Re: [PATCH] userfaultfd: prevent registration of special VMAs

[Lorenzo Stoakes]

On Thu, Jun 18, 2026 at 11:37:10AM +0200, David Hildenbrand (Arm) wrote:
> On 6/18/26 11:35, Mike Rapoport wrote:
> > On Thu, Jun 18, 2026 at 11:25:31AM +0200, David Hildenbrand (Arm) wrote:
> >> On 6/18/26 11:21, Mike Rapoport wrote:
> >>>
> >>> Cleaner in what sense?
> >>> Will be uglier for sure, just take a look at vma_can_userfault().
> >>
> >> I was thinking of this:
> >>
> >> diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
> >> index 180bad42fc79..8a6803618a91 100644
> >> --- a/mm/userfaultfd.c
> >> +++ b/mm/userfaultfd.c
> >> @@ -2029,7 +2029,10 @@ bool vma_can_userfault(struct vm_area_struct *vma,
> >> vm_flags_t vm_flags,
> >>  {
> >>         const struct vm_uffd_ops *ops = vma_uffd_ops(vma);
> >>
> >> -       if (vma->vm_flags & VM_DROPPABLE)
> >> +       if (vma->vm_flags & (VM_DROPPABLE | VM_SHADOW_STACK))
> >> +               return false;
> >> +
> >> +       if (!is_vm_hugetlb_page(vma) && (vma->vm_flags & VM_SPECIAL))
> >>                 return false;

This is still pretty gross, and it's a bit odd to me that we will now enforce
userfaultfd on ranges that are somehow VMA_DONTEXPAND_BIT but not otherwise
'special'.

But I think that's because we even allow that to exist as a thing and have made
VMA_DONTEXPAND_BIT a little unclear in its behaviour.

But I'm fixing that, I'm working on a series that clears up the special flags,
and replaces the checks in general with vma_xxx() or vma_flags_xxx() predicated,
and which will ultimatately drop VM_SPECIAL/VMA_SPECIAL_FLAGS.

> >
> > In a way that's an extra check for hugetlb, but it will work.
>
> My point would be that we exclude all special VMAs, except hugetlb (which is
> special but supported ... in its special way).

Mike - you said you were respinning, it'd help my series if you respan the above
quickly so I could base my change on that :).

I can send a quick patch if you're tied up also!

>
> --
> Cheers,
>
> David
>

Thanks, Lorenzo