linux-kernel - Re: [PATCH mm-unstable] mm: Fix uffd-wp bit loss when batching file folio unmapping

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5af933d1-8c64-4d3c-b835-d90c8e9f771a@kernel.org>
Date: Fri, 16 Jan 2026 11:51:17 +0100
From: "David Hildenbrand (Red Hat)" <david@...nel.org>
To: Dev Jain <dev.jain@....com>, Lorenzo Stoakes
 <lorenzo.stoakes@...cle.com>, akpm@...ux-foundation.org
Cc: axelrasmussen@...gle.com, yuanchu@...gle.com, weixugc@...gle.com,
 Liam.Howlett@...cle.com, vbabka@...e.cz, rppt@...nel.org, surenb@...gle.com,
 mhocko@...e.com, riel@...riel.com, harry.yoo@...cle.com, jannh@...gle.com,
 ryan.roberts@....com, baohua@...nel.org, baolin.wang@...ux.alibaba.com,
 linux-mm@...ck.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH mm-unstable] mm: Fix uffd-wp bit loss when batching file
 folio unmapping

On 1/16/26 10:40, Dev Jain wrote:
> 
> On 16/01/26 2:09 pm, Lorenzo Stoakes wrote:
>> On Fri, Jan 16, 2026 at 01:57:21PM +0530, Dev Jain wrote:
>>> The recently added file folio unmap batching support forgets to update
>>> pte_install_uffd_wp_if_needed(), which still updates a single pte.
>>> We end up jumping to the end of the folio in page_vma_mapped_walk(), thus
>>> setting the uffd-wp marker only on a single pte in the batch. Fix this by
>>> passing nr_pages into the function, and set the uffd-wp marker on all ptes.
>>>
>>> Note that, since the nr_pages passed to this function is always derived by
>>> some sort of batching, it is guaranteed that the set of old ptevals of the
>>> batch have uffd-wp bit on all ptes or no ptes, therefore it is safe to derive
>>> the value of the local variable "arm_uffd_pte" from only the particular
>>> pteval passed to this function, but apply the result on all ptes of the batch.
>>>
>>> Use set_pte_at() in a loop to set the markers - we cannot use set_ptes()
>>> as that will increment the PFN, but we don't have any PFN to update here.
>>>
>>> The userspace visible effect of the bug is inaccuracy observed by workloads
>>> relying on uffd-wp regions to install their own pages.
>>>
>>> Fixes: 8798e255b5ec ("mm: rmap: support batched unmapping for file large folios")
>> Hmm this patch isn't upstream yet, so wouldn't this patch be better as a comment
>> replying to the series so it can be respun?
>>
>> You only do a fixes tag for either upstream things that obviously have to stay
>> in place or perhaps things in mm-stable immediately prior to merge window that
>> can't be adjusted.
> 
> I saw that the last comment on that series was more than a week back, so best
> thought to just do a folded fix on top of it - and I had formed the impression
> (from the conversations on list) that akpm prefers fixes over respins : )

That series is still on my TODO list and I hope Andrew will keep it out 
of stable until I get to it.

Hope is all I got ;)

-- 
Cheers

David