From: Foxie Flakey <foxieflakey@gmail.com>
To: akpm@linux-foundation.org, rppt@kernel.org, peterx@redhat.com
Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org
Subject: [PATCH] userfaultfd: reset err to be 0 when move_pages_ptes succeeded
Date: Sat, 15 Aug 2026 17:42:12 +0700 (WIB) [thread overview]
Message-ID: <9c936a9f-ed27-e510-872f-5b3b8c680975@gmail.com> (raw)
An fix for edge case can occur if move_pages_ptes return -EAGAIN, later
when checked and it is EAGAIN, outer loop would retry again on same page
and succeeded but the err isn't reset so the outer loop would think need
to retry again so it goes back again and move pages again. On third attempt
move_pages_ptes will fail because it already moved and returns an error
that is not EAGAIN when outer loop checks again it sees non EAGAIN so it
dont retry and break out of loop. When loop is terminated it did not update
the "moved" variable from successful 2nd iteration.
That behaviour manifested into this at userspace
Source: [ .. unmapped .. ][ .. mapped ..]
Destination: [ .. mapped .. ][ .. unmapped ..]
^ ^
\ Kernel moved this far in actuality
What is reported to userspace on struct
uffdio_move's move field
When the previous behaviour is
Source: [ .. unmapped .. ][ .. mapped ..]
Destination: [ .. mapped .. ][ .. unmapped ..]
^
Reported to user space via uffdio_move's
move field
Fixes: 50944692052b ("userfaultfd: opportunistic TLB-flush batching for present pages in MOVE")
Signed-off-by: Foxie Flakey <foxieflakey@gmail.com>
---
mm/userfaultfd.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index c3adedaaf7d5..595e7e232f90 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -2069,10 +2069,12 @@ static ssize_t move_pages(struct userfaultfd_ctx *ctx, unsigned long dst_start,
ret = move_pages_ptes(mm, dst_pmd, src_pmd,
dst_vma, src_vma, dst_addr,
src_addr, src_end - src_addr, mode);
- if (ret < 0)
+ if (ret < 0) {
err = ret;
- else
+ } else {
+ err = 0;
step_size = ret;
+ }
}
cond_resched();
base-commit: 62cc90241548d5570ee68e01aaba6506964e9811
--
2.55.0
next reply other threads:[~2026-08-15 10:42 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-15 10:42 Foxie Flakey [this message]
2026-08-16 9:15 ` Mike Rapoport
2026-08-16 9:41 ` Foxie Flakey
2026-08-16 11:45 ` Mike Rapoport
2026-08-16 13:58 ` Foxie Flakey
2026-08-18 17:07 ` Foxie Flakey
2026-08-16 15:43 ` Suren Baghdasaryan
2026-08-16 15:58 ` Foxie Flakey
2026-08-17 22:26 ` Andrew Morton
2026-08-17 22:35 ` Andrew Morton
2026-08-18 1:29 ` Foxie Flakey
2026-08-18 1:13 ` Foxie Flakey
2026-08-18 15:07 ` Suren Baghdasaryan
2026-08-18 16:50 ` Foxie Flakey
2026-08-18 17:11 ` Suren Baghdasaryan
2026-08-19 3:04 ` Foxie Flakey
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=9c936a9f-ed27-e510-872f-5b3b8c680975@gmail.com \
--to=foxieflakey@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=peterx@redhat.com \
--cc=rppt@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®