Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

[David Hildenbrand (Arm)]

On 11/10/26 12:54, n3rd wrote:
> 
> Hello,
> 
> I am reporting a security bug in the Linux kernel.

Stop sending uffd problems as security bugs. STOP IT NOW.

Tal has a long list of uffd-related fixes he is about to send out. CCing him.

-- 
Cheers,

David

Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

[Tal Zussman]

On 11/10/26 6:55 AM, David Hildenbrand (Arm) wrote:
> On 11/10/26 12:54, n3rd wrote:
>> 
>> Hello,
>> 
>> I am reporting a security bug in the Linux kernel.
> 
> Stop sending uffd problems as security bugs. STOP IT NOW.
> 
> Tal has a long list of uffd-related fixes he is about to send out. CCing him.
> 
So this issue was originally on my list and I had a fix for it... but it was
REALLY ugly and a band-aid, so I dropped it.

I think the real solution is to just add actual markers for RWP and solve
all of these issues at once... but that should be a separate series from my
batch of fixes (which I'll be sending shortly). Is there a reason RWP
markers weren't done in the first place that I'm missing?

Thanks,
Tal

Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

[David Hildenbrand (Arm)]

On 11/11/26 04:19, Tal Zussman wrote:
> On 11/10/26 6:55 AM, David Hildenbrand (Arm) wrote:
>> On 11/10/26 12:54, n3rd wrote:
>>>
>>> Hello,
>>>
>>> I am reporting a security bug in the Linux kernel.
>>
>> Stop sending uffd problems as security bugs. STOP IT NOW.
>>
>> Tal has a long list of uffd-related fixes he is about to send out. CCing him.
>>
> So this issue was originally on my list and I had a fix for it... but it was
> REALLY ugly and a band-aid, so I dropped it.

Yeah, RWP is a mess.

> 
> I think the real solution is to just add actual markers for RWP and solve
> all of these issues at once... but that should be a separate series from my
> batch of fixes (which I'll be sending shortly). Is there a reason RWP
> markers weren't done in the first place that I'm missing?

Let's ask kiryl: why is it ok to drop RWP PTE bits during swapout, zap, collapse
etc?

https://kernel.org/doc/html/latest/admin-guide/mm/userfaultfd.html?utm_source=chatgpt.com

states "Unlike WP (which persists via PTE_MARKER_UFFD_WP), there is no
persistent RWP marker today. The user needs to re-arm the range with
UFFDIO_RWPROTECT after any operation that explicitly frees PTEs."

But requiring the user to re-arm is rather questionable design if the kernel can
just zap these page table entries.

@Jose, maybe you want to look into marker support for RWP to make RWP a bit less
horrible?


-- 
Cheers,

David