Re: [SECURITY] mm: khugepaged collapse_file() drops RWP PTE markers

[Kiryl Shutsemau <kas@kernel.org>]

On Wed, Nov 11, 2026 at 08:43:47PM +0100, Jose A. Perez de Azpillaga wrote:
> On 11/11/26 8:29 AM, David Hildenbrand (Arm) wrote:
> > On 11/11/26 04:19, Tal Zussman wrote:
> > > On 11/10/26 6:55 AM, David Hildenbrand (Arm) wrote:
> > > > On 11/10/26 12:54, n3rd wrote:
> > > > > 
> > > > > Hello,
> > > > > 
> > > > > I am reporting a security bug in the Linux kernel.
> > > > 
> > > > Stop sending uffd problems as security bugs. STOP IT NOW.
> > > > 
> > > > Tal has a long list of uffd-related fixes he is about to send out. CCing him.
> > > > 
> > > So this issue was originally on my list and I had a fix for it... but it was
> > > REALLY ugly and a band-aid, so I dropped it.
> > 
> > Yeah, RWP is a mess.
> > 
> > > 
> > > I think the real solution is to just add actual markers for RWP and solve
> > > all of these issues at once... but that should be a separate series from my
> > > batch of fixes (which I'll be sending shortly). Is there a reason RWP
> > > markers weren't done in the first place that I'm missing?
> > 
> > Let's ask kiryl: why is it ok to drop RWP PTE bits during swapout, zap, collapse
> > etc?
> > 
> > https://kernel.org/doc/html/latest/admin-guide/mm/userfaultfd.html?utm_source=chatgpt.com
> > 
> > states "Unlike WP (which persists via PTE_MARKER_UFFD_WP), there is no
> > persistent RWP marker today. The user needs to re-arm the range with
> > UFFDIO_RWPROTECT after any operation that explicitly frees PTEs."
> > 
> > But requiring the user to re-arm is rather questionable design if the kernel can
> > just zap these page table entries.
> > 
> > @Jose, maybe you want to look into marker support for RWP to make RWP a bit less
> > horrible?
> 
> oops. I overlooked the thread because of the AI report...
> 
> IMHO (and after reading Kiryl's email), I'd fix the doc instead. "Scope of
> protection" doesn't mention collapse or shmem reclaim, and it still tells
> the user to re-arm.
> 
> I could work on that patch :)

Thanks for volunteering :)

-- 
  Kiryl Shutsemau / Kirill A. Shutemov