UFFDIO_MOVE on a swapped-out page installs the source PTE at the
destination unchanged, so a uffd bit set on the source lands in a
destination VMA that was never registered for write protection. It
can't be unset there, and THP collapse can't happen either, because a
swap entry with the uffd bit set makes the scan bail.
I don't think it's intentional because for an unswapped page the bit
doesn't come along, and I don't see why being swapped out should change
that.
Clear the uffd bit on the moved swap entry unless the destination is
RWP-registered.
Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
Cc: <[email protected]>
Assisted-by: LLM
Signed-off-by: Donggeun Yoo <[email protected]>
---
mm/userfaultfd.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index 74f04c323c50f..f39f109f17989 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -1449,6 +1449,7 @@ static int move_swap_pte(struct mm_struct *mm, struct
vm_area_struct *dst_vma,
orig_src_pte = ptep_get_and_clear(mm, src_addr, src_pte);
if (pgtable_supports_soft_dirty())
orig_src_pte = pte_swp_mksoft_dirty(orig_src_pte);
+ orig_src_pte = pte_swp_clear_uffd(orig_src_pte);
/* Re-arm RWP on the moved swap entry if dst_vma is RWP-registered. */
if (userfaultfd_rwp(dst_vma))
orig_src_pte = pte_swp_mkuffd(orig_src_pte);
--
2.53.0
