Re: [PATCH 08/10] mm/hugetlb: tolerate UFFD_WP markers outside uffd-wp VMAs

[Lorenzo Stoakes (ARM)]

On Thu, Oct 15, 2026 at 06:07:14PM +0200, David Hildenbrand (Arm) wrote:
> UFFD PTE bit handling is a bit like swiss cheese, in particular with
> recently added RWP mode. Having uffd-wp markers outside uffd-wp VMAs
> already confused this code in the past and resulted in uffd-pte bits
> confusing other code later.
>
> Let's play safe and just ignore these markers in hugetlb_no_page(), not
> silently propagating the uffd-wp PTE bit.
>
> Fixes: 2d427bb01639 ("mm/userfaultfd: add RWP fault delivery and expose UFFDIO_REGISTER_MODE_RWP")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: David Hildenbrand (Arm) <david@xxxxxxxxxx>

Seems sensible so:

Acked-by: Lorenzo Stoakes (ARM) <ljs@xxxxxxxxxx>

> ---
>  mm/hugetlb.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/mm/hugetlb.c b/mm/hugetlb.c
> index ba6860b9b7f4c..1548a6156206b 100644
> --- a/mm/hugetlb.c
> +++ b/mm/hugetlb.c
> @@ -5939,8 +5939,11 @@ static vm_fault_t hugetlb_no_page(struct address_space *mapping,
>  	/*
>  	 * If this pte was previously wr-protected, keep it wr-protected even
>  	 * if populated.
> +	 *
> +	 * TODO: fix all cases where uffd-wp markers remain in VMAs that are no
> +	 * longer registered with uffd.
>  	 */
> -	if (unlikely(pte_is_uffd_wp_marker(vmf->orig_pte)))
> +	if (unlikely(userfaultfd_wp(vma) && pte_is_uffd_wp_marker(vmf->orig_pte)))
>  		new_pte = huge_pte_mkuffd(new_pte);
>  	set_huge_pte_at(mm, vmf->address, vmf->pte, new_pte, huge_page_size(h));
>
>
> --
> 2.43.0
>

--
Cheers, Lorenzo