Re: [PATCH] mm/khugepaged: Don't collapse uffd-minor-registered VMAs

[James Houghton]

On Fri, Aug 28, 2026 at 10:26 PM Lance Yang <lance.yang@xxxxxxxxx> wrote:
> >On Fri, Aug 28, 2026 at 12:50:04AM +0000, James Houghton wrote:
> >>If userspace implements post-copy live migration using userfaultfd minor
> >>faults, this situation is currently possible:
> >>1. The VMA for guest memory is userfaultfd-minor-registered and nothing
> >>   is mapped in the page tables.
> >>2. A stale copy of a page is present in a naturally-aligned THP (from
> >>   pre-copy live migration).
> >>3. khugepaged collapses the mapping of the THP, installs a PMD.
>
> Ouch ... I missed this earlier. The problem is real, but this commit
> message describes the wrong trigger.
>
> Background khugepaged calls try_collapse_pte_mapped_thp() with
> install_pmd=false, so it cannot install the PMD or trigger this
> sequence. MADV_COLLAPSE passes install_pmd=true and installs the PMD.
>
> So the problem described here can only be triggered by MADV_COLLAPSE,
> whether it comes through madvise() or process_madvise(), no?

Oh yeah, you're right. In our downstream version, `install_pmd` is set
to true for the khugepaged collapse path; I missed that it was false
upstream. Sorry about that. :(

So we can definitely remove cc:stable, there is no bug here.

WRT the semantics of process_madvise(MADV_COLLAPSE) and normal
madvise(MADV_COLLAPSE), I think it makes sense to always disallow
collapsing of UFFD-minor VMAs, whether MADV_COLLAPSE comes from our
own process or another. UFFD-minor faults are intended to be resolved
only with UFFDIO_CONTINUE, and until someone asks for it, I don't
really see a need to make MADV_COLLAPSE actually work to resolve minor
faults. I don't think userspace can *rely* on MADV_COLLAPSE resolving
minor faults either.

Lance, Kiryl, let me know what you think.

Thanks!