Re: [PATCH v5 1/2] fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes

["David Hildenbrand (Arm)" <david@kernel.org>]

On 7/15/26 16:42, Kiryl Shutsemau wrote:
> From: "Kiryl Shutsemau (Meta)" <kas@kernel.org>
> 
> PAGEMAP_SCAN reports an unpopulated PTE in a uffd-wp VMA as written, but
> a range with no page table at all -- a PMD hole -- is skipped:
> pagemap_scan_pte_hole() tests p->cur_vma_category, which never carries
> PAGE_IS_WRITTEN, so the hole is neither reported nor (under
> PM_SCAN_WP_MATCHING) armed.
> 
> In a uffd-wp VMA, WP_UNPOPULATED installs uffd-wp markers when protecting
> a range, allocating page tables as needed, so an unpopulated slot is
> treated as written -- see the pte_none() handling in
> pagemap_page_category(). A missing marker therefore means the range was
> zapped, e.g. via MADV_DONTNEED. This applies to anon and shmem VMAs.
> 
> An anonymous THP is write-protected in place as a huge PMD, so a
> full-PMD MADV_DONTNEED clears it to pmd_none -- a hole with no page table
> -- and pagemap_scan_pte_hole() misses it. For a MAP_PRIVATE|MAP_ANON
> mapping MADV_DONTNEED has fill-with-zeros semantics, so a write-tracking
> checkpoint/migration tool (e.g. CRIU) treats the range as unchanged and
> keeps its previous contents; after restore or live migration the process
> reads stale data instead of zeroes -- data corruption.
> 
> Report a hole in a non-hugetlb uffd-wp VMA as written, matching the
> pte_none handling in pagemap_page_category(); the existing
> PM_SCAN_WP_MATCHING path then arms it via uffd_wp_range().
> 
> hugetlb is excluded: pagemap_hugetlb_category() reports an empty hugetlb
> entry (huge_pte_none) as not-written, unlike pagemap_page_category(),
> which reports pte_none as written. pagemap_scan_pte_hole() fires for a
> hugetlb slot only when it has no page table; keeping that not-written
> matches how an allocated-but-empty hugetlb entry reads, so the hole and
> the empty-entry cases agree within the VMA.
> 
> Reported-by: Sashiko AI review <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/patchset/20260707151349.92143-1-kirill@shutemov.name
> Fixes: 2bad466cc9d9 ("mm/uffd: UFFD_FEATURE_WP_UNPOPULATED")
> Cc: Muhammad Usama Anjum <usama.anjum@arm.com>
> Cc: Peter Xu <peterx@redhat.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: Kiryl Shutsemau <kas@kernel.org>
> Assisted-by: Claude:claude-fable-5
> ---

Thanks!

Acked-by: David Hildenbrand (Arm) <david@kernel.org>

-- 
Cheers,

David