[PATCH] mm/khugepaged: don't map folios that are not uptodate in MADV_COLLAPSE

[PATCH] mm/khugepaged: don't map folios that are not uptodate in MADV_COLLAPSE

[David Hildenbrand (Arm)]

madvise(MADV_COLLAPSE) can map PMD-sized pagecache folios that are not
uptodate. For example, shmem fallocate() can put such folios into the
page cache.

collapse_file() already refuses to proceed with folios that are not
uptodate. Let's just do the same in try_collapse_pte_mapped_thp() and skip
such folios, leaving handling to the page faults.

Note that collapse_file() effectively clears shmem folios through
shmem_get_folio(); let's keep this fix simple and simply let the page
fault path deal with that.

Fixes: 34488399fa08 ("mm/madvise: add file and shmem support to MADV_COLLAPSE")
Reported-by: Chris Mason <mason@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
---
Once reviewed, I will pick this up in a timely manner.
---
 mm/khugepaged.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index 8d9f05a39afb3..db135b3c44ef1 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -1900,6 +1900,12 @@ static enum scan_result try_collapse_pte_mapped_thp(struct mm_struct *mm, unsign
 		goto drop_folio;
 	}
 
+	/* Leave any uninitialized folios to the page fault path. */
+	if (!folio_test_uptodate(folio)) {
+		result = SCAN_FAIL;
+		goto drop_folio;
+	}
+
 	result = find_pmd_or_thp_or_none(mm, haddr, &pmd);
 	switch (result) {
 	case SCAN_SUCCEED:

---

base-commit: f44fd601f72e09e44c667b9234c9cd469856679c

change-id: 20261105-set_huge_pmd_uptodate-9b9820307f30

--

Cheers,

David

Re: [PATCH] mm/khugepaged: don't map folios that are not uptodate in MADV_COLLAPSE

[Lorenzo Stoakes (ARM)]

On Thu, Nov 05, 2026 at 07:16:44PM +0100, David Hildenbrand (Arm) wrote:
> madvise(MADV_COLLAPSE) can map PMD-sized pagecache folios that are not
> uptodate. For example, shmem fallocate() can put such folios into the
> page cache.
>
> collapse_file() already refuses to proceed with folios that are not
> uptodate. Let's just do the same in try_collapse_pte_mapped_thp() and skip
> such folios, leaving handling to the page faults.
>
> Note that collapse_file() effectively clears shmem folios through
> shmem_get_folio(); let's keep this fix simple and simply let the page
> fault path deal with that.
>
> Fixes: 34488399fa08 ("mm/madvise: add file and shmem support to MADV_COLLAPSE")
> Reported-by: Chris Mason <mason@kernel.org>
> Cc: stable@vger.kernel.org
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>

Looks reasonable to me, there's no reason we should be dealing with non-uptodate
folios there.

Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>

> ---
> Once reviewed, I will pick this up in a timely manner.
> ---
>  mm/khugepaged.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/mm/khugepaged.c b/mm/khugepaged.c
> index 8d9f05a39afb3..db135b3c44ef1 100644
> --- a/mm/khugepaged.c
> +++ b/mm/khugepaged.c
> @@ -1900,6 +1900,12 @@ static enum scan_result try_collapse_pte_mapped_thp(struct mm_struct *mm, unsign
>  		goto drop_folio;
>  	}
>
> +	/* Leave any uninitialized folios to the page fault path. */
> +	if (!folio_test_uptodate(folio)) {
> +		result = SCAN_FAIL;
> +		goto drop_folio;
> +	}
> +
>  	result = find_pmd_or_thp_or_none(mm, haddr, &pmd);
>  	switch (result) {
>  	case SCAN_SUCCEED:
>
> ---
>
> base-commit: f44fd601f72e09e44c667b9234c9cd469856679c
>
> change-id: 20261105-set_huge_pmd_uptodate-9b9820307f30
>
> --
>
> Cheers,
>
> David
>

--
Cheers, Lorenzo

Re: [PATCH] mm/khugepaged: don't map folios that are not uptodate in MADV_COLLAPSE

[Hugh Dickins]

On Thu, 5 Nov 2026, David Hildenbrand (Arm) wrote:

> madvise(MADV_COLLAPSE) can map PMD-sized pagecache folios that are not
> uptodate. For example, shmem fallocate() can put such folios into the
> page cache.
> 
> collapse_file() already refuses to proceed with folios that are not
> uptodate. Let's just do the same in try_collapse_pte_mapped_thp() and skip
> such folios, leaving handling to the page faults.
> 
> Note that collapse_file() effectively clears shmem folios through
> shmem_get_folio(); let's keep this fix simple and simply let the page
> fault path deal with that.
> 
> Fixes: 34488399fa08 ("mm/madvise: add file and shmem support to MADV_COLLAPSE")
> Reported-by: Chris Mason <mason@kernel.org>
> Cc: stable@vger.kernel.org
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>

Acked-by: Hugh Dickins <hughd@google.com>

Valuable catch, thanks. I was worried that "try_collapse_pte_mapped_thp"
implies there's already a PTE mapping the non-uptodate folio, which
would already be wrong. But we've been a little too free with the
SCAN_PTE_MAPPED_HUGEPAGE result code, so there's no such implication
(and even if there had been a good PTE, I doubt there's enough locking
to stop racing fallocates putting a non-uptodate folio there meanwhile).

I was going to quibble with the Fixes, thinking the problem was there
earlier: but no, I agree with you, that's when install_pmd came in.

> ---
> Once reviewed, I will pick this up in a timely manner.
> ---
>  mm/khugepaged.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/mm/khugepaged.c b/mm/khugepaged.c
> index 8d9f05a39afb3..db135b3c44ef1 100644
> --- a/mm/khugepaged.c
> +++ b/mm/khugepaged.c
> @@ -1900,6 +1900,12 @@ static enum scan_result try_collapse_pte_mapped_thp(struct mm_struct *mm, unsign
>  		goto drop_folio;
>  	}
>  
> +	/* Leave any uninitialized folios to the page fault path. */
> +	if (!folio_test_uptodate(folio)) {
> +		result = SCAN_FAIL;
> +		goto drop_folio;
> +	}
> +
>  	result = find_pmd_or_thp_or_none(mm, haddr, &pmd);
>  	switch (result) {
>  	case SCAN_SUCCEED:
> 
> ---
> 
> base-commit: f44fd601f72e09e44c667b9234c9cd469856679c
> 
> change-id: 20261105-set_huge_pmd_uptodate-9b9820307f30
> 
> --
> 
> Cheers,
> 
> David

Re: [PATCH] mm/khugepaged: don't map folios that are not uptodate in MADV_COLLAPSE

[Zi Yan]

On Thu Nov 5, 2026 at 1:16 PM EST, David Hildenbrand (Arm) wrote:
> madvise(MADV_COLLAPSE) can map PMD-sized pagecache folios that are not
> uptodate. For example, shmem fallocate() can put such folios into the
> page cache.
>
> collapse_file() already refuses to proceed with folios that are not
> uptodate. Let's just do the same in try_collapse_pte_mapped_thp() and skip
> such folios, leaving handling to the page faults.
>
> Note that collapse_file() effectively clears shmem folios through
> shmem_get_folio(); let's keep this fix simple and simply let the page
> fault path deal with that.
>
> Fixes: 34488399fa08 ("mm/madvise: add file and shmem support to MADV_COLLAPSE")
> Reported-by: Chris Mason <mason@kernel.org>
> Cc: stable@vger.kernel.org
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
> ---
> Once reviewed, I will pick this up in a timely manner.
> ---
>  mm/khugepaged.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
Makes sense.

Acked-by: Zi Yan <ziy@nvidia.com>

-- 
Best Regards,
Yan, Zi

Re: [PATCH] mm/khugepaged: don't map folios that are not uptodate in MADV_COLLAPSE

[Zach O'Keefe]

On Thu, Nov 5, 2026 at 12:09 PM Zi Yan <ziy@nvidia.com> wrote:
>
> On Thu Nov 5, 2026 at 1:16 PM EST, David Hildenbrand (Arm) wrote:
> > madvise(MADV_COLLAPSE) can map PMD-sized pagecache folios that are not
> > uptodate. For example, shmem fallocate() can put such folios into the
> > page cache.
> >
> > collapse_file() already refuses to proceed with folios that are not
> > uptodate. Let's just do the same in try_collapse_pte_mapped_thp() and skip
> > such folios, leaving handling to the page faults.
> >
> > Note that collapse_file() effectively clears shmem folios through
> > shmem_get_folio(); let's keep this fix simple and simply let the page
> > fault path deal with that.
> >
> > Fixes: 34488399fa08 ("mm/madvise: add file and shmem support to MADV_COLLAPSE")
> > Reported-by: Chris Mason <mason@kernel.org>
> > Cc: stable@vger.kernel.org
> > Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
> > ---
> > Once reviewed, I will pick this up in a timely manner.
> > ---
> >  mm/khugepaged.c | 6 ++++++
> >  1 file changed, 6 insertions(+)
> >
> Makes sense.
>
> Acked-by: Zi Yan <ziy@nvidia.com>

Ah, good catch..

Agree with Hugh that the "pte_mapped" naming is a bit of a misnomer,
though it was how I was thinking of things at the time.

Thanks David / Chris.

Reviewed-by: Zach O'Keefe <zokeefe@google.com>


> --
> Best Regards,
> Yan, Zi
>

Re: [PATCH] mm/khugepaged: don't map folios that are not uptodate in MADV_COLLAPSE

[SJ Park]

On Thu, 05 Nov 2026 19:16:44 +0100 "David Hildenbrand (Arm)" <david@kernel.org> wrote:

> madvise(MADV_COLLAPSE) can map PMD-sized pagecache folios that are not
> uptodate. For example, shmem fallocate() can put such folios into the
> page cache.
> 
> collapse_file() already refuses to proceed with folios that are not
> uptodate. Let's just do the same in try_collapse_pte_mapped_thp() and skip
> such folios, leaving handling to the page faults.
> 
> Note that collapse_file() effectively clears shmem folios through
> shmem_get_folio(); let's keep this fix simple and simply let the page
> fault path deal with that.

Makes sense to me.

> 
> Fixes: 34488399fa08 ("mm/madvise: add file and shmem support to MADV_COLLAPSE")
> Reported-by: Chris Mason <mason@kernel.org>
> Cc: stable@vger.kernel.org
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>

Reviewed-by: SJ Park <sj@kernel.org>


Thanks,
SJ

[...]

Re: [PATCH] mm/khugepaged: don't map folios that are not uptodate in MADV_COLLAPSE

[Baolin Wang]

On 11/6/26 2:16 AM, David Hildenbrand (Arm) wrote:
> madvise(MADV_COLLAPSE) can map PMD-sized pagecache folios that are not
> uptodate. For example, shmem fallocate() can put such folios into the
> page cache.
> 
> collapse_file() already refuses to proceed with folios that are not
> uptodate. Let's just do the same in try_collapse_pte_mapped_thp() and skip
> such folios, leaving handling to the page faults.
> 
> Note that collapse_file() effectively clears shmem folios through
> shmem_get_folio(); let's keep this fix simple and simply let the page
> fault path deal with that.
> 
> Fixes: 34488399fa08 ("mm/madvise: add file and shmem support to MADV_COLLAPSE")
> Reported-by: Chris Mason <mason@kernel.org>
> Cc: stable@vger.kernel.org
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
> ---

Make sense to me.
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>

Re: [PATCH] mm/khugepaged: don't map folios that are not uptodate in MADV_COLLAPSE

[Lance Yang]

On Thu, Nov 05, 2026 at 07:16:44PM +0100, David Hildenbrand (Arm) wrote:
>madvise(MADV_COLLAPSE) can map PMD-sized pagecache folios that are not
>uptodate. For example, shmem fallocate() can put such folios into the
>page cache.
>
>collapse_file() already refuses to proceed with folios that are not
>uptodate. Let's just do the same in try_collapse_pte_mapped_thp() and skip
>such folios, leaving handling to the page faults.
>
>Note that collapse_file() effectively clears shmem folios through
>shmem_get_folio(); let's keep this fix simple and simply let the page
>fault path deal with that.
>
>Fixes: 34488399fa08 ("mm/madvise: add file and shmem support to MADV_COLLAPSE")
>Reported-by: Chris Mason <mason@kernel.org>
>Cc: stable@vger.kernel.org
>Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
>---

Nice work1

Reviewed-by: Lance Yang <lance.yang@linux.dev>

Re: [PATCH] mm/khugepaged: don't map folios that are not uptodate in MADV_COLLAPSE

[Kiryl Shutsemau]

On Thu, Nov 05, 2026 at 07:16:44PM +0100, David Hildenbrand (Arm) wrote:
> madvise(MADV_COLLAPSE) can map PMD-sized pagecache folios that are not
> uptodate. For example, shmem fallocate() can put such folios into the
> page cache.
> 
> collapse_file() already refuses to proceed with folios that are not
> uptodate. Let's just do the same in try_collapse_pte_mapped_thp() and skip
> such folios, leaving handling to the page faults.
> 
> Note that collapse_file() effectively clears shmem folios through
> shmem_get_folio(); let's keep this fix simple and simply let the page
> fault path deal with that.
> 
> Fixes: 34488399fa08 ("mm/madvise: add file and shmem support to MADV_COLLAPSE")
> Reported-by: Chris Mason <mason@kernel.org>
> Cc: stable@vger.kernel.org
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>

Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>

Separately from this fix: nothing on the mapping side catches this.
Every caller checks uptodate on its own (next_uptodate_folio(),
filemap_fault(), shmem_get_folio()), and khugepaged was the one that
went straight from filemap_lock_folio() to do_set_pmd().

Should do_set_pmd() and set_pte_range() assert it? Something like

        VM_WARN_ON_ONCE_FOLIO(folio->mapping && !folio_test_anon(folio) &&
                              !folio_test_uptodate(folio), folio);

The ->mapping test is for set_pte_range(): finish_fault() also maps
driver pages that never get PG_uptodate.

-- 
  Kiryl Shutsemau / Kirill A. Shutemov

Re: [PATCH] mm/khugepaged: don't map folios that are not uptodate in MADV_COLLAPSE

[David Hildenbrand (Arm)]

On 11/6/26 13:09, Kiryl Shutsemau wrote:
> On Thu, Nov 05, 2026 at 07:16:44PM +0100, David Hildenbrand (Arm) wrote:
>> madvise(MADV_COLLAPSE) can map PMD-sized pagecache folios that are not
>> uptodate. For example, shmem fallocate() can put such folios into the
>> page cache.
>>
>> collapse_file() already refuses to proceed with folios that are not
>> uptodate. Let's just do the same in try_collapse_pte_mapped_thp() and skip
>> such folios, leaving handling to the page faults.
>>
>> Note that collapse_file() effectively clears shmem folios through
>> shmem_get_folio(); let's keep this fix simple and simply let the page
>> fault path deal with that.
>>
>> Fixes: 34488399fa08 ("mm/madvise: add file and shmem support to MADV_COLLAPSE")
>> Reported-by: Chris Mason <mason@kernel.org>
>> Cc: stable@vger.kernel.org
>> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
> 
> Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
> 
> Separately from this fix: nothing on the mapping side catches this.
> Every caller checks uptodate on its own (next_uptodate_folio(),
> filemap_fault(), shmem_get_folio()), and khugepaged was the one that
> went straight from filemap_lock_folio() to do_set_pmd().
> 
> Should do_set_pmd() and set_pte_range() assert it? Something like
> 
>         VM_WARN_ON_ONCE_FOLIO(folio->mapping && !folio_test_anon(folio) &&
>                               !folio_test_uptodate(folio), folio);

I think so. But looking at these hard-to-trigger but in the end very nasty
problems, should we actually reject the operation and do a pr_warn_once() or
something?

-- 
Cheers,

David

Re: [PATCH] mm/khugepaged: don't map folios that are not uptodate in MADV_COLLAPSE

[Kiryl Shutsemau]

On Fri, Nov 06, 2026 at 01:29:31PM +0100, David Hildenbrand (Arm) wrote:
> > Separately from this fix: nothing on the mapping side catches this.
> > Every caller checks uptodate on its own (next_uptodate_folio(),
> > filemap_fault(), shmem_get_folio()), and khugepaged was the one that
> > went straight from filemap_lock_folio() to do_set_pmd().
> > 
> > Should do_set_pmd() and set_pte_range() assert it? Something like
> > 
> >         VM_WARN_ON_ONCE_FOLIO(folio->mapping && !folio_test_anon(folio) &&
> >                               !folio_test_uptodate(folio), folio);
> 
> I think so. But looking at these hard-to-trigger but in the end very nasty
> problems, should we actually reject the operation and do a pr_warn_once() or
> something?

Yes, rejecting sounds better.

Not in set_pte_range() as I suggested, though. Fault-around only gets
there with folios that next_uptodate_folio() checked under the folio
lock, and for CoW it maps the new anon folio after do_cow_fault() has
already copied from the page cache one.

Checking the folio ->fault() returned in finish_fault() covers PTE, PMD
and CoW; do_set_pmd() covers khugepaged. Both return VM_FAULT_SIGBUS.

Something like this, only compile-tested:

diff --git a/mm/memory.c b/mm/memory.c
index 6fe0b7dab927..ff2f2deff761 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -5674,6 +5674,22 @@ static vm_fault_t __do_fault(struct vm_fault *vmf)
        return ret;
 }

+/*
+ * A page cache folio that is not uptodate holds data that was never read in
+ * or cleared, and mapping it leaks stale memory to userspace. The callers are
+ * expected to check, so treat a hit as a kernel bug and refuse the mapping.
+ */
+static bool file_folio_not_uptodate(struct folio *folio)
+{
+       if (likely(folio_test_uptodate(folio)))
+               return false;
+       /* Driver pages from ->fault() never get PG_uptodate */
+       if (folio_test_anon(folio) || !folio->mapping)
+               return false;
+       WARN_ONCE(1, "refusing to map a page cache folio that is not uptodate\n");
+       return true;
+}
+
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
 static void deposit_prealloc_pte(struct vm_fault *vmf)
 {
@@ -5714,6 +5730,9 @@ vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *pa
                return ret;
        page = &folio->page;

+       if (file_folio_not_uptodate(folio))
+               return VM_FAULT_SIGBUS;
+
        /*
         * Just backoff if any subpage of a THP is corrupted otherwise
         * the corrupted page may mapped by PMD silently to escape the
@@ -5849,6 +5868,16 @@ vm_fault_t finish_fault(struct vm_fault *vmf)
        unsigned long addr;
        bool needs_fallback = false;

+       /*
+        * Check the folio ->fault() returned. For CoW that is the source of the
+        * copy; DAX CoW has none.
+        */
+       if (vmf->page) {
+               folio = page_folio(vmf->page);
+               if (file_folio_not_uptodate(folio))
+                       return VM_FAULT_SIGBUS;
+       }
+
 fallback:
        addr = vmf->address;
-- 
  Kiryl Shutsemau / Kirill A. Shutemov

Re: [PATCH] mm/khugepaged: don't map folios that are not uptodate in MADV_COLLAPSE

[David Hildenbrand (Arm)]

On 11/6/26 14:41, Kiryl Shutsemau wrote:
> On Fri, Nov 06, 2026 at 01:29:31PM +0100, David Hildenbrand (Arm) wrote:
>>> Separately from this fix: nothing on the mapping side catches this.
>>> Every caller checks uptodate on its own (next_uptodate_folio(),
>>> filemap_fault(), shmem_get_folio()), and khugepaged was the one that
>>> went straight from filemap_lock_folio() to do_set_pmd().
>>>
>>> Should do_set_pmd() and set_pte_range() assert it? Something like
>>>
>>>         VM_WARN_ON_ONCE_FOLIO(folio->mapping && !folio_test_anon(folio) &&
>>>                               !folio_test_uptodate(folio), folio);
>>
>> I think so. But looking at these hard-to-trigger but in the end very nasty
>> problems, should we actually reject the operation and do a pr_warn_once() or
>> something?
> 
> Yes, rejecting sounds better.
> 
> Not in set_pte_range() as I suggested, though. Fault-around only gets
> there with folios that next_uptodate_folio() checked under the folio
> lock, and for CoW it maps the new anon folio after do_cow_fault() has
> already copied from the page cache one.
> 
> Checking the folio ->fault() returned in finish_fault() covers PTE, PMD
> and CoW; do_set_pmd() covers khugepaged. Both return VM_FAULT_SIGBUS.
> 
> Something like this, only compile-tested:
> 
> diff --git a/mm/memory.c b/mm/memory.c
> index 6fe0b7dab927..ff2f2deff761 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -5674,6 +5674,22 @@ static vm_fault_t __do_fault(struct vm_fault *vmf)
>         return ret;
>  }
> 
> +/*
> + * A page cache folio that is not uptodate holds data that was never read in
> + * or cleared, and mapping it leaks stale memory to userspace. The callers are
> + * expected to check, so treat a hit as a kernel bug and refuse the mapping.
> + */
> +static bool file_folio_not_uptodate(struct folio *folio)
> +{
> +       if (likely(folio_test_uptodate(folio)))
> +               return false;
> +       /* Driver pages from ->fault() never get PG_uptodate */
> +       if (folio_test_anon(folio) || !folio->mapping)
> +               return false;
> +       WARN_ONCE(1, "refusing to map a page cache folio that is not uptodate\n");
> +       return true;
> +}
> +
>  #ifdef CONFIG_TRANSPARENT_HUGEPAGE
>  static void deposit_prealloc_pte(struct vm_fault *vmf)
>  {
> @@ -5714,6 +5730,9 @@ vm_fault_t do_set_pmd(struct vm_fault *vmf, struct folio *folio, struct page *pa
>                 return ret;
>         page = &folio->page;
> 
> +       if (file_folio_not_uptodate(folio))
> +               return VM_FAULT_SIGBUS;
> +
>         /*
>          * Just backoff if any subpage of a THP is corrupted otherwise
>          * the corrupted page may mapped by PMD silently to escape the
> @@ -5849,6 +5868,16 @@ vm_fault_t finish_fault(struct vm_fault *vmf)
>         unsigned long addr;
>         bool needs_fallback = false;
> 
> +       /*
> +        * Check the folio ->fault() returned. For CoW that is the source of the
> +        * copy; DAX CoW has none.
> +        */
> +       if (vmf->page) {
> +               folio = page_folio(vmf->page);
> +               if (file_folio_not_uptodate(folio))
> +                       return VM_FAULT_SIGBUS;
> +       }
> +
>  fallback:
>         addr = vmf->address;

Can you send that as a proper patch? I think this is the right thing to do to
catch more of these things if they ever pop up in a better way.

-- 
Cheers,

David

Re: [PATCH] mm/khugepaged: don't map folios that are not uptodate in MADV_COLLAPSE

[Pedro Falcato]

On Fri, Nov 06, 2026 at 01:29:31PM +0100, David Hildenbrand (Arm) wrote:
> On 11/6/26 13:09, Kiryl Shutsemau wrote:
> > On Thu, Nov 05, 2026 at 07:16:44PM +0100, David Hildenbrand (Arm) wrote:
> >> madvise(MADV_COLLAPSE) can map PMD-sized pagecache folios that are not
> >> uptodate. For example, shmem fallocate() can put such folios into the
> >> page cache.
> >>
> >> collapse_file() already refuses to proceed with folios that are not
> >> uptodate. Let's just do the same in try_collapse_pte_mapped_thp() and skip
> >> such folios, leaving handling to the page faults.
> >>
> >> Note that collapse_file() effectively clears shmem folios through
> >> shmem_get_folio(); let's keep this fix simple and simply let the page
> >> fault path deal with that.
> >>
> >> Fixes: 34488399fa08 ("mm/madvise: add file and shmem support to MADV_COLLAPSE")
> >> Reported-by: Chris Mason <mason@kernel.org>
> >> Cc: stable@vger.kernel.org
> >> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
> > 
> > Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
> > 
> > Separately from this fix: nothing on the mapping side catches this.
> > Every caller checks uptodate on its own (next_uptodate_folio(),
> > filemap_fault(), shmem_get_folio()), and khugepaged was the one that
> > went straight from filemap_lock_folio() to do_set_pmd().
> > 
> > Should do_set_pmd() and set_pte_range() assert it? Something like
> > 
> >         VM_WARN_ON_ONCE_FOLIO(folio->mapping && !folio_test_anon(folio) &&
> >                               !folio_test_uptodate(folio), folio);
> 
> I think so. But looking at these hard-to-trigger but in the end very nasty
> problems, should we actually reject the operation and do a pr_warn_once() or
> something?
> 

Yes. FWIW, this is something that's been going through my mind. Our page table
manipulation APIs (and usage) are way too fragile and allow you to do the
most insane things without ever realizing it (e.g you can clear a pte, set
over a PTE, get-and-clear and discard the result, and do all of the above with
no locks held, set a pte for a folio that's not uptodate, set a pte for a folio
for which you don't have the lock, etc).

Some basic assertions (even if there's no easy way to back down from those)
would be nice, or ideally yes a rejection.

I would just add that these very much should be VM_WARN_ON_ONCE instead of
pr_warn_once(). pr_warn_once() will (AIUI) not be caught by fuzzers, at least
not as easily.

Also, if they're inexpensive enough, we might want to upgrade them to full
WARN_ON_ONCE().

-- 
Pedro

Re: [PATCH] mm/khugepaged: don't map folios that are not uptodate in MADV_COLLAPSE

[David Hildenbrand (Arm)]

On 11/6/26 15:06, Pedro Falcato wrote:
> On Fri, Nov 06, 2026 at 01:29:31PM +0100, David Hildenbrand (Arm) wrote:
>> On 11/6/26 13:09, Kiryl Shutsemau wrote:
>>>
>>> Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
>>>
>>> Separately from this fix: nothing on the mapping side catches this.
>>> Every caller checks uptodate on its own (next_uptodate_folio(),
>>> filemap_fault(), shmem_get_folio()), and khugepaged was the one that
>>> went straight from filemap_lock_folio() to do_set_pmd().
>>>
>>> Should do_set_pmd() and set_pte_range() assert it? Something like
>>>
>>>         VM_WARN_ON_ONCE_FOLIO(folio->mapping && !folio_test_anon(folio) &&
>>>                               !folio_test_uptodate(folio), folio);
>>
>> I think so. But looking at these hard-to-trigger but in the end very nasty
>> problems, should we actually reject the operation and do a pr_warn_once() or
>> something?
>>
> 
> Yes. FWIW, this is something that's been going through my mind. Our page table
> manipulation APIs (and usage) are way too fragile and allow you to do the
> most insane things without ever realizing it (e.g you can clear a pte, set
> over a PTE, get-and-clear and discard the result, and do all of the above with
> no locks held, set a pte for a folio that's not uptodate, set a pte for a folio
> for which you don't have the lock, etc).
> 
> Some basic assertions (even if there's no easy way to back down from those)
> would be nice, or ideally yes a rejection.
> 
> I would just add that these very much should be VM_WARN_ON_ONCE instead of
> pr_warn_once(). pr_warn_once() will (AIUI) not be caught by fuzzers, at least
> not as easily.

Good point on the fuzzers.

-- 
Cheers,

David

Re: [PATCH] mm/khugepaged: don't map folios that are not uptodate in MADV_COLLAPSE

[David Hildenbrand]

On Thu, 05 Nov 2026 19:16:44 +0100, David Hildenbrand (Arm) wrote:
> madvise(MADV_COLLAPSE) can map PMD-sized pagecache folios that are not
> uptodate. For example, shmem fallocate() can put such folios into the
> page cache.
> 
> collapse_file() already refuses to proceed with folios that are not
> uptodate. Let's just do the same in try_collapse_pte_mapped_thp() and skip
> such folios, leaving handling to the page faults.
> 
> [...]

Applied, thanks!

tree: mm/core.git
branch: for-next-fixes

Applied patches will appear soon in mm-next, followed by linux-next.

Please report any outstanding bugs that were missed during review, so we
can either drop the patch series or decide how to fix it up.

It is encouraged to provide Acked-bys, Reviewed-bys, and Tested-bys even
though the patches have already been applied. If possible, patch trailers
will be updated.

Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. Further, this is not a guarantee that the
patches will go upstream. If in doubt, please check the listed branch.

[1/1] mm/khugepaged: don't map folios that are not uptodate in MADV_COLLAPSE
      https://git.kernel.org/mm/core/c/d6d183ac

-- 
Cheers,

David

Re: [PATCH] mm/khugepaged: don't map folios that are not uptodate in MADV_COLLAPSE

[Pedro Falcato]

On Thu, Nov 05, 2026 at 07:16:44PM +0100, David Hildenbrand (Arm) wrote:
> madvise(MADV_COLLAPSE) can map PMD-sized pagecache folios that are not
> uptodate. For example, shmem fallocate() can put such folios into the
> page cache.
> 
> collapse_file() already refuses to proceed with folios that are not
> uptodate. Let's just do the same in try_collapse_pte_mapped_thp() and skip
> such folios, leaving handling to the page faults.
> 
> Note that collapse_file() effectively clears shmem folios through
> shmem_get_folio(); let's keep this fix simple and simply let the page
> fault path deal with that.
> 
> Fixes: 34488399fa08 ("mm/madvise: add file and shmem support to MADV_COLLAPSE")
> Reported-by: Chris Mason <mason@kernel.org>
> Cc: stable@vger.kernel.org
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>

Reviewed-by: Pedro Falcato <pfalcato@suse.de>

-- 
Pedro