Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

[David Hildenbrand (Arm)]

On 11/10/26 12:54, n3rd wrote:
> 
> Hello,
> 
> I am reporting a security bug in the Linux kernel.

Stop sending uffd problems as security bugs. STOP IT NOW.

Tal has a long list of uffd-related fixes he is about to send out. CCing him.

-- 
Cheers,

David

Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

[Tal Zussman]

On 11/10/26 6:55 AM, David Hildenbrand (Arm) wrote:
> On 11/10/26 12:54, n3rd wrote:
>> 
>> Hello,
>> 
>> I am reporting a security bug in the Linux kernel.
> 
> Stop sending uffd problems as security bugs. STOP IT NOW.
> 
> Tal has a long list of uffd-related fixes he is about to send out. CCing him.
> 
So this issue was originally on my list and I had a fix for it... but it was
REALLY ugly and a band-aid, so I dropped it.

I think the real solution is to just add actual markers for RWP and solve
all of these issues at once... but that should be a separate series from my
batch of fixes (which I'll be sending shortly). Is there a reason RWP
markers weren't done in the first place that I'm missing?

Thanks,
Tal

Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

[David Hildenbrand (Arm)]

On 11/11/26 04:19, Tal Zussman wrote:
> On 11/10/26 6:55 AM, David Hildenbrand (Arm) wrote:
>> On 11/10/26 12:54, n3rd wrote:
>>>
>>> Hello,
>>>
>>> I am reporting a security bug in the Linux kernel.
>>
>> Stop sending uffd problems as security bugs. STOP IT NOW.
>>
>> Tal has a long list of uffd-related fixes he is about to send out. CCing him.
>>
> So this issue was originally on my list and I had a fix for it... but it was
> REALLY ugly and a band-aid, so I dropped it.

Yeah, RWP is a mess.

> 
> I think the real solution is to just add actual markers for RWP and solve
> all of these issues at once... but that should be a separate series from my
> batch of fixes (which I'll be sending shortly). Is there a reason RWP
> markers weren't done in the first place that I'm missing?

Let's ask kiryl: why is it ok to drop RWP PTE bits during swapout, zap, collapse
etc?

https://kernel.org/doc/html/latest/admin-guide/mm/userfaultfd.html?utm_source=chatgpt.com

states "Unlike WP (which persists via PTE_MARKER_UFFD_WP), there is no
persistent RWP marker today. The user needs to re-arm the range with
UFFDIO_RWPROTECT after any operation that explicitly frees PTEs."

But requiring the user to re-arm is rather questionable design if the kernel can
just zap these page table entries.

@Jose, maybe you want to look into marker support for RWP to make RWP a bit less
horrible?


-- 
Cheers,

David

Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

[Kiryl Shutsemau]

On Wed, Nov 11, 2026 at 08:29:50AM +0100, David Hildenbrand (Arm) wrote:
> On 11/11/26 04:19, Tal Zussman wrote:
> > On 11/10/26 6:55 AM, David Hildenbrand (Arm) wrote:
> >> On 11/10/26 12:54, n3rd wrote:
> >>>
> >>> Hello,
> >>>
> >>> I am reporting a security bug in the Linux kernel.
> >>
> >> Stop sending uffd problems as security bugs. STOP IT NOW.
> >>
> >> Tal has a long list of uffd-related fixes he is about to send out. CCing him.
> >>
> > So this issue was originally on my list and I had a fix for it... but it was
> > REALLY ugly and a band-aid, so I dropped it.
> 
> Yeah, RWP is a mess.
> 
> > 
> > I think the real solution is to just add actual markers for RWP and solve
> > all of these issues at once... but that should be a separate series from my
> > batch of fixes (which I'll be sending shortly). Is there a reason RWP
> > markers weren't done in the first place that I'm missing?
> 
> Let's ask kiryl: why is it ok to drop RWP PTE bits during swapout, zap, collapse
> etc?
> 
> https://kernel.org/doc/html/latest/admin-guide/mm/userfaultfd.html?utm_source=chatgpt.com
> 
> states "Unlike WP (which persists via PTE_MARKER_UFFD_WP), there is no
> persistent RWP marker today. The user needs to re-arm the range with
> UFFDIO_RWPROTECT after any operation that explicitly frees PTEs."
> 
> But requiring the user to re-arm is rather questionable design if the kernel can
> just zap these page table entries.

There is no need to re-arm. 

Once the PTE is zapped, the next access faults, and userfaultfd already
has a mode for that fault: MINOR if the page is still in the page cache
or in swap, MISSING if it is gone. Register the range with RWP|MINOR and
the first access after collapse, shmem reclaim or MADV_DONTNEED arrives
as a minor fault. The monitor counts it as an access and resolves it
with UFFDIO_CONTINUE.

That is why there is no RWP marker: MINOR already covers it. WP needs a
marker because MINOR would trap reads as well, and a WP user does not
want those.

Anon has no MINOR mode, so there the bit stays wherever the page
survives: it is carried on swap and migration entries, and anon
collapse bails on uffd PTEs with SCAN_PTE_UFFD. MADV_DONTNEED frees the
page, so the next access is a MISSING fault.

The report registers RWP alone. That is the only setup where the access
after collapse goes unreported.

-- 
  Kiryl Shutsemau / Kirill A. Shutemov

Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

[Linus Torvalds]

On Wed, 11 Nov 2026 at 11:13, Kiryl Shutsemau <kas@kernel.org> wrote:
>
> The report registers RWP alone. That is the only setup where the access
> after collapse goes unreported.

Let's just document that as "don't care" with the reasoning.

               Linus

Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

[David Hildenbrand (Arm)]

On 11/11/26 19:53, Kiryl Shutsemau wrote:
> On Wed, Nov 11, 2026 at 08:29:50AM +0100, David Hildenbrand (Arm) wrote:
>> On 11/11/26 04:19, Tal Zussman wrote:
>>> So this issue was originally on my list and I had a fix for it... but it was
>>> REALLY ugly and a band-aid, so I dropped it.
>>
>> Yeah, RWP is a mess.
>>
>>>
>>> I think the real solution is to just add actual markers for RWP and solve
>>> all of these issues at once... but that should be a separate series from my
>>> batch of fixes (which I'll be sending shortly). Is there a reason RWP
>>> markers weren't done in the first place that I'm missing?
>>
>> Let's ask kiryl: why is it ok to drop RWP PTE bits during swapout, zap, collapse
>> etc?
>>
>> https://kernel.org/doc/html/latest/admin-guide/mm/userfaultfd.html?utm_source=chatgpt.com
>>
>> states "Unlike WP (which persists via PTE_MARKER_UFFD_WP), there is no
>> persistent RWP marker today. The user needs to re-arm the range with
>> UFFDIO_RWPROTECT after any operation that explicitly frees PTEs."
>>
>> But requiring the user to re-arm is rather questionable design if the kernel can
>> just zap these page table entries.
> 
> There is no need to re-arm. 
> 
> Once the PTE is zapped, the next access faults, and userfaultfd already
> has a mode for that fault: MINOR if the page is still in the page cache
> or in swap, MISSING if it is gone. Register the range with RWP|MINOR and
> the first access after collapse, shmem reclaim or MADV_DONTNEED arrives
> as a minor fault. The monitor counts it as an access and resolves it
> with UFFDIO_CONTINUE.
> 
> That is why there is no RWP marker: MINOR already covers it. WP needs a
> marker because MINOR would trap reads as well, and a WP user does not
> want those.
> 
> Anon has no MINOR mode, so there the bit stays wherever the page
> survives: it is carried on swap and migration entries, and anon
> collapse bails on uffd PTEs with SCAN_PTE_UFFD. MADV_DONTNEED frees the
> page, so the next access is a MISSING fault.
> 
> The report registers RWP alone. That is the only setup where the access
> after collapse goes unreported.

I have the faint recollection that we discussed that handling during early
(pre?) RWP handling.

I think that expectation and the implication is indeed not documented anywhere
for users that have no idea what markers are.

Even LLMs are confused.

Or is it documented already?

It would be a lot more consistent if we'd just add marker support. Or is there a
good reason why that is explicitly not wanted?

-- 
Cheers,

David

Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

[Linus Torvalds]

On Wed, 11 Nov 2026 at 12:20, David Hildenbrand (Arm) <david@kernel.org> wrote:
>
> It would be a lot more consistent if we'd just add marker support. Or is there a
> good reason why that is explicitly not wanted?

Let's not help people do things that won't work on older kernels for
no real gain.

Is there an actual real-life user that would care and be enormously
helped by such a thing and it would increase performance or something?
That sounds very unlikely, since presumably re-faulting never happens
in practice, so just tracking it in user space is "free".

In the absence of some real load with a real argument for it, please
let's just document existing behavior to the fact that you need to
simply see the re-faulting of these things..

And let's document it in a way where the LLM's also see it and don't
think it's a mistake.

               Linus

Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

[David Hildenbrand (Arm)]

On 11/11/26 21:55, Linus Torvalds wrote:
> On Wed, 11 Nov 2026 at 12:20, David Hildenbrand (Arm) <david@kernel.org> wrote:
>>
>> It would be a lot more consistent if we'd just add marker support. Or is there a
>> good reason why that is explicitly not wanted?
> 
> Let's not help people do things that won't work on older kernels for
> no real gain.

Uffd folks usually indicate such things through new uffd features.

> 
> Is there an actual real-life user that would care and be enormously
> helped by such a thing and it would increase performance or something?
> That sounds very unlikely, since presumably re-faulting never happens
> in practice, so just tracking it in user space is "free".
> 
> In the absence of some real load with a real argument for it, please
> let's just document existing behavior to the fact that you need to
> simply see the re-faulting of these things..
Just to express why I would even dare proposing to implement something in
userfaultfd: in Kiryl's series we abstracted the uffd-wp PTE bit to a uffd PTE
bit, which made things more generic.

Abstracting uffd-wp markers to uffd markers would similarly make things more
generic.

A quick codex prompt tells me: 90 insertions, 95 deletions.

But most changes are documentation either way, so that doesn't reflect reality.

Now let's ignore what I wrote above, I just polished another uffd fix and most
fixes I looked at throughout the last days were uffd related, which is starting
to get annoying.

So yes, no new uffd features.

-- 
Cheers,

David

Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

[Linus Torvalds]

On Wed, 11 Nov 2026 at 13:35, David Hildenbrand (Arm) <david@kernel.org> wrote:
>
> So yes, no new uffd features.

The one uffd feature I'd actually like is "no kernel faults".

Because damn it, that has been useful mostly yo people who want to
open up arbitrary kernel timing channels across user accesses.

            Linus

Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

[Jose A. Perez de Azpillaga]

On 11/11/26 8:29 AM, David Hildenbrand (Arm) wrote:
> On 11/11/26 04:19, Tal Zussman wrote:
>> On 11/10/26 6:55 AM, David Hildenbrand (Arm) wrote:
>>> On 11/10/26 12:54, n3rd wrote:
>>>>
>>>> Hello,
>>>>
>>>> I am reporting a security bug in the Linux kernel.
>>>
>>> Stop sending uffd problems as security bugs. STOP IT NOW.
>>>
>>> Tal has a long list of uffd-related fixes he is about to send out. CCing him.
>>>
>> So this issue was originally on my list and I had a fix for it... but it was
>> REALLY ugly and a band-aid, so I dropped it.
> 
> Yeah, RWP is a mess.
> 
>>
>> I think the real solution is to just add actual markers for RWP and solve
>> all of these issues at once... but that should be a separate series from my
>> batch of fixes (which I'll be sending shortly). Is there a reason RWP
>> markers weren't done in the first place that I'm missing?
> 
> Let's ask kiryl: why is it ok to drop RWP PTE bits during swapout, zap, collapse
> etc?
> 
> https://kernel.org/doc/html/latest/admin-guide/mm/userfaultfd.html?utm_source=chatgpt.com
> 
> states "Unlike WP (which persists via PTE_MARKER_UFFD_WP), there is no
> persistent RWP marker today. The user needs to re-arm the range with
> UFFDIO_RWPROTECT after any operation that explicitly frees PTEs."
> 
> But requiring the user to re-arm is rather questionable design if the kernel can
> just zap these page table entries.
> 
> @Jose, maybe you want to look into marker support for RWP to make RWP a bit less
> horrible?

oops. I overlooked the thread because of the AI report...

IMHO (and after reading Kiryl's email), I'd fix the doc instead. "Scope 
of protection" doesn't mention collapse or shmem reclaim, and it still 
tells the user to re-arm.

I could work on that patch :)

-- 
cheers,
jose a. p-a

Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

[Kiryl Shutsemau]

On Wed, Nov 11, 2026 at 08:43:47PM +0100, Jose A. Perez de Azpillaga wrote:
> On 11/11/26 8:29 AM, David Hildenbrand (Arm) wrote:
> > On 11/11/26 04:19, Tal Zussman wrote:
> > > On 11/10/26 6:55 AM, David Hildenbrand (Arm) wrote:
> > > > On 11/10/26 12:54, n3rd wrote:
> > > > > 
> > > > > Hello,
> > > > > 
> > > > > I am reporting a security bug in the Linux kernel.
> > > > 
> > > > Stop sending uffd problems as security bugs. STOP IT NOW.
> > > > 
> > > > Tal has a long list of uffd-related fixes he is about to send out. CCing him.
> > > > 
> > > So this issue was originally on my list and I had a fix for it... but it was
> > > REALLY ugly and a band-aid, so I dropped it.
> > 
> > Yeah, RWP is a mess.
> > 
> > > 
> > > I think the real solution is to just add actual markers for RWP and solve
> > > all of these issues at once... but that should be a separate series from my
> > > batch of fixes (which I'll be sending shortly). Is there a reason RWP
> > > markers weren't done in the first place that I'm missing?
> > 
> > Let's ask kiryl: why is it ok to drop RWP PTE bits during swapout, zap, collapse
> > etc?
> > 
> > https://kernel.org/doc/html/latest/admin-guide/mm/userfaultfd.html?utm_source=chatgpt.com
> > 
> > states "Unlike WP (which persists via PTE_MARKER_UFFD_WP), there is no
> > persistent RWP marker today. The user needs to re-arm the range with
> > UFFDIO_RWPROTECT after any operation that explicitly frees PTEs."
> > 
> > But requiring the user to re-arm is rather questionable design if the kernel can
> > just zap these page table entries.
> > 
> > @Jose, maybe you want to look into marker support for RWP to make RWP a bit less
> > horrible?
> 
> oops. I overlooked the thread because of the AI report...
> 
> IMHO (and after reading Kiryl's email), I'd fix the doc instead. "Scope of
> protection" doesn't mention collapse or shmem reclaim, and it still tells
> the user to re-arm.
> 
> I could work on that patch :)

Thanks for volunteering :)

-- 
  Kiryl Shutsemau / Kirill A. Shutemov