[PATCH v3 0/2] mm/userfaultfd: recheck WP registration in the hugetlb UFFDIO_COPY retry

[Jose A. Perez de Azpillaga]

The urgent fixes made hugetlb_fault() tolerate uffd bits left in VMAs
that are no longer registered for them, and asked for follow-ups that
remove the sources [1]. This is one: a hugetlb UFFDIO_COPY_MODE_WP copy
that has to fault in its source page doesn't recheck the WP registration
before retrying, so re-registering the range without WP in that window
leaves a uffd-wp PTE behind.

Patch 1 adds the missing check. Patch 2 adds a uffd-unit-tests case for
it, which fails on hugetlb without patch 1.

The other source 6/10 of [1] mentions, UFFDIO_COPY in MODE_WP racing
with UFFDIO_UNREGISTER [2], is closed by "mm/userfaultfd: write-lock the
VMA before waking waiters when unregistering" [3].

Based on mm-unstable.

Tested on x86_64 in QEMU.

[1] https://lore.kernel.org/20261015-urgent_fixes-v1-0-42796911043b@xxxxxxxxxx
[2] https://lore.kernel.org/20261015-urgent_fixes-v1-6-42796911043b@xxxxxxxxxx
[3] https://lore.kernel.org/20261031-fixes_core-v3-23-d6437171ecc3@xxxxxxxxxx (in linux-next)
[4] https://lore.kernel.org/sashiko-outbox-194303@xxxxxxxxxx

Changes in v3:
- 2/2: open the source userfaultfd with O_NONBLOCK and check for POLLIN,
  so poll() waits for the fault instead of returning POLLERR at once
  (reported by sashiko [4]), add Mike's Reviewed-by
- rebase on mm-unstable

Changes in v2:
- 1/2: drop the leftover sentence and the non-hugetlb reference from the
  commit message, add Mike's Reviewed-by
- 2/2: "all memory types" in the commit message, rename copy to result
- rebase on mm-unstable

v2: https://lore.kernel.org/20261102081140.201987-1-azpijr@xxxxxxxxx
v1: https://lore.kernel.org/20261029221129.89068-1-azpijr@xxxxxxxxx

Jose A. Perez de Azpillaga (2):
  mm/userfaultfd: recheck WP registration in the hugetlb UFFDIO_COPY
    retry
  selftests/mm: add a uffd test for re-registering during UFFDIO_COPY

 mm/userfaultfd.c                             |   4 +
 tools/testing/selftests/mm/uffd-unit-tests.c | 105 +++++++++++++++++++
 2 files changed, 109 insertions(+)


base-commit: 0ea6dc8c4a2192227ec25768625686b8fcd5cb09
--
2.56.0