Re: [PATCH v2] mm/khugepaged: Don't install PMDs in uffd-minor-registered VMAs

[Lance Yang]

On Fri, Aug 28, 2026 at 06:09:39PM -0700, James Houghton wrote:
>On Fri, Aug 28, 2026 at 5:33 PM Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> wrote:
[...]
>> Wondering what Lance tested.  Was he able to reproduce the bug?

Yes!

>I assume he just re-ran my repro, but yeah I'm not sure, heh. Lance,
>what did you test?

In general, I prefer to write my own reproducer from scratch, using
whatever approach works. That's what I did here.

On the parent, MADV_COLLAPSE installed a PMD, and a later
UFFDIO_CONTINUE failed with EEXIST. With v1 applied, MADV_COLLAPSE was
rejected and UFFDIO_CONTINUE succeeded when registration completed
before collapse.

I then extended the reproducer to register the VMA during the mmap lock
drop/reacquire window in collapse. With v1, a PMD was still installed,
and the later UFFDIO_CONTINUE again failed with EEXIST. Adding a
userfaultfd_minor() recheck after reacquiring the lock closed that race.

Before reviewing v2, let's go back to v1 [1] and settle the expected
semantics there first. The check depends on which policy we choose, so
I'd hold off on reviewing v2 until that is resolved :)

[1] https://lore.kernel.org/lkml/20260829041523.43008-1-lance.yang@xxxxxxxxx/

>> Sashiko might have found another race in there:
>>
>>         https://sashiko.dev/#/patchset/20260828222640.1638457-1-jthoughton@xxxxxxxxxx
>
>Let me get back to you on this. Best case, I'll send another
>(separate) patch. :)

@James please don't send another revision or a separate patch for now.

Cheers, Lance