(cc Kiryl)
On Tue, Sep 22, 2026 at 01:40:51PM +0200, David Hildenbrand (Arm) wrote:
> On 9/19/26 02:46, Donggeun Yoo wrote:
> > UFFDIO_MOVE on a swapped-out page installs the source PTE at the
> > destination unchanged, so a uffd bit set on the source lands in a
> > destination VMA that was never registered for write protection. It is
> > then permanent: the bit is dropped only by change_protection() under
> > MM_CP_UFFD_{WP,RWP}_RESOLVE, which uffd_wp_range(), mrwprotect_range()
> > and userfaultfd_clear_vma() issue only for a VMA registered in that
> > mode. pagemap reports the page as uffd-tracked, and MADV_COLLAPSE
> > refuses the range while the bit is set, because collapse_scan_pmd() is
> > strict about uffd on swap entries.
> >
> > move_present_ptes() and move_zeropage_pte() build the destination PTE
> > from dst_vma->vm_page_prot and arm RWP only when dst_vma asks for it, so
> > the destination's own registration decides the result. move_swap_pte()
> > copies the source PTE instead and only ever sets the bit, never clears
> > it, so one UFFDIO_MOVE behaves differently depending on whether the page
> > happened to be resident.
> >
> > Clear the uffd bit on the moved swap entry unless the destination is
> > RWP-registered, as copy_nonpresent_pte() does where it installs a PTE
> > into a destination that may not be armed. A WP-registered destination
> > stops inheriting the bit as well, which is already what it gets when the
> > moved page is resident.
> >
> > Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
> > Cc: <[email protected]>
> > Signed-off-by: Donggeun Yoo <[email protected]>
> > ---
> > mm/userfaultfd.c | 2 ++
> > 1 file changed, 2 insertions(+)
> >
> > diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
> > index 74f04c323c50..6495666c596b 100644
> > --- a/mm/userfaultfd.c
> > +++ b/mm/userfaultfd.c
> > @@ -1452,6 +1452,8 @@ static int move_swap_pte(struct mm_struct *mm, struct
> > vm_area_struct *dst_vma,
> > /* Re-arm RWP on the moved swap entry if dst_vma is RWP-registered. */
> > if (userfaultfd_rwp(dst_vma))
> > orig_src_pte = pte_swp_mkuffd(orig_src_pte);
> > + else
> > + orig_src_pte = pte_swp_clear_uffd(orig_src_pte);
> > set_pte_at(mm, dst_addr, dst_pte, orig_src_pte);
> > double_pt_unlock(dst_ptl, src_ptl);
> >
>
> In move_present_ptes() we don't run into that issue as we create a new PTE
> from
> scratch
>
> orig_dst_pte = folio_mk_pte(src_folio, dst_vma->vm_page_prot);
>
>
> Staring at the
>
> if (userfaultfd_rwp(dst_vma))
>
> I do wonder why we don't have to take similar care about wp ... I'm sure the
> is
> a good reason.
>
> Code change itself LGTM.
>
>
> --
> Cheers,
>
> David
--
Sincerely yours,
Mike.
