Re: [BUG] mm: userfaultfd RWP drops a populated shmem PMD

[Kiryl Shutsemau]

On Tue, Oct 20, 2026 at 11:07:59AM +0000, shaos wrote:
> Hello,
> 
> UFFDIO_RWPROTECT_MODE_RWP can return success for a present shmem THP
> mapping while dropping the PMD mapping instead of leaving the
> populated page resident and write-protected. The next read refaults
> the page and completes without a UFFD_PAGEFAULT_FLAG_RWP event.

RWP only traps accesses to present PTEs. Arming a PMD-mapped shmem THP
splits the PMD, and splitting a file PMD unmaps it, so nothing is left
to protect. Populating the page table would not help: the PTEs are
empty and there is no RWP marker to put in them.

I think the right way to deal with it is for userspace to register the
range with UFFDIO_REGISTER_MODE_MINOR as well, and count the MINOR fault
that follows as an access.

-- 
  Kiryl Shutsemau / Kirill A. Shutemov