commit f369b07c861435bd812a9d14493f71b34132ed6f Author: Peter Xu <peterx@xxxxxxxxxx> Date: Thu Aug 11 16:13:40 2022 -0400 mm/uffd: reset write protection when unregister with wp-mode close should behave just like unregister. Simplified+readable reproducer: #define _GNU_SOURCE #include <stdint.h> #include <fcntl.h> #include <sys/syscall.h> #include <sys/mman.h> #include <sys/types.h> #include <sys/ioctl.h> #include <linux/userfaultfd.h> #include <unistd.h> int main(void) { void *src = mmap(0, 4096, PROT_READ, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0); void *dst = mmap(0, 4096, PROT_READ, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0); struct uffdio_register uffdio_register = {}; struct uffdio_copy uffdio_copy = {}; struct uffdio_api uffdio_api = {}; int uffd; uffd = syscall(SYS_userfaultfd, O_CLOEXEC | O_NONBLOCK | UFFD_USER_MODE_ONLY); uffdio_api.api = UFFD_API; ioctl(uffd, UFFDIO_API, &uffdio_api); uffdio_register.range.start = (uintptr_t)dst; uffdio_register.range.len = 4096; uffdio_register.mode = UFFDIO_REGISTER_MODE_WP; ioctl(uffd, UFFDIO_REGISTER, &uffdio_register); uffdio_copy.dst = (uintptr_t)dst; uffdio_copy.src = (uintptr_t)src; uffdio_copy.len = 4096; uffdio_copy.mode = UFFDIO_COPY_MODE_DONTWAKE|UFFDIO_COPY_MODE_WP; ioctl(uffd, UFFDIO_COPY, &uffdio_copy); close(uffd); mprotect(dst, 4096, PROT_READ|PROT_WRITE); return 0; }Thanks, I'll post a patch. PS: next time feel free to try "strace ./reproducer", it'll do the translations and I found it handy to work with syzbot.
Cool, was not aware that it would do that amount of translation! -- Cheers, David / dhildenb
