Re: [PATCH v3 1/2] mm/khugepaged: Never install PMDs in uffd-minor-registered VMAs

["David Hildenbrand (Arm)" <david@kernel.org>]

On 9/10/26 04:34, James Houghton wrote:
> Userfaultfd minor faults provides userspace with the ability to manually
> install PTEs with UFFDIO_CONTINUE. Right now, MADV_COLLAPSE can map
> holes in the VMA when a naturally-aligned THP is present. This is not
> true for khugepaged collapse: the PTEs will be retracted, but a PMD will
> not be installed.

You might want to add a breadcrumb here that collapse_file() never returns
SCAN_PTE_MAPPED_HUGEPAGE for khugepaged.

The whole thing makes me wonder why that khugepaged check is buried so deep down
in that function. Makes me wonder whether that check can actually get pulled
further out (maybe Kiryl's patches do that).

try_collapse_pte_mapped_thp(mm, addr, !cc->is_khugepaged);

is rather confusing when we never end up there with khugepaged ...

> 
> When MADV_COLLAPSE installs a PMD that mapped holes in the VMA,
> userspace is likely to expect UFFDIO_CONTINUE to succeed on the
> should-be holes. UFFDIO_CONTINUE will fail and return EEXIST.
> 
> This is not inherently a problem, as MADV_COLLAPSE is an explicit
> userspace action. But, especially because MADV_COLLAPSE can be invoked
> by an external process via process_madvise(), a rogue caller could break
> a userfaultfd-minor resolver thread. If khugepaged is later updated to
> install PMDs for khugepaged collapsing, that would be a genuine problem.
> 
> Userspace cannot generally use MADV_COLLAPSE to resolve userfault minor
> faults, as MADV_COLLAPSE will only resolve such faults if a
> naturally-aligned THP is present.
> 
> The naturally-aligned THP case is the only case where this quirk exists.
> Collapsing otherwise requires all PTEs to be present for
> userfaultfd-registered VMAs (i.e., max none PTEs is 0), which is
> correct. This check is essentially bypassed for naturally-aligned THPs.
> 
> Suggested-by: Lance Yang <lance.yang@linux.dev>
> Tested-by: Lance Yang <lance.yang@linux.dev>
> Signed-off-by: James Houghton <jthoughton@google.com>
> ---
> v2: https://lore.kernel.org/linux-mm/20260828222640.1638457-1-jthoughton@google.com/
> Changes since v2:
>  - Drop cc:stable and update the changelog for the main patch.
>    khugepaged doesn't actually install PMDs, so it is impossible for the
>    kernel to silently install mappings that userspace didn't ask for.
>    Therefore this patch does not need to be backported.
>  - Update the uffd-unit-tests selftest to account for the new behavior
>    (new patch). This patched selftest is equivalent to the reproducer I
>    provided in v1.
> 
> v1: https://lore.kernel.org/linux-mm/20260828005004.2870750-1-jthoughton@google.com/
> ---
>  mm/khugepaged.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/mm/khugepaged.c b/mm/khugepaged.c
> index 75639298efc2..e6947fe142ee 100644
> --- a/mm/khugepaged.c
> +++ b/mm/khugepaged.c
> @@ -1894,6 +1894,13 @@ static enum scan_result try_collapse_pte_mapped_thp(struct mm_struct *mm, unsign
>  	if (userfaultfd_protected(vma))
>  		return SCAN_PTE_UFFD;
>  
> +	/*
> +	 * Userfaultfd-minor-registered VMAs should not be collapsed, as
> +	 * userspace is expecting to explicitly install PTEs.
> +	 */
> +	if (userfaultfd_minor(vma))
> +		return SCAN_PTE_UFFD;

Can we just combine the two uffd checks to have less uffd noise? :)

"Don't collapse if we might have UFFD markers or if userspace fills the page
tables through uffd minor faults".

Overall LGTM

-- 
Cheers,

David