From c37e9d9411a12240a60ca3796d3cbb496e6258a2 Mon Sep 17 00:00:00 2001 From: "David Hildenbrand (Arm)" Date: Thu, 15 Oct 2026 18:07:14 +0200 Subject: [PATCH] mm/hugetlb: tolerate UFFD_WP markers outside uffd-wp VMAs UFFD PTE bit handling is a bit like swiss cheese, in particular with recently added RWP mode. Having uffd-wp markers outside uffd-wp VMAs already confused this code in the past and resulted in uffd-pte bits confusing other code later. Let's play safe and just ignore these markers in hugetlb_no_page(), not silently propagating the uffd-wp PTE bit. Link: https://lore.kernel.org/20261015-urgent_fixes-v1-8-42796911043b@kernel.org Fixes: 2d427bb01639 ("mm/userfaultfd: add RWP fault delivery and expose UFFDIO_REGISTER_MODE_RWP") Signed-off-by: David Hildenbrand (Arm) Signed-off-by: Andrew Morton Acked-by: Lorenzo Stoakes (ARM) Reviewed-by: Lance Yang Cc: Liam R. Howlett Cc: Vlastimil Babka Cc: Jann Horn Cc: Pedro Falcato Cc: Muchun Song Cc: Oscar Salvador Cc: Miaohe Lin Cc: Naoya Horiguchi Cc: Adam Litke Cc: Mel Gorman Cc: Rik van Riel Cc: Peter Xu Cc: Kiryl Shutsemau Cc: Mike Rapoport Cc: Josef Bacik Cc: --- mm/hugetlb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index a4fede4be663..c6c45de147d2 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -5981,8 +5981,11 @@ static vm_fault_t hugetlb_no_page(struct address_space *mapping, /* * If this pte was previously wr-protected, keep it wr-protected even * if populated. + * + * TODO: fix all cases where uffd-wp markers remain in VMAs that are no + * longer registered with uffd. */ - if (unlikely(pte_is_uffd_wp_marker(vmf->orig_pte))) + if (unlikely(userfaultfd_wp(vma) && pte_is_uffd_wp_marker(vmf->orig_pte))) new_pte = huge_pte_mkuffd(new_pte); set_huge_pte_at(mm, vmf->address, vmf->pte, new_pte, huge_page_size(h));