Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

["David Hildenbrand (Arm)" <david@kernel.org>]

On 11/11/26 19:53, Kiryl Shutsemau wrote:
> On Wed, Nov 11, 2026 at 08:29:50AM +0100, David Hildenbrand (Arm) wrote:
>> On 11/11/26 04:19, Tal Zussman wrote:
>>> So this issue was originally on my list and I had a fix for it... but it was
>>> REALLY ugly and a band-aid, so I dropped it.
>>
>> Yeah, RWP is a mess.
>>
>>>
>>> I think the real solution is to just add actual markers for RWP and solve
>>> all of these issues at once... but that should be a separate series from my
>>> batch of fixes (which I'll be sending shortly). Is there a reason RWP
>>> markers weren't done in the first place that I'm missing?
>>
>> Let's ask kiryl: why is it ok to drop RWP PTE bits during swapout, zap, collapse
>> etc?
>>
>> https://kernel.org/doc/html/latest/admin-guide/mm/userfaultfd.html?utm_source=chatgpt.com
>>
>> states "Unlike WP (which persists via PTE_MARKER_UFFD_WP), there is no
>> persistent RWP marker today. The user needs to re-arm the range with
>> UFFDIO_RWPROTECT after any operation that explicitly frees PTEs."
>>
>> But requiring the user to re-arm is rather questionable design if the kernel can
>> just zap these page table entries.
> 
> There is no need to re-arm. 
> 
> Once the PTE is zapped, the next access faults, and userfaultfd already
> has a mode for that fault: MINOR if the page is still in the page cache
> or in swap, MISSING if it is gone. Register the range with RWP|MINOR and
> the first access after collapse, shmem reclaim or MADV_DONTNEED arrives
> as a minor fault. The monitor counts it as an access and resolves it
> with UFFDIO_CONTINUE.
> 
> That is why there is no RWP marker: MINOR already covers it. WP needs a
> marker because MINOR would trap reads as well, and a WP user does not
> want those.
> 
> Anon has no MINOR mode, so there the bit stays wherever the page
> survives: it is carried on swap and migration entries, and anon
> collapse bails on uffd PTEs with SCAN_PTE_UFFD. MADV_DONTNEED frees the
> page, so the next access is a MISSING fault.
> 
> The report registers RWP alone. That is the only setup where the access
> after collapse goes unreported.

I have the faint recollection that we discussed that handling during early
(pre?) RWP handling.

I think that expectation and the implication is indeed not documented anywhere
for users that have no idea what markers are.

Even LLMs are confused.

Or is it documented already?

It would be a lot more consistent if we'd just add marker support. Or is there a
good reason why that is explicitly not wanted?

-- 
Cheers,

David