Re: [PATCH 2/2] mm/khugepaged: check for empty PTE tables before retracting

["Lorenzo Stoakes (ARM)" <ljs@kernel.org>]

On Mon, Nov 09, 2026 at 04:08:23PM +0100, David Hildenbrand (Arm) wrote:
> On 11/8/26 00:51, sashiko-bot@kernel.org wrote:
> > [Severity: Medium]
> > Can removing the VM_COPY_ON_FORK flag checks here cause retract_page_tables()
> > to race with copy_page_range() during fork()?
> >
> > In dup_mmap(), the child VMA is linked into mapping->i_mmap and
> > i_mmap_unlock_write(mapping) is dropped before copy_page_range() runs.
> > vma_needs_copy() copies page tables not only when vma_has_anon_rmap() is set,
> > but also when VM_COPY_ON_FORK flags (VM_MAYBE_GUARD, VM_MAYBE_UFFD_POISON,
> > VM_UFFD_WP, or VM_UFFD_RWP) are set on a file or shmem VMA whose anon_vma is
> > still NULL.
>
> Ah, try_collapse_pte_mapped_thp() runs withe the mmap lock, whereby
> retract_page_tables() only holds the rmap lock.

[ ... ]

> > Once the PMD is pmd_none, the next fault in finish_fault() installs a huge
> > PMD before checking userfaultfd_armed(vma):
> >
> > mm/memory.c:finish_fault() {
> > 	if (pmd_none(*vmf->pmd)) {
> > 		if (!needs_fallback && folio_test_pmd_mappable(folio)) {
> > 			ret = do_set_pmd(vmf, folio, page);
> > 			if (ret != VM_FAULT_FALLBACK)
> > 				return ret;
> > 		}
> >     ...
> > 	/* Using per-page fault to maintain the uffd semantics */
> > 	if (unlikely(userfaultfd_armed(vma)) || unlikely(needs_fallback)) {
> > 		nr_pages = 1;
> > }
> >
> > When userspace later issues UFFDIO_RWPROTECT on that file or shmem VMA,
> > change_pmd_range() sees pgtable_split_needed() is true and calls
> > __split_huge_pmd(), which zaps the file huge PMD back to pmd_none without
> > populating a PTE table (since pgtable_populate_needed() is false for
> > MM_CP_UFFD_RWP), so RWP protection is lost and subsequent accesses fault the
> > unprotected huge PMD back in without delivering RWP faults.  Installing a
> > huge PMD also causes PAGEMAP_SCAN to report all 512 pages as accessed or
> > written after a single 4KB page fault.
>
> "Since pgtable_populate_needed() is false for MM_CP_UFFD_RWP" I think RWP also
> needs proper uffd marker support, independent of the change here.

Hey,

Wondered if you planned to do a respin on this? Want to know whether to delay
review for that or not, thanks!

--
Cheers, Lorenzo