BUG: mm: VM_BUG_ON_PAGE in post_alloc_hook() via __ClearPagePrezeroed() on compound pages

BUG: mm: VM_BUG_ON_PAGE in post_alloc_hook() via __ClearPagePrezeroed() on compound pages

[Breno Leitao]

Hi Michael,

Booting next-20260603 (a225caacc365) on arm64 with CONFIG_DEBUG_VM=y
panics in start_kernel() during kmem_cache_init():

  page dumped because: VM_BUG_ON_PAGE(1 && PageCompound(page))
  kernel BUG at ./include/linux/page-flags.h:682!
  Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP
  CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.1.0-rc6-next-20260603
  Hardware name: linux,dummy-virt (DT)
  pc : post_alloc_hook+0x224/0x2b8
  Call trace:
   post_alloc_hook+0x224/0x2b8 (P)
   get_page_from_freelist+0x18a4/0x1b18
   __alloc_frozen_pages_noprof+0x1b0/0x2068
   __alloc_pages_mpol+0x130/0x2d0
   alloc_frozen_pages_noprof+0x64/0xe8
   alloc_slab_page+0x88/0x140
   new_slab+0x11c/0x680
   ___slab_alloc+0x18c/0x7f0
   __kmalloc_noprof+0x534/0x938
   do_kmem_cache_create+0x724/0x890
   create_boot_cache+0xc8/0x148
   create_kmalloc_cache+0x5c/0xc8
   new_kmalloc_cache+0x274/0x438
   create_kmalloc_caches+0x2c/0x88
   kmem_cache_init+0x228/0x2e0
   mm_core_init+0x74/0xa0
   start_kernel+0x1cc/0x4d0

Bisected (by inspection) to:

  504f40f6bda6 ("mm: page_reporting: skip redundant zeroing of host-zeroed
                 reported pages")

Reproducer:
  - linux-next 20260603, arm64 defconfig + DEBUG_VM=y (any debug-heavy
    config will do; mine also has PROVE_LOCKING/DEBUG_LOCK_ALLOC, but
    those are not required to trip the BUG once an order>0 __GFP_COMP
    allocation hits prep_new_page).
  - Boot under qemu-system-aarch64 -M virt with earlycon enabled.

I've tested something like the following and  I was able to boot the host:

  --- a/include/linux/page-flags.h
  +++ b/include/linux/page-flags.h
  @@ -679,7 +679,7 @@ FOLIO_FLAG_FALSE(idle)
    * PagePrezeroed() tracks pages known to be zero.  The allocator
    * uses this to skip redundant zeroing in post_alloc_hook().
    */
  -__PAGEFLAG(Prezeroed, prezeroed, PF_NO_COMPOUND)
  +__PAGEFLAG(Prezeroed, prezeroed, PF_ANY)

With that change the lockdep+DEBUG_VM kernel boots all the way through
SMP init and hands off to PID 1 on arm64.

Happy to test a follow-up patch if you'd prefer a different shape.

Thanks,
--breno

Re: BUG: mm: VM_BUG_ON_PAGE in post_alloc_hook() via __ClearPagePrezeroed() on compound pages

[Michael S. Tsirkin]

On Thu, Jun 04, 2026 at 03:59:06AM -0700, Breno Leitao wrote:
> Hi Michael,
> 
> Booting next-20260603 (a225caacc365) on arm64 with CONFIG_DEBUG_VM=y
> panics in start_kernel() during kmem_cache_init():

it's my bad i pushed a wrong branch to next. Sorry.

>   page dumped because: VM_BUG_ON_PAGE(1 && PageCompound(page))
>   kernel BUG at ./include/linux/page-flags.h:682!
>   Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP
>   CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.1.0-rc6-next-20260603
>   Hardware name: linux,dummy-virt (DT)
>   pc : post_alloc_hook+0x224/0x2b8
>   Call trace:
>    post_alloc_hook+0x224/0x2b8 (P)
>    get_page_from_freelist+0x18a4/0x1b18
>    __alloc_frozen_pages_noprof+0x1b0/0x2068
>    __alloc_pages_mpol+0x130/0x2d0
>    alloc_frozen_pages_noprof+0x64/0xe8
>    alloc_slab_page+0x88/0x140
>    new_slab+0x11c/0x680
>    ___slab_alloc+0x18c/0x7f0
>    __kmalloc_noprof+0x534/0x938
>    do_kmem_cache_create+0x724/0x890
>    create_boot_cache+0xc8/0x148
>    create_kmalloc_cache+0x5c/0xc8
>    new_kmalloc_cache+0x274/0x438
>    create_kmalloc_caches+0x2c/0x88
>    kmem_cache_init+0x228/0x2e0
>    mm_core_init+0x74/0xa0
>    start_kernel+0x1cc/0x4d0
> 
> Bisected (by inspection) to:
> 
>   504f40f6bda6 ("mm: page_reporting: skip redundant zeroing of host-zeroed
>                  reported pages")
> 
> Reproducer:
>   - linux-next 20260603, arm64 defconfig + DEBUG_VM=y (any debug-heavy
>     config will do; mine also has PROVE_LOCKING/DEBUG_LOCK_ALLOC, but
>     those are not required to trip the BUG once an order>0 __GFP_COMP
>     allocation hits prep_new_page).
>   - Boot under qemu-system-aarch64 -M virt with earlycon enabled.
> 
> I've tested something like the following and  I was able to boot the host:
> 
>   --- a/include/linux/page-flags.h
>   +++ b/include/linux/page-flags.h
>   @@ -679,7 +679,7 @@ FOLIO_FLAG_FALSE(idle)
>     * PagePrezeroed() tracks pages known to be zero.  The allocator
>     * uses this to skip redundant zeroing in post_alloc_hook().
>     */
>   -__PAGEFLAG(Prezeroed, prezeroed, PF_NO_COMPOUND)
>   +__PAGEFLAG(Prezeroed, prezeroed, PF_ANY)
> 
> With that change the lockdep+DEBUG_VM kernel boots all the way through
> SMP init and hands off to PID 1 on arm64.
> 
> Happy to test a follow-up patch if you'd prefer a different shape.
> 
> Thanks,
> --breno