UFFDIO_POISON(2const)

💖 UFFDIO_POISON(2const) 💖

okay bestie, so this is UFFDIO_POISON, and it lives in section 2const of the Linux man-pages. it's one of those ioctl constant pages, so buckle up, we're poisoning address ranges (in the cute, page-table way, not the illegal way 🧪).

---

✨ NAME ✨

UFFDIO_POISON — mark an address range as "poisoned"

---

📚 LIBRARY 📚

Standard C library (libc, -lc) 🫶

---

🎀 SYNOPSIS 🎀

no cap, this is the whole thing:

#include <linux/userfaultfd.h>  /* Definition of UFFD* constants */
#include <sys/ioctl.h>

int ioctl(int fd, UFFDIO_POISON, ...);

#include <linux/userfaultfd.h>

struct uffdio_poison {
     struct uffdio_range  range;
                       /* Range to install poison PTE markers in */
     __u64   mode;     /* Flags controlling the behavior of poison */
     __s64   updated;  /* Number of bytes poisoned, or negated error */
};

---

💅 DESCRIPTION 💅

so the vibe here is: you mark an address range as "poisoned", and any future access to those addresses is gonna raise a SIGBUS signal. 😭 rude, but that's the point.

and here's the thing that makes it different from MADV_HWPOISON: it works by installing page table entries, instead of actually "really" poisoning the underlying physical pages. it's giving illusion, not violence. which means it only affects this particular address space — your neighbors are safe, periodt. ✨

you can bitwise OR the following value into mode to change how the UFFDIO_POISON operation behaves:

• UFFDIO_POISON_MODE_DONTWAKE — do not wake up the thread that's waiting for page-fault resolution. let her sleep 💤

and now, the updated field. the kernel uses it to hand you back the number of bytes that were actually poisoned, or an error, in the exact same manner as UFFDIO_COPY. so if the value that comes back in updated does not match the value you specified in range.len, the operation fails with the error EAGAIN. 😤

important, bestie: updated is output-only. it is not read by the UFFDIO_POISON operation. don't try to talk to it, it's not listening. 🙈

---

🔥 RETURN VALUE 🔥

On success, 0 is returned. and in that case? the entire area was poisoned. ate. 👑

On error, -1 is returned and errno is set to indicate the error. classic.

---

💀 ERRORS 💀

• EAGAIN — the number of bytes mapped (i.e., the value returned in the updated field) does not equal the value that was specified in the range.len field.
• EINVAL — either range.start or range.len was not a multiple of the system page size; or range.len was zero; or the range specified was invalid.
• EINVAL — an invalid bit was specified in the mode field. (yes, EINVAL twice, that's just how she is 💅)
• EEXIST — one or more pages were already mapped in the given range. 💀
• ENOENT — the faulting process has changed its virtual memory layout simultaneously with an outstanding UFFDIO_POISON operation. multitasking gone wrong.
• ENOMEM — allocating memory for page table entries failed.
• ESRCH — the faulting process has exited at the time of a UFFDIO_POISON operation. she left 🚪

---

🌈 STANDARDS 🌈

Linux. that's it, that's the standard. 🐧

---

🦋 HISTORY 🦋

Linux 6.6. so it's a newer baddie, not an ancient one.

---

🍓 EXAMPLES 🍓

See userfaultfd(2). (iykyk — the examples live over there 🫶)

---

⭐ SEE ALSO ⭐

• ioctl(2)
• ioctl_userfaultfd(2)
• userfaultfd(2)
• linux.git/Documentation/admin-guide/mm/userfaultfd.rst

---

and that's the whole page, bestie!! 🎀✨ this cutie came out of Linux man-pages 6.20, dated 2026-02-08 — go poison some page tables responsibly, mwah 💖🧚‍♀️🌸