+ mm-khugepaged-never-install-pmds-in-uffd-minor-registered-vmas.patch added to mm-new branch

+ mm-khugepaged-never-install-pmds-in-uffd-minor-registered-vmas.patch added to mm-new branch

[Andrew Morton]

The patch titled
     Subject: mm/khugepaged: never install PMDs in uffd-minor-registered VMAs
has been added to the -mm mm-new branch.  Its filename is
     mm-khugepaged-never-install-pmds-in-uffd-minor-registered-vmas.patch

This patch will shortly appear at
     https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/mm-khugepaged-never-install-pmds-in-uffd-minor-registered-vmas.patch

This patch will later appear in the mm-new branch at
    git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Note, mm-new is a provisional staging ground for work-in-progress
patches, and acceptance into mm-new is a notification for others take
notice and to finish up reviews.  Please do not hesitate to respond to
review feedback and post updated versions to replace or incrementally
fixup patches in mm-new.

The mm-new branch of mm.git is not included in linux-next

If a few days of testing in mm-new is successful, the patch will me moved
into mm.git's mm-unstable branch, which is included in linux-next

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days

------------------------------------------------------
From: James Houghton <jthoughton@google.com>
Subject: mm/khugepaged: never install PMDs in uffd-minor-registered VMAs
Date: Thu, 10 Sep 2026 02:34:10 +0000

Userfaultfd minor faults provides userspace with the ability to manually
install PTEs with UFFDIO_CONTINUE.  Right now, MADV_COLLAPSE can map holes
in the VMA when a naturally-aligned THP is present.  This is not true for
khugepaged collapse: the PTEs will be retracted, but a PMD will not be
installed.

When MADV_COLLAPSE installs a PMD that mapped holes in the VMA, userspace
is likely to expect UFFDIO_CONTINUE to succeed on the should-be holes. 
UFFDIO_CONTINUE will fail and return EEXIST.

This is not inherently a problem, as MADV_COLLAPSE is an explicit
userspace action.  But, especially because MADV_COLLAPSE can be invoked by
an external process via process_madvise(), a rogue caller could break a
userfaultfd-minor resolver thread.  If khugepaged is later updated to
install PMDs for khugepaged collapsing, that would be a genuine problem.

Userspace cannot generally use MADV_COLLAPSE to resolve userfault minor
faults, as MADV_COLLAPSE will only resolve such faults if a
naturally-aligned THP is present.

The naturally-aligned THP case is the only case where this quirk exists. 
Collapsing otherwise requires all PTEs to be present for
userfaultfd-registered VMAs (i.e., max none PTEs is 0), which is correct. 
This check is essentially bypassed for naturally-aligned THPs.

khugepaged doesn't actually install PMDs, so it is impossible for the
kernel to silently install mappings that userspace didn't ask for. 
Therefore this patch does not need to be backported.

Link: https://lore.kernel.org/20260910023411.514987-1-jthoughton@google.com
Suggested-by: Lance Yang <lance.yang@linux.dev>
Tested-by: Lance Yang <lance.yang@linux.dev>
Signed-off-by: James Houghton <jthoughton@google.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Yang Shi <shy828301@gmail.com>
Cc: Zach O'Keefe <zokeefe@google.com>
Cc: Zi Yan <ziy@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/khugepaged.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/mm/khugepaged.c~mm-khugepaged-never-install-pmds-in-uffd-minor-registered-vmas
+++ a/mm/khugepaged.c
@@ -1834,6 +1834,13 @@ static enum scan_result try_collapse_pte
 	if (userfaultfd_protected(vma))
 		return SCAN_PTE_UFFD;
 
+	/*
+	 * Userfaultfd-minor-registered VMAs should not be collapsed, as
+	 * userspace is expecting to explicitly install PTEs.
+	 */
+	if (userfaultfd_minor(vma))
+		return SCAN_PTE_UFFD;
+
 	folio = filemap_lock_folio(vma->vm_file->f_mapping,
 			       linear_page_index(vma, haddr));
 	if (IS_ERR(folio))
_

Patches currently in -mm which might be from jthoughton@google.com are

mm-khugepaged-never-install-pmds-in-uffd-minor-registered-vmas.patch
mm-selftests-adjust-the-madv_collapse-uffd-minor-selftests.patch