Re: [PATCH v3 1/2] mm/khugepaged: Never install PMDs in uffd-minor-registered VMAs

[Andrew Morton]

On Thu, 10 Sep 2026 02:34:10 +0000 James Houghton <jthoughton@xxxxxxxxxx> wrote:

> Userfaultfd minor faults provides userspace with the ability to manually
> install PTEs with UFFDIO_CONTINUE. Right now, MADV_COLLAPSE can map
> holes in the VMA when a naturally-aligned THP is present. This is not
> true for khugepaged collapse: the PTEs will be retracted, but a PMD will
> not be installed.
> 
> When MADV_COLLAPSE installs a PMD that mapped holes in the VMA,
> userspace is likely to expect UFFDIO_CONTINUE to succeed on the
> should-be holes. UFFDIO_CONTINUE will fail and return EEXIST.
> 
> This is not inherently a problem, as MADV_COLLAPSE is an explicit
> userspace action. But, especially because MADV_COLLAPSE can be invoked
> by an external process via process_madvise(), a rogue caller could break
> a userfaultfd-minor resolver thread. If khugepaged is later updated to
> install PMDs for khugepaged collapsing, that would be a genuine problem.
> 
> Userspace cannot generally use MADV_COLLAPSE to resolve userfault minor
> faults, as MADV_COLLAPSE will only resolve such faults if a
> naturally-aligned THP is present.
> 
> The naturally-aligned THP case is the only case where this quirk exists.
> Collapsing otherwise requires all PTEs to be present for
> userfaultfd-registered VMAs (i.e., max none PTEs is 0), which is
> correct. This check is essentially bypassed for naturally-aligned THPs.
> 
> ...
>
>  - Drop cc:stable and update the changelog for the main patch.
>    khugepaged doesn't actually install PMDs, so it is impossible for the
>    kernel to silently install mappings that userspace didn't ask for.
>    Therefore this patch does not need to be backported.

Thanks for explaining that.  It helps.  My life :(

Sashiko had a stupid niggle about the selftest change and made quite
disturbing claims about the existing try_collapse_pte_mapped_thp() code:

	https://sashiko.dev/#/patchset/20260910023411.514987-1-jthoughton@xxxxxxxxxx

I'll queue the series for test-n-review.