From: Kiryl Shutsemau <kas@kernel.org>
To: James Houghton <jthoughton@google.com>
Cc: Lance Yang <lance.yang@linux.dev>,
Andrew Morton <akpm@linux-foundation.org>,
david@kernel.org, ljs@kernel.org, ziy@nvidia.com,
baolin.wang@linux.alibaba.com, liam@infradead.org,
nico.pache@linux.dev, ryan.roberts@arm.com, dev.jain@arm.com,
baohua@kernel.org, usama.arif@linux.dev, shy828301@gmail.com,
zokeefe@google.com, hughd@google.com, linux-mm@kvack.org,
linux-kernel@vger.kernel.org, stable@vger.kernel.org
Subject: Re: [PATCH] mm/khugepaged: Don't collapse uffd-minor-registered VMAs
Date: Wed, 2 Sep 2026 11:27:42 +0100 [thread overview]
Message-ID: <apf5xBqj5560JlMD@thinkstation> (raw)
In-Reply-To: <CADrL8HW3=n8VqW+7YSb2kyhkHidNKGy32+2s7A0OfF+oYoAifg@mail.gmail.com>
On Mon, Aug 31, 2026 at 09:51:33AM -0700, James Houghton wrote:
> On Fri, Aug 28, 2026 at 10:26 PM Lance Yang <lance.yang@linux.dev> wrote:
> > >On Fri, Aug 28, 2026 at 12:50:04AM +0000, James Houghton wrote:
> > >>If userspace implements post-copy live migration using userfaultfd minor
> > >>faults, this situation is currently possible:
> > >>1. The VMA for guest memory is userfaultfd-minor-registered and nothing
> > >> is mapped in the page tables.
> > >>2. A stale copy of a page is present in a naturally-aligned THP (from
> > >> pre-copy live migration).
> > >>3. khugepaged collapses the mapping of the THP, installs a PMD.
> >
> > Ouch ... I missed this earlier. The problem is real, but this commit
> > message describes the wrong trigger.
> >
> > Background khugepaged calls try_collapse_pte_mapped_thp() with
> > install_pmd=false, so it cannot install the PMD or trigger this
> > sequence. MADV_COLLAPSE passes install_pmd=true and installs the PMD.
> >
> > So the problem described here can only be triggered by MADV_COLLAPSE,
> > whether it comes through madvise() or process_madvise(), no?
>
> Oh yeah, you're right. In our downstream version, `install_pmd` is set
> to true for the khugepaged collapse path; I missed that it was false
> upstream. Sorry about that. :(
>
> So we can definitely remove cc:stable, there is no bug here.
>
> WRT the semantics of process_madvise(MADV_COLLAPSE) and normal
> madvise(MADV_COLLAPSE), I think it makes sense to always disallow
> collapsing of UFFD-minor VMAs, whether MADV_COLLAPSE comes from our
> own process or another. UFFD-minor faults are intended to be resolved
> only with UFFDIO_CONTINUE, and until someone asks for it, I don't
> really see a need to make MADV_COLLAPSE actually work to resolve minor
> faults. I don't think userspace can *rely* on MADV_COLLAPSE resolving
> minor faults either.
It is safer to go with stricter policy: reject always. We can always
relax it later if there is a use-case and reasoning about the interface
is solid. We don't have it yet.
--
Kiryl Shutsemau / Kirill A. Shutemov
next prev parent reply other threads:[~2026-09-02 10:27 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-28 0:50 James Houghton
2026-08-28 9:47 ` Lance Yang
2026-08-28 13:07 ` Kiryl Shutsemau
2026-08-29 4:15 ` Lance Yang
2026-08-29 6:03 ` Lance Yang
2026-08-28 19:07 ` James Houghton
2026-08-29 5:26 ` Lance Yang
2026-08-31 16:51 ` James Houghton
2026-09-02 10:27 ` Kiryl Shutsemau [this message]
2026-09-02 20:41 ` James Houghton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=apf5xBqj5560JlMD@thinkstation \
--to=kas@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=baohua@kernel.org \
--cc=baolin.wang@linux.alibaba.com \
--cc=david@kernel.org \
--cc=dev.jain@arm.com \
--cc=hughd@google.com \
--cc=jthoughton@google.com \
--cc=lance.yang@linux.dev \
--cc=liam@infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=ljs@kernel.org \
--cc=nico.pache@linux.dev \
--cc=ryan.roberts@arm.com \
--cc=shy828301@gmail.com \
--cc=stable@vger.kernel.org \
--cc=usama.arif@linux.dev \
--cc=ziy@nvidia.com \
--cc=zokeefe@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®