From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794424358; b=o567/TMLzwKkVcOUjJgSemeBqEDHthTxa+8LnnWsLfBpS2qj3USGrX3Rv4W98zqtn97m SzSVtK4yCuKDOctTxrQbPKzJhy972Rk1np5yB8HRtQHhchmoPAiwBF4hkB/CX08m3gXrM FJ/9MYxjpK7rfcDYP7bBJWqIHD2CwHHdV5yV/PiCHOsZPuWNsve2lKlKTZqng2jGS1Eah SK/5nEInCdC8VtSU0mgDKAi2FOtTLoQcQxMUgD3HHUgW1Cs/nXPq3VZrol20MmUa4Rx2C +VGOwNZ/Y202fdUKAkef5sSeYXbkX0mxELLVFT+IwVhVH2Y13WM/iYGHglj6ZaoDyTw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794424358; h=Received:DKIM-Signature:Received:Received:X-ME-Sender:X-ME-Received: X-ME-Proxy-Cause:X-ME-Proxy:Feedback-ID:Received:Date:From:To:Cc: Subject:Message-ID:References:MIME-Version:Content-Type: Content-Disposition:In-Reply-To; bh=9rzvnRWJjWzbxf1CdqOdngD5YMGoOzjDwN76qmbiuFc=; b=SIXPD0SUaYhh1EftDdSidPLxyRTXXqltIKkK+6iFOh9FVU57fzwrvOKo5xiUYMYgPTfP qzdUCt+VquuFNwSzza3xntNclP1fC8my9T6JMGXYCw1hT3AfYBZIOUtlPIlTgAUa/KgCw YZhs5ctWWgQbAdTPT/cAweYOO60nXq4w/Qt11ivDtH/vQ8oMYONzE77NxhcahM1X9apuD QCEwucUBZHrHOsS4qOYK3C8AgxRvAxoxxoioybiaBJ4A3tZ+6sjXOi/9F4qcWEDzvKMoA eJZvh66nIKMDNdZjBjixoFDOcN6XTsYrRDiqaDYZtzQ1u4jgVM+VIQHCnRMnfLjC16w== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=jzfu4WAA; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CE39B60A2602 for ; Wed, 11 Nov 2026 19:12:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=jzfu4WAA Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3216D1F00A05; Wed, 11 Nov 2026 19:12:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794424358; bh=9rzvnRWJjWzbxf1CdqOdngD5YMGoOzjDwN76qmbiuFc=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=jzfu4WAA6ElJ02kn/Kow/ZSu0s0IB0QJ2OsvUpsYACJnXnbWmm539erPelJDDOfOe aw6+cCZQJJqvUwITWwqeUpUsZd/9qAmO8xWtxYPAh4ibTOCRkVHUc4/WC0mLkcI2zy XDdtfmZEI/5RrpshDsKQsdXJ4xKRLav0prmxY1A0DU+X7K4hgSXVGXvSLisdoU20yu kUvz9iHFP9GrF6KjqI16Hy8aT0y9fkL179uWyhqMnF/PP4hiKaoaqPM8NAE8Py/aP1 To5D9e2/M2EdcYoM0Gq597Ns7nEpZq8VXxsmHf8cebTfYQJEJrkSVRGXReYwJulZ4Y 62sajGVCqmEUg== Received: from phl-compute-03.internal (phl-compute-03.internal [10.202.2.43]) by mailfauth.ams.internal (Postfix) with ESMTP id 287B8198004A; Wed, 11 Nov 2026 14:12:28 -0500 (EST) Received: from phl-frontend-03 ([10.202.2.162]) by phl-compute-03.internal (MEProxy); Wed, 11 Nov 2026 14:12:34 -0500 X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTES/6cX0KaFoJYJ4MHvoyZOb6MXDU0/tO2FG3RhJxxbVEfD8pjHEIxsQzk0Al2yPN SEhfIex5SKtz3lQPun/UByqNcs/KxTT5GXvxxYylZ4FlJU2QVRNetXmrPMM9RL9Vt+vqmI GbyZH9mdeKdScR+BW8cX/HcTaYp4E9mis5e5ATXCP8qD2KZAL6IPA3zSlQRZ2QhQQpw7o1 2U27Sm7SGvcB8wymQGlny6KDRlL+gv07ozEKC+ckkFNc2fIPs5sPEN/TFM8t+MtO0rkq+H 8pt3TP4ChsV/1DQckczcrs8gXCDvRLQDfJzvJxquUNHH9cvUj99Q01NMCnsHpJGK1Le+kZ 4+pDo4bpQyKl62ZpWv7iXTTVuBsu5f+usqWAKQ3eRZbhK9VQt0rRvbUqMjcLfCd6iWOi67 TZx6wJtmbqeDb5YKJQTg8mVMsB2ssGUxwc0+DrORZGZtNURNi5f84iuKnV5uP1YDAZd3V+ /EL10zfWdPyT3ztdXn6fHlQ/cOeHFz3MuPej6yOli5FkSC6OHMJJsyQady8n+FGpjxh4tH BJZKq251ZhN9/vc588/+ysP2jaAh1lsok4VTfRVbn8wSDQoKxSs6p9H3m+/8e05fRJTfYx pcw0WN8tvBrhB49hWK5zJ5q2V3eDoF79C3BirccEq4Qbj72ChN/eTWjQZqrg X-ME-Proxy: Feedback-ID: i10464835:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Wed, 11 Nov 2026 14:12:26 -0500 (EST) Date: Wed, 11 Nov 2026 19:12:25 +0000 From: Kiryl Shutsemau To: Tal Zussman Cc: Andrew Morton , Mike Rapoport , Peter Xu , James Houghton , Andrea Arcangeli , Suren Baghdasaryan , Balbir Singh , "Liam R. Howlett" , Lorenzo Stoakes , Vlastimil Babka , Jann Horn , Pedro Falcato , =?utf-8?B?TWljaGHFgiBNaXJvc8WCYXc=?= , Andrei Vagin , Stephen Rothwell , Arnd Bergmann , Muhammad Usama Anjum , David Hildenbrand , Zi Yan , Matthew Brost , Joshua Hahn , Byungchul Park , Gregory Price , Ying Huang , Alistair Popple , Baolin Wang , Nico Pache , Ryan Roberts , Dev Jain , Barry Song , Lance Yang , Usama Arif , Chris Down , Muchun Song , Oscar Salvador , =?utf-8?Q?Miko=C5=82aj?= Lenczewski , Michal Hocko , Mike Kravetz , linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org Subject: Re: [PATCH 06/12] mm/huge_memory: build the moved huge zero PMD from the destination VMA Message-ID: References: <20261111-uffd-state-fixes-v1-0-00713d368976@columbia.edu> <20261111-uffd-state-fixes-v1-6-00713d368976@columbia.edu> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20261111-uffd-state-fixes-v1-6-00713d368976@columbia.edu> On Wed, Nov 11, 2026 at 12:55:14PM -0500, Tal Zussman wrote: > move_pages_huge_pmd() builds the destination PMD for the huge zero page > by copying the source PMD and clearing its uffd bit, so the destination > keeps the protection of the source. > > A source VMA registered for RWP can map the huge zero page with a > PAGE_NONE PMD, and UFFDIO_MOVE does not check how the source is > registered. The destination then gets a PAGE_NONE PMD without the uffd > bit, although nothing asked for that in the destination VMA. > > The next access fixes it up through the NUMA hinting fault path. Until > then, the first access to the destination takes a spurious fault and GUP > has to take the fault path. The impact on userspace is small. > > The moved entry must have the protection of the destination VMA. To fix > it, build the entry from the vm_page_prot of the destination VMA, as > move_zeropage_pte() does for the small zero page, and keep marking it > soft-dirty. A destination VMA registered for RWP still gets its PMD > re-armed afterwards. > > Fixes: 763f43865fc4 ("mm: preserve RWP marker across PTE rewrites") > Signed-off-by: Tal Zussman Reviewed-by: Kiryl Shutsemau (Meta) -- Kiryl Shutsemau / Kirill A. Shutemov