Re: [PATCH v3 1/2] mm/khugepaged: Never install PMDs in uffd-minor-registered VMAs

On Thu, 10 Sep 2026 02:34:10 +0000 James Houghton [off-list ref] wrote:

Userfaultfd minor faults provides userspace with the ability to manually
install PTEs with UFFDIO_CONTINUE. Right now, MADV_COLLAPSE can map
holes in the VMA when a naturally-aligned THP is present. This is not
true for khugepaged collapse: the PTEs will be retracted, but a PMD will
not be installed.

When MADV_COLLAPSE installs a PMD that mapped holes in the VMA,
userspace is likely to expect UFFDIO_CONTINUE to succeed on the
should-be holes. UFFDIO_CONTINUE will fail and return EEXIST.

This is not inherently a problem, as MADV_COLLAPSE is an explicit
userspace action. But, especially because MADV_COLLAPSE can be invoked
by an external process via process_madvise(), a rogue caller could break
a userfaultfd-minor resolver thread. If khugepaged is later updated to
install PMDs for khugepaged collapsing, that would be a genuine problem.

Userspace cannot generally use MADV_COLLAPSE to resolve userfault minor
faults, as MADV_COLLAPSE will only resolve such faults if a
naturally-aligned THP is present.

The naturally-aligned THP case is the only case where this quirk exists.
Collapsing otherwise requires all PTEs to be present for
userfaultfd-registered VMAs (i.e., max none PTEs is 0), which is
correct. This check is essentially bypassed for naturally-aligned THPs.

...

 - Drop cc:stable and update the changelog for the main patch.
   khugepaged doesn't actually install PMDs, so it is impossible for the
   kernel to silently install mappings that userspace didn't ask for.
   Therefore this patch does not need to be backported.

Thanks for explaining that.  It helps.  My life :(

Sashiko had a stupid niggle about the selftest change and made quite
disturbing claims about the existing try_collapse_pte_mapped_thp() code:

	https://sashiko.dev/#/patchset/20260910023411.514987-1-jthoughton@google.com

I'll queue the series for test-n-review.