Re: [PATCH v2 2/2] mm/hugetlb: optimize bootmem hugepage tail vmemmap init

[Muchun Song <muchun.song@linux.dev>]

On 2026/11/11 16:16, Mike Rapoport wrote:
> Hi,
> On Wed, Nov 11, 2026 at 01:28:50PM +0800, Muchun Song wrote:
>> On 2026/11/11 11:14, Li Zhe wrote:
>>> On 11/10/26 9:35 PM, sashiko-bot@kernel.org wrote:
>>>> Thank you for your contribution! Sashiko AI review found 1 potential
>>>> issue to consider:
>>>> - [High] mm/hugetlb: out-of-bounds write in
>>>>      hugetlb_folio_init_tail_vmemmap()
>>>> --
>>>>
>>>> commit 5be89b38412d58045fd600596787f54c7559d32c
>>>> Author: Li Zhe <lizhe.67@bytedance.com>
>>>>
>>>> mm/hugetlb: optimize bootmem hugepage tail vmemmap init
>>>>
>>>> This commit optimizes bootmem hugepage tail struct page initialization by
>>>> seeding a template from the first tail page and initializing the remaining
>>>> tail pages via memmap_init_page_from_template().
>>>>
>>>>> diff --git a/mm/hugetlb.c b/mm/hugetlb.c
>>>>> index cb2de24affdc4..6ae5d2679e3aa 100644
>>>>> --- a/mm/hugetlb.c
>>>>> +++ b/mm/hugetlb.c
>>>>> @@ -3239,6 +3239,7 @@ static void __init hugetlb_folio_init_tail_vmemmap(struct folio *folio,
>>>>>     	enum zone_type zone = folio_zonenum(folio);
>>>>>     	int nid = folio_nid(folio);
>>>>>     	struct page *page = folio_page(folio, start_page_number);
>>>>> +	struct page template;
>>>>>     	unsigned long head_pfn = folio_pfn(folio);
>>>>>     	unsigned long pfn, end_pfn = head_pfn + end_page_number;
>>>>>     	unsigned int order = huge_page_order(h);
>>>>> @@ -3247,11 +3248,20 @@ static void __init hugetlb_folio_init_tail_vmemmap(struct folio *folio,
>>>>>     	 * As we marked all tail pages with memblock_reserved_mark_noinit(),
>>>>>     	 * we must initialize them ourselves here.
>>>>>     	 */
>>>>> -	for (pfn = head_pfn + start_page_number; pfn < end_pfn; page++, pfn++) {
>>>>> -		__init_single_page(page, pfn, zone, nid);
>>>>> -		prep_compound_tail(page, &folio->page, order);
>>>>> -		set_page_count(page, 0);
>>>>> -	}
>>>>> +	pfn = head_pfn + start_page_number;
>>>>> +
>>>>> +	/*
>>>>> +	 * Seed a template from the first real tail page and refresh only
>>>>> +	 * PFN-dependent fields before copying it.
>>>>> +	 */
>>>>> +	__init_single_page(page, pfn, zone, nid);
>>>>> +	prep_compound_tail(page, &folio->page, order);
>>>>> +	set_page_count(page, 0);
>>>>> +	memcpy(&template, page, sizeof(template));
>>>>> +
>>>>> +	for (pfn++; pfn < end_pfn; pfn++)
>>>>> +		memmap_init_page_from_template(pfn_to_page(pfn), pfn, zone,
>>>>> +					       &template);
>>>> [Severity: High]
>>>> Can peeling the first iteration out of the loop overwrite the struct page
>>>> past the end of folio when start_page_number >= end_page_number?
>>>>
>>>> Previously, the loop was a no-op when pfn >= end_pfn.  Now, when HVO does
>>>> not optimize a gigantic folio, prep_and_add_bootmem_folios() calls
>>>> hugetlb_folio_init_tail_vmemmap(folio, h,
>>>> VMEMMAP_OPTIMIZATION_NR_STRUCT_PAGES, pages_per_huge_page(h)) after
>>>> gather_bootmem_prealloc_node() has already initialized the first
>>>> VMEMMAP_OPTIMIZATION_NR_STRUCT_PAGES pages.
>>>>
>>>> On configurations where a gigantic page has pages_per_huge_page(h) <=
>>>> VMEMMAP_OPTIMIZATION_NR_STRUCT_PAGES (for example, powerpc
>>>> mpc885_ads_defconfig with 16 KiB pages, MAX_PAGE_ORDER == 8, and 8 MiB
>>>> gigantic hugepages of order 9, where both values are 512), this
>>>> unconditionally initializes folio_page(folio, start_page_number) and marks
>>>> the adjacent physical page's struct page as a compound tail of folio,
>>>> corrupting mem_map.
>>> Thanks for the report. This looks valid.
>>>
>>> I will restore the empty-range check before seeding the template in v3.
>> Go ahead. I will end up removing this empty-range check here [1].
>>
>> [1]
>> https://lore.kernel.org/all/20261109095807.41547-8-songmuchun@bytedance.com/
>   
> Maybe you'll pick these two patches into your series since you anyway
> change the same areas?

Good point! I'd like to do this.

Thanks,
Muchun

>>> Thanks,
>>> Zhe