Re: [PATCH v3 1/2] mm/khugepaged: Never install PMDs in uffd-minor-registered VMAs

[James Houghton <jthoughton@google.com>]

On Mon, Sep 21, 2026 at 11:52 AM David Hildenbrand (Arm)
<david@kernel.org> wrote:
>
> On 9/10/26 04:34, James Houghton wrote:
> > Userfaultfd minor faults provides userspace with the ability to manually
> > install PTEs with UFFDIO_CONTINUE. Right now, MADV_COLLAPSE can map
> > holes in the VMA when a naturally-aligned THP is present. This is not
> > true for khugepaged collapse: the PTEs will be retracted, but a PMD will
> > not be installed.
>
> You might want to add a breadcrumb here that collapse_file() never returns
> SCAN_PTE_MAPPED_HUGEPAGE for khugepaged.

collapse_file() does return SCAN_PTE_MAPPED_HUGEPAGE even when called
by khugepaged though. (right?)

>
> The whole thing makes me wonder why that khugepaged check is buried so deep down
> in that function. Makes me wonder whether that check can actually get pulled
> further out (maybe Kiryl's patches do that).
>
> try_collapse_pte_mapped_thp(mm, addr, !cc->is_khugepaged);
>
> is rather confusing when we never end up there with khugepaged ...

Hmm... it's not confusing to me; khugepaged does in fact call it. It's
just that, for khugepaged, a PMD is never installed.

Kiryl's series made the "do not install a PMD" choice part of the
collapse_policy, so I think it's a bit clearer now.

>
> >
> > When MADV_COLLAPSE installs a PMD that mapped holes in the VMA,
> > userspace is likely to expect UFFDIO_CONTINUE to succeed on the
> > should-be holes. UFFDIO_CONTINUE will fail and return EEXIST.
> >
> > This is not inherently a problem, as MADV_COLLAPSE is an explicit
> > userspace action. But, especially because MADV_COLLAPSE can be invoked
> > by an external process via process_madvise(), a rogue caller could break
> > a userfaultfd-minor resolver thread. If khugepaged is later updated to
> > install PMDs for khugepaged collapsing, that would be a genuine problem.
> >
> > Userspace cannot generally use MADV_COLLAPSE to resolve userfault minor
> > faults, as MADV_COLLAPSE will only resolve such faults if a
> > naturally-aligned THP is present.
> >
> > The naturally-aligned THP case is the only case where this quirk exists.
> > Collapsing otherwise requires all PTEs to be present for
> > userfaultfd-registered VMAs (i.e., max none PTEs is 0), which is
> > correct. This check is essentially bypassed for naturally-aligned THPs.
> >
> > Suggested-by: Lance Yang <lance.yang@linux.dev>
> > Tested-by: Lance Yang <lance.yang@linux.dev>
> > Signed-off-by: James Houghton <jthoughton@google.com>
> > ---
> > v2: https://lore.kernel.org/linux-mm/20260828222640.1638457-1-jthoughton@google.com/
> > Changes since v2:
> >  - Drop cc:stable and update the changelog for the main patch.
> >    khugepaged doesn't actually install PMDs, so it is impossible for the
> >    kernel to silently install mappings that userspace didn't ask for.
> >    Therefore this patch does not need to be backported.
> >  - Update the uffd-unit-tests selftest to account for the new behavior
> >    (new patch). This patched selftest is equivalent to the reproducer I
> >    provided in v1.
> >
> > v1: https://lore.kernel.org/linux-mm/20260828005004.2870750-1-jthoughton@google.com/
> > ---
> >  mm/khugepaged.c | 7 +++++++
> >  1 file changed, 7 insertions(+)
> >
> > diff --git a/mm/khugepaged.c b/mm/khugepaged.c
> > index 75639298efc2..e6947fe142ee 100644
> > --- a/mm/khugepaged.c
> > +++ b/mm/khugepaged.c
> > @@ -1894,6 +1894,13 @@ static enum scan_result try_collapse_pte_mapped_thp(struct mm_struct *mm, unsign
> >       if (userfaultfd_protected(vma))
> >               return SCAN_PTE_UFFD;
> >
> > +     /*
> > +      * Userfaultfd-minor-registered VMAs should not be collapsed, as
> > +      * userspace is expecting to explicitly install PTEs.
> > +      */
> > +     if (userfaultfd_minor(vma))
> > +             return SCAN_PTE_UFFD;
>
> Can we just combine the two uffd checks to have less uffd noise? :)
>
> "Don't collapse if we might have UFFD markers or if userspace fills the page
> tables through uffd minor faults".

I've gone with this wording:

        /*
         * Don't collapse if there might be PTE markers for userfaultfd-based
         * access protection or if collapsing might bypass userfaultfd minor
         * faults.
         */
        if (userfaultfd_protected(vma) || userfaultfd_minor(vma))
                return SCAN_PTE_UFFD;

>
> Overall LGTM

Thanks David. :) Sorry for the delay. I'll send a new version tomorrow
(on top of Kiryl's patches / mm-unstable).