Re: [PATCH] mm/ksm: fix userfaultfd protection during merge and unmerge

[David Hildenbrand (Arm)]

On 10/27/26 13:11, Kiryl Shutsemau wrote:
> On Mon, Oct 26, 2026 at 09:00:54PM +0800, Lance Yang wrote:
>> KSM loses userfaultfd protection when replace_page() builds a new PTE
>> from vma->vm_page_prot. Dropping its uffd bit lets a subsequent write go
>> through ordinary COW instead of userfaultfd write protection handling. For
>> RWP, a merged page also becomes readable without faulting.
>>
>> Keeping the uffd bit and restoring PAGE_NONE fixes merging, but we also
>> have to handle unmerging. An existing KSM page can be protected with RWP
>> before MADV_UNMERGEABLE, so unmerging already needs fixing independently
>> of preserving RWP during merging.
>>
>> Unsharing replaces a shared page with a private one and should leave
>> userfaultfd protection in place, as do_wp_page() already does for write
>> protection. Currently, an unshare fault reaches do_uffd_rwp() before it
>> can proceed to do_wp_page().
>>
>> - With synchronous RWP, handle_userfault() returns VM_FAULT_SIGBUS.
>>   break_ksm() then reports success with a KSM page still merged.
>>
>> - With asynchronous RWP, protection is cleared before unsharing.
>>
>> Preserve the uffd bit when merging, and restore PAGE_NONE for RWP. Let
>> FAULT_FLAG_UNSHARE skip RWP fault handling and keep PAGE_NONE on each
>> private copy as well. Unsharing can then complete with RWP still armed
>> for a subsequent access.
>>
>> Fixes: 63b2d4174c4a ("userfaultfd: wp: add the writeprotect API to userfaultfd ioctl")
>> Fixes: 2d427bb01639 ("mm/userfaultfd: add RWP fault delivery and expose UFFDIO_REGISTER_MODE_RWP")
>> Link: https://lore.kernel.org/all/20261019010934.697895-1-samarth.colleges@xxxxxxxxx/
>> Link: https://lore.kernel.org/all/20261020055518.36087-1-lance.yang@xxxxxxxxx/
>> Cc: stable@xxxxxxxxxxxxxxx
>> Co-developed-by: Samarth Narang <samarth.colleges@xxxxxxxxx>
>> Signed-off-by: Samarth Narang <samarth.colleges@xxxxxxxxx>
>> Signed-off-by: Lance Yang <lance.yang@xxxxxxxxx>
> 
> Thanks for fixing this:
> 
> Reviewed-by: Kiryl Shutsemau (Meta) <kas@xxxxxxxxxx>
> 
>> @@ -1463,9 +1464,14 @@ static int replace_page(struct vm_area_struct *vma, struct page *page,
>>  		dec_mm_counter(mm, MM_ANONPAGES);
>>  	}
>>  
>> -	/* Preserve soft-dirty when replacing the page. */
>> +	/* Preserve soft-dirty and uffd protection when replacing the page. */
> 
> Small nit: the period at the end of a single-line comment looks odd to
> me. Am I the only one?

I think you are. :)

I would complain if something looks like a sentence but doesn't end with a period.

It would be different it it's not actually a full sentence.

/* preserve soft-dirty */

-- 
Cheers,

David