On Sun, Jul 12, 2026 at 09:14:12AM +0800, Zenghui Yu wrote: > Hi Kiryl, > > On 7/9/26 8:16 PM, Kiryl Shutsemau wrote: > > From: "Kiryl Shutsemau (Meta)" <[email protected]> > > > > PAGEMAP_SCAN reports an unpopulated PTE in a uffd-wp VMA as written, but > > a range with no page table at all -- a PMD hole -- is skipped: > > pagemap_scan_pte_hole() tests p->cur_vma_category, which never carries > > PAGE_IS_WRITTEN, so the hole is neither reported nor (under > > PM_SCAN_WP_MATCHING) armed. > > > > MADV_DONTNEED has fill-with-zeros semantics: it changes the contents of > > the range to zeroes (a subsequent read maps the zero page), which write > > tracking must report as written. An anonymous THP is write-protected in > > place as a huge PMD, so a full-PMD MADV_DONTNEED clears it to pmd_none -- > > a hole -- and the zeroing goes unreported. A write-tracking > > checkpoint/migration tool (e.g. CRIU) then treats the range as unchanged > > and keeps its previous contents, so after restore or live migration the > > process reads stale data instead of zeroes -- data corruption. > > > > Report a hole in a non-hugetlb uffd-wp VMA as written, matching the > > pte_none handling in pagemap_page_category(); the existing > > PM_SCAN_WP_MATCHING path then arms it via uffd_wp_range(). > > > > hugetlb is excluded: pagemap_hugetlb_category() reports an empty hugetlb > > entry (huge_pte_none) as not-written, unlike pagemap_page_category(), > > which reports pte_none as written. pagemap_scan_pte_hole() fires for a > > hugetlb slot only when it has no page table; keeping that not-written > > matches how an allocated-but-empty hugetlb entry reads, so the hole and > > the empty-entry cases agree within the VMA. > > > > Add a pagemap_ioctl selftest covering the anon-THP PMD-hole case. > > > > Reported-by: Sashiko AI review <[email protected]> > > Closes: > > https://sashiko.dev/#/patchset/[email protected] > > Fixes: 2bad466cc9d9 ("mm/uffd: UFFD_FEATURE_WP_UNPOPULATED") > > Cc: Muhammad Usama Anjum <[email protected]> > > Cc: Peter Xu <[email protected]> > > Cc: [email protected] > > Signed-off-by: Kiryl Shutsemau <[email protected]> > > Assisted-by: Claude:claude-fable-5 > > --- > > > > Changes since v2 [1], addressing Andrew's review: > > - Describe the user-visible effect: MADV_DONTNEED has fill-with-zeros > > semantics, so the range must be reported written; otherwise a > > checkpoint/migration tool (CRIU) keeps stale data and the process > > reads corrupted contents after restore. Add Reported-by/Closes. > > - Reword the hugetlb carve-out to rest on the category functions: > > pagemap_hugetlb_category() reads an empty hugetlb entry as > > not-written, unlike pagemap_page_category(). > > - Drop the redundant MADV_COLLAPSE fallback #define; it is in > > <asm-generic/mman-common.h> and used directly by other mm selftests. > > I hit the following compilation error on mm-new: > > [root@localhost mm]# make > CC pagemap_ioctl > pagemap_ioctl.c: In function 'unpopulated_thp_hole_test': > pagemap_ioctl.c:1130:31: error: 'MADV_COLLAPSE' undeclared (first use in this > function); did you mean 'MADV_COLD'? > 1130 | if (madvise(mem, hpage_size, MADV_COLLAPSE) || > | ^~~~~~~~~~~~~ > | MADV_COLD > pagemap_ioctl.c:1130:31: note: each undeclared identifier is reported only > once for each function it appears in > make: *** [../lib.mk:225: > /root/code/mm/tools/testing/selftests/mm/pagemap_ioctl] Error 1 > > Could you consider addressing it like fd5295afae91 ("selftests/mm: > hmm-tests: include linux/mman.h to access MADV_COLLAPSE")?
Yep, will send v4. -- Kiryl Shutsemau / Kirill A. Shutemov
