Re: [PATCH v2] mm/ksm: keep soft-dirty and uffd-wp when merging a page
From: Mohammed EL Kadiri
Date: Tue Oct 20 2026 - 17:59:21 EST
This works for me, on b306deee4cba (mm-testing), x86_64,
CONFIG_KSM=y, CONFIG_USERFAULTFD=y, CONFIG_DEBUG_VM=y, KASAN enabled,
THP disabled.
Reproducer: merge 64 identical anon pages via KSM, arm synchronous
userfaultfd-wp on one page, then MADV_UNMERGEABLE it without touching
it. The page should come out private with WP semantics intact.
On the same commit, before applying your wp_page_copy()/handle_pte_fault()
fix:
UNMERGE ret=0 errno=0
AFTER_UNMERGE target_pfn=1153393 peer_pfn=1153393 target_KPF_KSM=1
FAIL: MADV_UNMERGEABLE returned success but target remains shared/KSM
and every run also hits this in dmesg:
FAULT_FLAG_ALLOW_RETRY missing c80
Call Trace:
handle_userfault.cold+0x30/0x3f
__handle_mm_fault+0xde9/0x1c30
handle_mm_fault+0x13b/0x440
break_ksm+0x8a/0x100
ksm_madvise+0x467/0x780
madvise_vma_behavior+0x1d1/0x1e40
madvise_do_behavior+0x431/0x14b0
do_madvise+0x162/0x210
break_ksm()'s internal fault-in to unshare the page is landing in the
uffd-wp fault handler, which isn't expecting it. 8/8 runs across two
boots, same trace every time.
After applying the fix:
AFTER_UNMERGE target_pfn=1063999 peer_pfn=1064929 target_KPF_KSM=0
PASS: target is private and no longer KSM-backed
FAULT event=18 flags=0x8 address=0x7f3dcb727000
PASS: read generated RWP fault and remained blocked
No warnings or call traces in dmesg. 8/8 runs across two boots.
Tested-by: Mohammed EL Kadiri <med08elkadiri@xxxxxxxxx>