From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1792511508; b=DMsIpsSUYw+6St7/wkscjyMkmg/Rm81D+GXaPu13ZYJ6ESdSTksYpn8D5chdLcxUTQ/C lEGvzSZX9T1sBwtMP31/HojuszgdiGkoOJGahSr87kQqaLVjyWCKInwxWhFRs17ahVG+S O0noifGqB+ePYonNADWm6IuAgWUASMzvVDN9H4pC45IOzFzBq9NJUgTyqtlV9wQVmHzn1 JNzNt0uMkhAUMO3ZiNnG2gk9wvxTHha+xQUFBprz1qRYFxdkBbronXtRlTYHiNWDpovmW HFSTWzRryJlKsO0E4SVePlPfp9AWZD7cKJJt0j11hBZEJRZjNmphqbD/lb8VQtqJmUg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792511508; h=Received:Message-ID:Date:MIME-Version:User-Agent:Subject:To:Cc: References:From:Content-Language:Autocrypt:In-Reply-To:Content-Type: Content-Transfer-Encoding; bh=rp2WPSA1/ERI/64JuBOxmZOEGsPjBzedZzE5dNWVpu8=; b=J+xONDvMkhAMxeh31a3OuhzX8UAfyYuJKAC4P/Nfgsl2NJjw7rf0e7wvR5OnIfWKPh14 uKw2rlcWmSDuYM+4Sep+TWKbUO8QpssyHa/IRHWTxISbCOF3sZkKDzFXqZjyerI6H17KU jDECiyp9mPn+nDm9rv+g5JV/qf9IpjOxHLnjMU++2iqxtkLlfe7c9JCnOSjCiw9M67jMO +9fQ0AvPY/hsYKyJKJ7GgxxYW8rkZktcxbOrvfgbqNxRGI+m0wTVZVpfeQN8n3+hdYycG 0gEBXQYEBWVyKlwTk9Nac9Vfa3Wr8QuVSbO+5M2UH8IWWyfmkXPkISVyOtxZCY0W1qw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2232B606A320; Tue, 20 Oct 2026 15:51:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9AE881F000C4; Tue, 20 Oct 2026 15:51:45 +0000 (UTC) Message-ID: Date: Tue, 20 Oct 2026 17:51:12 +0200 X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] mm/vma: avoid broken uffd merge on mremap To: "Lorenzo Stoakes (ARM)" , Andrew Morton , "Liam R. Howlett" , Vlastimil Babka , Jann Horn , Pedro Falcato , Mike Rapoport , Peter Xu , Kiryl Shutsemau Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, shaos , stable@vger.kernel.org References: <20261020-uffd-remap-fix-v1-1-0f34fc181f0a@kernel.org> From: "David Hildenbrand (Arm)" Content-Language: en-US Autocrypt: addr=david@kernel.org; keydata= xsFNBFXLn5EBEAC+zYvAFJxCBY9Tr1xZgcESmxVNI/0ffzE/ZQOiHJl6mGkmA1R7/uUpiCjJ dBrn+lhhOYjjNefFQou6478faXE6o2AhmebqT4KiQoUQFV4R7y1KMEKoSyy8hQaK1umALTdL QZLQMzNE74ap+GDK0wnacPQFpcG1AE9RMq3aeErY5tujekBS32jfC/7AnH7I0v1v1TbbK3Gp XNeiN4QroO+5qaSr0ID2sz5jtBLRb15RMre27E1ImpaIv2Jw8NJgW0k/D1RyKCwaTsgRdwuK Kx/Y91XuSBdz0uOyU/S8kM1+ag0wvsGlpBVxRR/xw/E8M7TEwuCZQArqqTCmkG6HGcXFT0V9 PXFNNgV5jXMQRwU0O/ztJIQqsE5LsUomE//bLwzj9IVsaQpKDqW6TAPjcdBDPLHvriq7kGjt WhVhdl0qEYB8lkBEU7V2Yb+SYhmhpDrti9Fq1EsmhiHSkxJcGREoMK/63r9WLZYI3+4W2rAc UucZa4OT27U5ZISjNg3Ev0rxU5UH2/pT4wJCfxwocmqaRr6UYmrtZmND89X0KigoFD/XSeVv jwBRNjPAubK9/k5NoRrYqztM9W6sJqrH8+UWZ1Idd/DdmogJh0gNC0+N42Za9yBRURfIdKSb B3JfpUqcWwE7vUaYrHG1nw54pLUoPG6sAA7Mehl3nd4pZUALHwARAQABzS5EYXZpZCBIaWxk ZW5icmFuZCAoQ3VycmVudCkgPGRhdmlkQGtlcm5lbC5vcmc+wsGQBBMBCAA6AhsDBQkmWAik AgsJBBUKCQgCFgICHgUCF4AWIQQb2cqtc1xMOkYN/MpN3hD3AP+DWgUCaYJt/AIZAQAKCRBN 3hD3AP+DWriiD/9BLGEKG+N8L2AXhikJg6YmXom9ytRwPqDgpHpVg2xdhopoWdMRXjzOrIKD g4LSnFaKneQD0hZhoArEeamG5tyo32xoRsPwkbpIzL0OKSZ8G6mVbFGpjmyDLQCAxteXCLXz ZI0VbsuJKelYnKcXWOIndOrNRvE5eoOfTt2XfBnAapxMYY2IsV+qaUXlO63GgfIOg8RBaj7x 3NxkI3rV0SHhI4GU9K6jCvGghxeS1QX6L/XI9mfAYaIwGy5B68kF26piAVYv/QZDEVIpo3t7 /fjSpxKT8plJH6rhhR0epy8dWRHk3qT5tk2P85twasdloWtkMZ7FsCJRKWscm1BLpsDn6EQ4 jeMHECiY9kGKKi8dQpv3FRyo2QApZ49NNDbwcR0ZndK0XFo15iH708H5Qja/8TuXCwnPWAcJ DQoNIDFyaxe26Rx3ZwUkRALa3iPcVjE0//TrQ4KnFf+lMBSrS33xDDBfevW9+Dk6IISmDH1R HFq2jpkN+FX/PE8eVhV68B2DsAPZ5rUwyCKUXPTJ/irrCCmAAb5Jpv11S7hUSpqtM/6oVESC 3z/7CzrVtRODzLtNgV4r5EI+wAv/3PgJLlMwgJM90Fb3CB2IgbxhjvmB1WNdvXACVydx55V7 LPPKodSTF29rlnQAf9HLgCphuuSrrPn5VQDaYZl4N/7zc2wcWM7BTQRVy5+RARAA59fefSDR 9nMGCb9LbMX+TFAoIQo/wgP5XPyzLYakO+94GrgfZjfhdaxPXMsl2+o8jhp/hlIzG56taNdt VZtPp3ih1AgbR8rHgXw1xwOpuAd5lE1qNd54ndHuADO9a9A0vPimIes78Hi1/yy+ZEEvRkHk /kDa6F3AtTc1m4rbbOk2fiKzzsE9YXweFjQvl9p+AMw6qd/iC4lUk9g0+FQXNdRs+o4o6Qvy iOQJfGQ4UcBuOy1IrkJrd8qq5jet1fcM2j4QvsW8CLDWZS1L7kZ5gT5EycMKxUWb8LuRjxzZ 3QY1aQH2kkzn6acigU3HLtgFyV1gBNV44ehjgvJpRY2cC8VhanTx0dZ9mj1YKIky5N+C0f21 zvntBqcxV0+3p8MrxRRcgEtDZNav+xAoT3G0W4SahAaUTWXpsZoOecwtxi74CyneQNPTDjNg azHmvpdBVEfj7k3p4dmJp5i0U66Onmf6mMFpArvBRSMOKU9DlAzMi4IvhiNWjKVaIE2Se9BY FdKVAJaZq85P2y20ZBd08ILnKcj7XKZkLU5FkoA0udEBvQ0f9QLNyyy3DZMCQWcwRuj1m73D sq8DEFBdZ5eEkj1dCyx+t/ga6x2rHyc8Sl86oK1tvAkwBNsfKou3v+jP/l14a7DGBvrmlYjO 59o3t6inu6H7pt7OL6u6BQj7DoMAEQEAAcLBfAQYAQgAJgIbDBYhBBvZyq1zXEw6Rg38yk3e EPcA/4NaBQJonNqrBQkmWAihAAoJEE3eEPcA/4NaKtMQALAJ8PzprBEXbXcEXwDKQu+P/vts IfUb1UNMfMV76BicGa5NCZnJNQASDP/+bFg6O3gx5NbhHHPeaWz/VxlOmYHokHodOvtL0WCC 8A5PEP8tOk6029Z+J+xUcMrJClNVFpzVvOpb1lCbhjwAV465Hy+NUSbbUiRxdzNQtLtgZzOV Zw7jxUCs4UUZLQTCuBpFgb15bBxYZ/BL9MbzxPxvfUQIPbnzQMcqtpUs21CMK2PdfCh5c4gS sDci6D5/ZIBw94UQWmGpM/O1ilGXde2ZzzGYl64glmccD8e87OnEgKnH3FbnJnT4iJchtSvx yJNi1+t0+qDti4m88+/9IuPqCKb6Stl+s2dnLtJNrjXBGJtsQG/sRpqsJz5x1/2nPJSRMsx9 5YfqbdrJSOFXDzZ8/r82HgQEtUvlSXNaXCa95ez0UkOG7+bDm2b3s0XahBQeLVCH0mw3RAQg r7xDAYKIrAwfHHmMTnBQDPJwVqxJjVNr7yBic4yfzVWGCGNE4DnOW0vcIeoyhy9vnIa3w1uZ 3iyY2Nsd7JxfKu1PRhCGwXzRw5TlfEsoRI7V9A8isUCoqE2Dzh3FvYHVeX4Us+bRL/oqareJ CIFqgYMyvHj7Q06kTKmauOe4Nf0l0qEkIuIzfoLJ3qr5UyXc2hLtWyT9Ir+lYlX9efqh7mOY qIws/H2t In-Reply-To: <20261020-uffd-remap-fix-v1-1-0f34fc181f0a@kernel.org> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 10/20/26 16:55, Lorenzo Stoakes (ARM) wrote: > Userfaultfd often causes unexpected interactions within mm, and does so at > the intersection of uffd, mremap() and VMA merging. > > When an mremap of a VMA occurs, copy_vma_and_data() calls > mremap_userfaultfd_prep() to notify uffd of this. > > However, mremap_userfaultfd_prep() simply drops the UFFD context for the > VMA if the user did not register it for remap, i.e. didn't specify the > UFFD_FEATURE_EVENT_REMAP flag. > > This is OK for the VMA itself, as upon page table move, move_ptes() clears > UFFD page table flags, using vma_has_uffd_without_event_remap() to > determine whether to do so. > > However, this doesn't account for merging with adjacent VMAs, whose page > tables won't have received this treatment, and thus latent UFFD markers > will be left around. > > Worse, it'll break UFFD for any VMAs it is merged with. This is very > surprising behaviour for a user, who will then simply not receive UFFD > events for VMAs they ought to. > > Resolve the issue by explicitly checking for this case via > vma_has_uffd_without_event_remap() in vma_merge_copied_range(), the merge > function explicitly designated for mremap() operations. > > Also update the userland VMA tests accordingly. > > Reported-by: shaos > Closes: https://lore.kernel.org/all/20261020110748.959870-1-shawnq1@163.com/ > Fixes: 3cfd22be0ad6 ("userfaultfd: clear flag if remap event not enabled") > Cc: stable@vger.kernel.org > Signed-off-by: Lorenzo Stoakes (ARM) > --- > mm/vma.c | 5 +++++ > tools/testing/vma/include/stubs.h | 5 +++++ > 2 files changed, 10 insertions(+) > > diff --git a/mm/vma.c b/mm/vma.c > index de5ebc57e7a5..1be613044b4a 100644 > --- a/mm/vma.c > +++ b/mm/vma.c > @@ -1211,6 +1211,11 @@ static struct vm_area_struct *vma_merge_copied_range(struct vma_merge_struct *vm > > vmg->copied_from = vmg->middle; > vmg->middle = NULL; > + > + /* If not registered for remap, uffd context will be cleared. */ > + if (vma_has_uffd_without_event_remap(vmg->copied_from)) > + return NULL; > + > return vma_merge_new_range(vmg); > } > > diff --git a/tools/testing/vma/include/stubs.h b/tools/testing/vma/include/stubs.h > index be8f5161f92a..f786a585caf0 100644 > --- a/tools/testing/vma/include/stubs.h > +++ b/tools/testing/vma/include/stubs.h > @@ -386,6 +386,11 @@ static inline bool is_mergeable_vm_userfaultfd_ctx(struct vm_area_struct *vma, > return true; > } > > +static inline bool vma_has_uffd_without_event_remap(struct vm_area_struct *vma) > +{ > + return false; > +} > + > static inline bool anon_vma_name_eq(struct anon_vma_name *anon_name1, > struct anon_vma_name *anon_name2) > { > @Kiryl that should solve the issue I was raising the other day with leftover uffd PTE bits outside of uffd areas? Can you review? -- Cheers, David