Re: [PATCH v2 1/2] userfaultfd: clear the inherited uffd bit in move_swap_pte()

[David Hildenbrand (Arm)]

On 9/25/26 06:48, Andrew Morton wrote:
> On Fri, 25 Sep 2026 13:29:06 +0900 Donggeun Yoo <donggeunyoo.kernel@xxxxxxxxx> wrote:
> 
>> UFFDIO_MOVE on a swapped-out page installs the source PTE at the
>> destination unchanged, so a uffd bit set on the source lands in a
>> destination VMA that was never registered for write protection.  It
>> can't be unset there, and THP collapse can't happen either, because a
>> swap entry with the uffd bit set makes the scan bail.
>>
>> I don't think it's intentional because for an unswapped page the bit
>> doesn't come along, and I don't see why being swapped out should change
>> that.
>>
>> Clear the uffd bit on the moved swap entry unless the destination is
>> RWP-registered.
> 
> Thanks, but...
> 
> When fixing a bug, please always fully describe the userspace-visible
> effects of that bug.

It would also be helpful to describe if this was actually hit in practice so
far. IOW, how relevant is this in practice.

Will this trigger a kernel splat later?

Someone would have to use UFFD_WP/UFFD_RWP with UFFDIO_MOVE, and have
UFFD_WP/UFFD_RWP disabled on the destination vma ... and then work on a swap entry.

Code itself LGTM

-- 
Cheers,

David