From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DC479175A6C for ; Thu, 17 Sep 2026 05:37:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789623479; cv=none; b=obQ9paWbNP0dMZCtRp1bZBpbNMjU5iEvNi2l/aes3YyQExk4vEyPc/LDxvqctRcycX9aOG49kGHDziFcEbaURc6xjekwTrqhgtfIMZoMsZHsiYyQzNPSKsOLlqMOFkLTBQK3fZw+w6FrlYtpAFXChDPgyZNF6i6TvCWvDy5rzqE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789623479; c=relaxed/simple; bh=GtaSBLy102tdJf6Uk+W4Neo1khM3cY5UJt4oJoL8joI=; h=Date:To:From:Subject:Message-Id; b=Gd9WKZvFvFjxYNEfb+PlYBRKAWeMfKXrsr82Y7dYGq6kRDvp84UzLk+x+OO5tofkM1PFcz8+esdgj6lp5HH7c2XZe+Ix4gVHtomNfYC8zbYjYedATWgBI8iuBeK9DizEXG0sW+hZMtsreKWn75yuU22ppFa51bzIjwGG57xv31Y= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=ldMwbzTP; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="ldMwbzTP" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4FB7C1F000FF; Thu, 17 Sep 2026 05:37:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-foundation.org; s=korg; t=1789623477; bh=0jV4JNvNPWCAjvmyqdnSABQBzMwifzHDRF1ba/fJIzA=; h=Date:To:From:Subject; b=ldMwbzTPwsbYm9KO//3PgWjJBvzg2BQEJQIIzyr17cKGwExPglkCl3qJvL0iHTHRf vYK8/6ngFuZRlP//wYO1DkBP6FJNSpu+DbKjq+dwcfqRvUg3ro5flTMuH48GIFUALU 53awIWXtY6XoY3Mse3c5pMBeuG//GsNTykvIICak= Date: Wed, 16 Sep 2026 22:37:56 -0700 To: mm-commits@vger.kernel.org,zokeefe@google.com,ziy@nvidia.com,shy828301@gmail.com,ryan.roberts@arm.com,ljs@kernel.org,liam@infradead.org,lance.yang@linux.dev,kas@kernel.org,hughd@google.com,dev.jain@arm.com,david@kernel.org,baolin.wang@linux.alibaba.com,baohua@kernel.org,jthoughton@google.com,akpm@linux-foundation.org From: Andrew Morton Subject: [to-be-updated] mm-khugepaged-never-install-pmds-in-uffd-minor-registered-vmas.patch removed from -mm tree Message-Id: <20260917053757.4FB7C1F000FF@smtp.kernel.org> Precedence: bulk X-Mailing-List: mm-commits@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: The quilt patch titled Subject: mm/khugepaged: never install PMDs in uffd-minor-registered VMAs has been removed from the -mm tree. Its filename was mm-khugepaged-never-install-pmds-in-uffd-minor-registered-vmas.patch This patch was dropped because an updated version will be issued ------------------------------------------------------ From: James Houghton Subject: mm/khugepaged: never install PMDs in uffd-minor-registered VMAs Date: Thu, 10 Sep 2026 02:34:10 +0000 Userfaultfd minor faults provides userspace with the ability to manually install PTEs with UFFDIO_CONTINUE. Right now, MADV_COLLAPSE can map holes in the VMA when a naturally-aligned THP is present. This is not true for khugepaged collapse: the PTEs will be retracted, but a PMD will not be installed. When MADV_COLLAPSE installs a PMD that mapped holes in the VMA, userspace is likely to expect UFFDIO_CONTINUE to succeed on the should-be holes. UFFDIO_CONTINUE will fail and return EEXIST. This is not inherently a problem, as MADV_COLLAPSE is an explicit userspace action. But, especially because MADV_COLLAPSE can be invoked by an external process via process_madvise(), a rogue caller could break a userfaultfd-minor resolver thread. If khugepaged is later updated to install PMDs for khugepaged collapsing, that would be a genuine problem. Userspace cannot generally use MADV_COLLAPSE to resolve userfault minor faults, as MADV_COLLAPSE will only resolve such faults if a naturally-aligned THP is present. The naturally-aligned THP case is the only case where this quirk exists. Collapsing otherwise requires all PTEs to be present for userfaultfd-registered VMAs (i.e., max none PTEs is 0), which is correct. This check is essentially bypassed for naturally-aligned THPs. khugepaged doesn't actually install PMDs, so it is impossible for the kernel to silently install mappings that userspace didn't ask for. Therefore this patch does not need to be backported. Link: https://lore.kernel.org/20260910023411.514987-1-jthoughton@google.com Suggested-by: Lance Yang Tested-by: Lance Yang Signed-off-by: James Houghton Signed-off-by: Andrew Morton Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Hugh Dickins Cc: Kiryl Shutsemau Cc: Lance Yang Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: Ryan Roberts Cc: Yang Shi Cc: Zach O'Keefe Cc: Zi Yan --- mm/khugepaged.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/mm/khugepaged.c~mm-khugepaged-never-install-pmds-in-uffd-minor-registered-vmas +++ a/mm/khugepaged.c @@ -1834,6 +1834,13 @@ static enum scan_result try_collapse_pte if (userfaultfd_protected(vma)) return SCAN_PTE_UFFD; + /* + * Userfaultfd-minor-registered VMAs should not be collapsed, as + * userspace is expecting to explicitly install PTEs. + */ + if (userfaultfd_minor(vma)) + return SCAN_PTE_UFFD; + folio = filemap_lock_folio(vma->vm_file->f_mapping, linear_page_index(vma, haddr)); if (IS_ERR(folio)) _ Patches currently in -mm which might be from jthoughton@google.com are mm-selftests-adjust-the-madv_collapse-uffd-minor-selftests.patch