Re: [PATCH v2] mm/khugepaged: Don't install PMDs in uffd-minor-registered VMAs

[Andrew Morton]

On Fri, 28 Aug 2026 22:26:40 +0000 James Houghton <jthoughton@xxxxxxxxxx> wrote:

> Userfaultfd minor faults provides userspace with the ability to manually
> install PTEs with UFFDIO_CONTINUE. Right now, khugepaged collapse can
> map holes in the VMA when a naturally-aligned THP is present without
> explicit action from userspace.
> 
> This is a problem, as it bypasses userfaultfd minor faults that
> userspace is expecting to handle.
> 
> If userspace implements post-copy live migration using userfaultfd minor
> faults, this situation is currently possible:
> 1. The VMA for guest memory is userfaultfd-minor-registered and nothing
>    is mapped in the page tables.
> 2. A stale copy of a page is present in a naturally-aligned THP (from
>    pre-copy live migration).
> 3. khugepaged collapses the mapping of the THP, installs a PMD.
> 4. The VM now has access to the stale contents => VM is broken.
> 5. After installing the correct contents, userspace attempts to map the
>    page with UFFDIO_CONTINUE; it gets EEXIST, indicating that something
>    unexpectedly mapped the page.

Did I read somewhere that this it biting you in a real-life scenario? 
That would use useful info to spell out.

Or is this a theoretical thing?

> The naturally-aligned THP case is the only case where this is a problem.
> khugepaged otherwise requires all PTEs to be present for
> userfaultfd-registered VMAs (i.e., max none PTEs is 0), which is
> correct. This check is essentially bypassed for naturally-aligned THPs.
> 
> No changes are needed for file_backed_vma_is_retractable(), as zapping
> PTEs is safe. Userspace must already handle cases where PTEs are zapped
> without explicit action (e.g. due to reclaim).
> 
> Fixes: 58ac9a8993a1 ("mm/khugepaged: attempt to map file/shmem-backed pte-mapped THPs by pmds")
> Cc: <stable@xxxxxxxxxxxxxxx> # 6.1

>From the changelog it isn't clear why a -stable backport is proposed? 
I assume the userspace-visible runtime effect is a rare and bogus
-EEXIST from UFFDIO_CONTINUE?

> Suggested-by: Lance Yang <lance.yang@xxxxxxxxx>
> Tested-by: Lance Yang <lance.yang@xxxxxxxxx>

Wondering what Lance tested.  Was he able to reproduce the bug?

Sashiko might have found another race in there:

	https://sashiko.dev/#/patchset/20260828222640.1638457-1-jthoughton@xxxxxxxxxx