> On Sep 14, 2023, at 8:26 AM, Suren Baghdasaryan <surenb@xxxxxxxxxx> wrote: > > + if (!pte_same(ptep_clear_flush(src_vma, src_addr, src_pte), > + orig_src_pte)) > + BUG_ON(1); Just a minor detail regarding these few lines: Besides the less-than-ideal use of BUG_ON() here, I think that this code assumes that the PTE cannot change at this point. However, as the PTE was still mapped at this point, I think the access and dirty bits can be set. tl;dr: this appears to be triggerable by userspace. [ as for the performance of this code, the lack of batching would mean that for multithreaded applications where more than a single page is remapped, performance would suffer ]
