Re: [PATCH v2 1/1] userfaultfd: fix a crash when UFFDIO_MOVE handles a THP hole

[Suren Baghdasaryan <surenb@google.com>]

On Wed, Aug 6, 2025 at 8:06 AM Suren Baghdasaryan <surenb@google.com> wrote:
>
> On Tue, Aug 5, 2025 at 5:41 PM Peter Xu <peterx@redhat.com> wrote:
> >
> > On Tue, Aug 05, 2025 at 04:41:18PM -0700, Suren Baghdasaryan wrote:
> > > Ok, I let the reproducer run for half a day and it did not hit this
> > > case, so I must have done something wrong during my initial
> > > investigation. Sorry for the confusion. I could have sworn that I saw
> > > this case but now it just does not happen.
> >
> > I'm wildly guessing you might have hit the numa balancing bug I mentioned,
> > that might explain what you mentioned previously on the testing results.
> > It might just be tricky to reproduce:
> >
> >   - We'll need a valid THP (pmd) first in the MOVE source region
> >
> >   - THP needs to be selected by numa balancing for a check (marking
> >     prot_none)
> >
> >   - (before any further access..) UFFDIO_MOVE needs to happen on top trying
> >     to move the whole THP being marked as prot_none.
> >
> > AFAICT, task_numa_work() is the only place that can mark the THP, and when
> > it happens, should see change_huge_pmd(cp_flags=MM_CP_PROT_NUMA) and then
> > returns with HPAGE_PMD_NR.
> >
> > [sorry I am still pretty occupied with other things.  I can try to reproduce
> >  together with you after I get more time back]
> >
> > > With migration entry being the only case that leads to that
> > > pmd_folio(), the only check we need to add is the "if
> > > (pmd_present(*src_pmd))" before pmd_folio(). Would you like me to
> > > check anything else or should I go ahead and post that fix?
> >
> > We could fix the migration entry first, then if any of us can reproduce the
> > above numa balancing issue then it can be a 2nd patch on top.
> >
> > After all, so far we didn't yet prove it, either some unreproduceable test,
> > or pure code analysis.  Meanwhile it might also be cleaner if we have one
> > patch fix one issue, rather than having one patch fix two bugs.
> >
> > What do you think?
>
> Agree, that seems reasonable. I'll post the new fix today.

v3 is posted at
https://lore.kernel.org/all/20250806154015.769024-1-surenb@google.com/

> Thanks,
> Suren.
>
> >
> > Thanks,
> >
> > --
> > Peter Xu
> >