---
name: "UFFDIO_POISON"
section: "2const"
platform: "linux"
package: "man-pages"
version: "6.19-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/UFFDIO_POISON"
---

# UFFDIO\_POISON(2const)

mark an address range as "poisoned"

## NAME

UFFDIO\_POISON - mark an address range as "poisoned"

## LIBRARY

Standard C library (*libc*, *-lc*)

## SYNOPSIS

```
#include <linux/userfaultfd.h>  /* Definition of UFFD* constants */
#include <sys/ioctl.h>
```

**int ioctl(int** *fd***, UFFDIO\_POISON, ...);**

**#include \<linux/userfaultfd.h\>**

```
struct uffdio_poison {
	struct uffdio_range  range;
	                  /* Range to install poison PTE markers in */
	__u64   mode;     /* Flags controlling the behavior of poison */
	__s64   updated;  /* Number of bytes poisoned, or negated error */
};
```

## DESCRIPTION

Mark an address range as "poisoned". Future accesses to these addresses will raise a **SIGBUS** signal. Unlike **MADV\_HWPOISON** this works by installing page table entries, rather than "really" poisoning the underlying physical pages. This means it only affects this particular address space.

The following value may be bitwise ORed in *mode* to change the behavior of the **UFFDIO\_POISON** operation:

- **UFFDIO\_POISON\_MODE\_DONTWAKE**

  Do not wake up the thread that waits for page-fault resolution.

The *updated* field is used by the kernel to return the number of bytes that were actually poisoned, or an error in the same manner as **UFFDIO\_COPY**. If the value returned in the *updated* field doesn't match the value that was specified in *range.len*, the operation fails with the error **EAGAIN**. The *updated* field is output-only; it is not read by the **UFFDIO\_POISON** operation.

## RETURN VALUE

On success, 0 is returned. In this case, the entire area was poisoned.

On error, -1 is returned and *errno* is set to indicate the error.

## ERRORS

- **EAGAIN**

  The number of bytes mapped (i.e., the value returned in the *updated* field) does not equal the value that was specified in the *range.len* field.

- **EINVAL**

  Either *range.start* or *range.len* was not a multiple of the system page size; or *range.len* was zero; or the range specified was invalid.

- **EINVAL**

  An invalid bit was specified in the *mode* field.

- **EEXIST**

  One or more pages were already mapped in the given range.

- **ENOENT**

  The faulting process has changed its virtual memory layout simultaneously with an outstanding **UFFDIO\_POISON** operation.

- **ENOMEM**

  Allocating memory for page table entries failed.

- **ESRCH**

  The faulting process has exited at the time of a **UFFDIO\_POISON** operation.

## STANDARDS

Linux.

## HISTORY

Linux 6.6.

## EXAMPLES

See [**userfaultfd**(2)](/userfaultfd/2.md).

## SEE ALSO

[**ioctl**(2)](/ioctl/2.md), [**ioctl\_userfaultfd**(2)](/ioctl_userfaultfd/2.md), [**userfaultfd**(2)](/userfaultfd/2.md)

*linux.git/Documentation/admin-guide/mm/userfaultfd.rst*