-aid, so I dropped it.

Yeah, RWP is a mess.

> 
> I think the real solution is to just add actual markers for RWP and solve
> all of these issues at once... but that should be a separate series from my
> batch of fixes (which I'll be sending shortly). Is there a reason RWP
> markers weren't done in the first place that I'm missing?

Let's ask kiryl: why is it ok to drop RWP PTE bits during swapout, zap, collapse
etc?

https://kernel.org/doc/html/latest/admin-guide/mm/userfaultfd.html?utm_source=chatgpt.com

states "Unlike WP (which persists via PTE_MARKER_UFFD_WP), there is no
persistent RWP marker today. The user needs to re-arm the range with
UFFDIO_RWPROTECT after any operation that explicitly frees PTEs."

But requiring the user to re-arm is rather questionable design if the kernel can
just zap these page table entries.

@Jose, maybe you want to look into marker support for RWP to make RWP a bit less
horrible?


-- 
Cheers,

David

Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

[Kiryl Shutsemau]

On Wed, Nov 11, 2026 at 08:29:50AM +0100, David Hildenbrand (Arm) wrote:
> On 11/11/26 04:19, Tal Zussman wrote:
> > On 11/10/26 6:55 AM, David Hildenbrand (Arm) wrote:
> >> On 11/10/26 12:54, n3rd wrote:
> >>>
> >>> Hello,
> >>>
> >>> I am reporting a security bug in the Linux kernel.
> >>
> >> Stop sending uffd problems as security bugs. STOP IT NOW.
> >>
> >> Tal has a long list of uffd-related fixes he is about to send out. CCing him.
> >>
> > So this issue was originally on my list and I had a fix for it... but it was
> > REALLY ugly and a band-aid, so I dropped it.
> 
> Yeah, RWP is a mess.
> 
> > 
> > I think the real solution is to just add actual markers for RWP and solve
> > all of these issues at once... but that should be a separate series from my
> > batch of fixes (which I'll be sending shortly). Is there a reason RWP
> > markers weren't done in the first place that I'm missing?
> 
> Let's ask kiryl: why is it ok to drop RWP PTE bits during swapout, zap, collapse
> etc?
> 
> https://kernel.org/doc/html/latest/admin-guide/mm/userfaultfd.html?utm_source=chatgpt.com
> 
> states "Unlike WP (which persists via PTE_MARKER_UFFD_WP), there is no
> persistent RWP marker today. The user needs to re-arm the range with
> UFFDIO_RWPROTECT after any operation that explicitly frees PTEs."
> 
> But requiring the user to re-arm is rather questionable design if the kernel can
> just zap these page table entries.

There is no need to re-arm. 

Once the PTE is zapped, the next access faults, and userfaultfd already
has a mode for that fault: MINOR if the page is still in the page cache
or in swap, MISSING if it is gone. Register the range with RWP|MINOR and
the first access after collapse, shmem reclaim or MADV_DONTNEED arrives
as a minor fault. The monitor counts it as an access and resolves it
with UFFDIO_CONTINUE.

That is why there is no RWP marker: MINOR already covers it. WP needs a
marker because MINOR would trap reads as well, and a WP user does not
want those.

Anon has no MINOR mode, so there the bit stays wherever the page
survives: it is carried on swap and migration entries, and anon
collapse bails on uffd PTEs with SCAN_PTE_UFFD. MADV_DONTNEED frees the
page, so the next access is a MISSING fault.

The report registers RWP alone. That is the only setup where the access
after collapse goes unreported.

-- 
  Kiryl Shutsemau / Kirill A. Shutemov

Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

[Linus Torvalds]

On Wed, 11 Nov 2026 at 11:13, Kiryl Shutsemau <kas@kernel.org> wrote:
>
> The report registers RWP alone. That is the only setup where the access
> after collapse goes unreported.

Let's just document that as "don't care" with the reasoning.

               Linus

Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

[David Hildenbrand (Arm)]

On 11/11/26 19:53, Kiryl Shutsemau wrote:
> On Wed, Nov 11, 2026 at 08:29:50AM +0100, David Hildenbrand (Arm) wrote:
>> On 11/11/26 04:19, Tal Zussman wrote:
>>> So this issue was originally on my list and I had a fix for it... but it was
>>> REALLY ugly and a band-aid, so I dropped it.
>>
>> Yeah, RWP is a mess.
>>
>>>
>>> I think the real solution is to just add actual markers for RWP and solve
>>> all of these issues at once... but that should be a separate series from my
>>> batch of fixes (which I'll be sending shortly). Is there a reason RWP
>>> markers weren't done in the first place that I'm missing?
>>
>> Let's ask kiryl: why is it ok to drop RWP PTE bits during swapout, zap, collapse
>> etc?
>>
>> https://kernel.org/doc/html/latest/admin-guide/mm/userfaultfd.html?utm_source=chatgpt.com
>>
>> states "Unlike WP (which persists via PTE_MARKER_UFFD_WP), there is no
>> persistent RWP marker today. The user needs to re-arm the range with
>> UFFDIO_RWPROTECT after any operation that explicitly frees PTEs."
>>
>> But requiring the user to re-arm is rather questionable design if the kernel can
>> just zap these page table entries.
> 
> There is no need to re-arm. 
> 
> Once the PTE is zapped, the next access faults, and userfaultfd already
> has a mode for that fault: MINOR if the page is still in the page cache
> or in swap, MISSING if it is gone. Register the range with RWP|MINOR and
> the first access after collapse, shmem reclaim or MADV_DONTNEED arrives
> as a minor fault. The monitor counts it as an access and resolves it
> with UFFDIO_CONTINUE.
> 
> That is why there is no RWP marker: MINOR already covers it. WP needs a
> marker because MINOR would trap reads as well, and a WP user does not
> want those.
> 
> Anon has no MINOR mode, so there the bit stays wherever the page
> survives: it is carried on swap and migration entries, and anon
> collapse bails on uffd PTEs with SCAN_PTE_UFFD. MADV_DONTNEED frees the
> page, so the next access is a MISSING fault.
> 
> The report registers RWP alone. That is the only setup where the access
> after collapse goes unreported.

I have the faint recollection that we discussed that handling during early
(pre?) RWP handling.

I think that expectation and the implication is indeed not documented anywhere
for users that have no idea what markers are.

Even LLMs are confused.

Or is it documented already?

It would be a lot more consistent if we'd just add marker support. Or is there a
good reason why that is explicitly not wanted?

-- 
Cheers,

David

Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

[Jose A. Perez de Azpillaga]

On 11/11/26 8:29 AM, David Hildenbrand (Arm) wrote:
> On 11/11/26 04:19, Tal Zussman wrote:
>> On 11/10/26 6:55 AM, David Hildenbrand (Arm) wrote:
>>> On 11/10/26 12:54, n3rd wrote:
>>>>
>>>> Hello,
>>>>
>>>> I am reporting a security bug in the Linux kernel.
>>>
>>> Stop sending uffd problems as security bugs. STOP IT NOW.
>>>
>>> Tal has a long list of uffd-related fixes he is about to send out. CCing him.
>>>
>> So this issue was originally on my list and I had a fix for it... but it was
>> REALLY ugly and a band-aid, so I dropped it.
> 
> Yeah, RWP is a mess.
> 
>>
>> I think the real solution is to just add actual markers for RWP and solve
>> all of these issues at once... but that should be a separate series from my
>> batch of fixes (which I'll be sending shortly). Is there a reason RWP
>> markers weren't done in the first place that I'm missing?
> 
> Let's ask kiryl: why is it ok to drop RWP PTE bits during swapout, zap, collapse
> etc?
> 
> https://kernel.org/doc/html/latest/admin-guide/mm/userfaultfd.html?utm_source=chatgpt.com
> 
> states "Unlike WP (which persists via PTE_MARKER_UFFD_WP), there is no
> persistent RWP marker today. The user needs to re-arm the range with
> UFFDIO_RWPROTECT after any operation that explicitly frees PTEs."
> 
> But requiring the user to re-arm is rather questionable design if the kernel can
> just zap these page table entries.
> 
> @Jose, maybe you want to look into marker support for RWP to make RWP a bit less
> horrible?

oops. I overlooked the thread because of the AI report...

IMHO (and after reading Kiryl's email), I'd fix the doc instead. "Scope 
of protection" doesn't mention collapse or shmem reclaim, and it still 
tells the user to re-arm.

I could work on that patch :)

-- 
cheers,
jose a. p-a

Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

[Kiryl Shutsemau]

On Wed, Nov 11, 2026 at 08:43:47PM +0100, Jose A. Perez de Azpillaga wrote:
> On 11/11/26 8:29 AM, David Hildenbrand (Arm) wrote:
> > On 11/11/26 04:19, Tal Zussman wrote:
> > > On 11/10/26 6:55 AM, David Hildenbrand (Arm) wrote:
> > > > On 11/10/26 12:54, n3rd wrote:
> > > > > 
> > > > > Hello,
> > > > > 
> > > > > I am reporting a security bug in the Linux kernel.
> > > > 
> > > > Stop sending uffd problems as security bugs. STOP IT NOW.
> > > > 
> > > > Tal has a long list of uffd-related fixes he is about to send out. CCing him.
> > > > 
> > > So this issue was originally on my list and I had a fix for it... but it was
> > > REALLY ugly and a band-aid, so I dropped it.
> > 
> > Yeah, RWP is a mess.
> > 
> > > 
> > > I think the real solution is to just add actual markers for RWP and solve
> > > all of these issues at once... but that should be a separate series from my
> > > batch of fixes (which I'll be sending shortly). Is there a reason RWP
> > > markers weren't done in the first place that I'm missing?
> > 
> > Let's ask kiryl: why is it ok to drop RWP PTE bits during swapout, zap, collapse
> > etc?
> > 
> > https://kernel.org/doc/html/latest/admin-guide/mm/userfaultfd.html?utm_source=chatgpt.com
> > 
> > states "Unlike WP (which persists via PTE_MARKER_UFFD_WP), there is no
> > persistent RWP marker today. The user needs to re-arm the range with
> > UFFDIO_RWPROTECT after any operation that explicitly frees PTEs."
> > 
> > But requiring the user to re-arm is rather questionable design if the kernel can
> > just zap these page table entries.
> > 
> > @Jose, maybe you want to look into marker support for RWP to make RWP a bit less
> > horrible?
> 
> oops. I overlooked the thread because of the AI report...
> 
> IMHO (and after reading Kiryl's email), I'd fix the doc instead. "Scope of
> protection" doesn't mention collapse or shmem reclaim, and it still tells
> the user to re-arm.
> 
> I could work on that patch :)

Thanks for volunteering :)

-- 
  Kiryl Shutsemau / Kirill A. Shutemov