Re: [PATCH v3] fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes

[Kiryl Shutsemau <kirill@shutemov.name>]

On Sun, Jul 12, 2026 at 09:14:12AM +0800, Zenghui Yu wrote:
> Hi Kiryl,
> 
> On 7/9/26 8:16 PM, Kiryl Shutsemau wrote:
> > From: "Kiryl Shutsemau (Meta)" <kas@kernel.org>
> > 
> > PAGEMAP_SCAN reports an unpopulated PTE in a uffd-wp VMA as written, but
> > a range with no page table at all -- a PMD hole -- is skipped:
> > pagemap_scan_pte_hole() tests p->cur_vma_category, which never carries
> > PAGE_IS_WRITTEN, so the hole is neither reported nor (under
> > PM_SCAN_WP_MATCHING) armed.
> > 
> > MADV_DONTNEED has fill-with-zeros semantics: it changes the contents of
> > the range to zeroes (a subsequent read maps the zero page), which write
> > tracking must report as written. An anonymous THP is write-protected in
> > place as a huge PMD, so a full-PMD MADV_DONTNEED clears it to pmd_none --
> > a hole -- and the zeroing goes unreported. A write-tracking
> > checkpoint/migration tool (e.g. CRIU) then treats the range as unchanged
> > and keeps its previous contents, so after restore or live migration the
> > process reads stale data instead of zeroes -- data corruption.
> > 
> > Report a hole in a non-hugetlb uffd-wp VMA as written, matching the
> > pte_none handling in pagemap_page_category(); the existing
> > PM_SCAN_WP_MATCHING path then arms it via uffd_wp_range().
> > 
> > hugetlb is excluded: pagemap_hugetlb_category() reports an empty hugetlb
> > entry (huge_pte_none) as not-written, unlike pagemap_page_category(),
> > which reports pte_none as written. pagemap_scan_pte_hole() fires for a
> > hugetlb slot only when it has no page table; keeping that not-written
> > matches how an allocated-but-empty hugetlb entry reads, so the hole and
> > the empty-entry cases agree within the VMA.
> > 
> > Add a pagemap_ioctl selftest covering the anon-THP PMD-hole case.
> > 
> > Reported-by: Sashiko AI review <sashiko-bot@kernel.org>
> > Closes: https://sashiko.dev/#/patchset/20260707151349.92143-1-kirill@shutemov.name
> > Fixes: 2bad466cc9d9 ("mm/uffd: UFFD_FEATURE_WP_UNPOPULATED")
> > Cc: Muhammad Usama Anjum <usama.anjum@collabora.com>
> > Cc: Peter Xu <peterx@redhat.com>
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Kiryl Shutsemau <kas@kernel.org>
> > Assisted-by: Claude:claude-fable-5
> > ---
> > 
> > Changes since v2 [1], addressing Andrew's review:
> >   - Describe the user-visible effect: MADV_DONTNEED has fill-with-zeros
> >     semantics, so the range must be reported written; otherwise a
> >     checkpoint/migration tool (CRIU) keeps stale data and the process
> >     reads corrupted contents after restore. Add Reported-by/Closes.
> >   - Reword the hugetlb carve-out to rest on the category functions:
> >     pagemap_hugetlb_category() reads an empty hugetlb entry as
> >     not-written, unlike pagemap_page_category().
> >   - Drop the redundant MADV_COLLAPSE fallback #define; it is in
> >     <asm-generic/mman-common.h> and used directly by other mm selftests.
> 
> I hit the following compilation error on mm-new:
> 
> [root@localhost mm]# make
>   CC       pagemap_ioctl
> pagemap_ioctl.c: In function 'unpopulated_thp_hole_test':
> pagemap_ioctl.c:1130:31: error: 'MADV_COLLAPSE' undeclared (first use in this function); did you mean 'MADV_COLD'?
>  1130 |  if (madvise(mem, hpage_size, MADV_COLLAPSE) ||
>       |                               ^~~~~~~~~~~~~
>       |                               MADV_COLD
> pagemap_ioctl.c:1130:31: note: each undeclared identifier is reported only once for each function it appears in
> make: *** [../lib.mk:225: /root/code/mm/tools/testing/selftests/mm/pagemap_ioctl] Error 1
> 
> Could you consider addressing it like fd5295afae91 ("selftests/mm:
> hmm-tests: include linux/mman.h to access MADV_COLLAPSE")?

Yep, will send v4.

-- 
  Kiryl Shutsemau / Kirill A. Shutemov