[PATCH] mm/hugetlb: init tails before init_migratetype

[PATCH] mm/hugetlb: init tails before init_migratetype

[Michal Clapinski]

Currently, if you enable HVO, DEFERRED_STRUCT_PAGE_INIT and VM_DEBUG
the kernel will crash with the following stack trace

get_pfnblock_bitmap_bitidx
__set_pfnblock_flags_mask
hugetlb_bootmem_init_migratetype
prep_and_add_bootmem_folios
gather_bootmem_prealloc_node
gather_bootmem_prealloc_parallel
padata_do_multithreaded
gather_bootmem_prealloc
hugetlb_init

on this code

VM_BUG_ON_PAGE(!zone_spans_pfn(page_zone(page), pfn), page);

This code looks inside the struct page which will be uninitialized
for hugetlb tail pages, which will cause a false positive.

So let's initialize the tail pages before this happens.

Fixes: 622026e87c40 ("mm/hugetlb: remove fake head pages")
Signed-off-by: Michal Clapinski <mclapinski@google.com>
---
I think this one check is the only thing that fails, so I can probably
just remove it instead.
---
 mm/hugetlb.c         |  1 +
 mm/hugetlb_vmemmap.c | 14 +++++++++-----
 mm/hugetlb_vmemmap.h |  5 +++++
 3 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 571212b80835..de5e7c104c10 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -4127,6 +4127,7 @@ static int __init hugetlb_init(void)
 	}
 
 	hugetlb_init_hstates();
+	hugetlb_vmemmap_init_tails();
 	gather_bootmem_prealloc();
 	report_hugepages();
 
diff --git a/mm/hugetlb_vmemmap.c b/mm/hugetlb_vmemmap.c
index 133b46dfb09f..cf485c101926 100644
--- a/mm/hugetlb_vmemmap.c
+++ b/mm/hugetlb_vmemmap.c
@@ -867,14 +867,10 @@ static const struct ctl_table hugetlb_vmemmap_sysctls[] = {
 	},
 };
 
-static int __init hugetlb_vmemmap_init(void)
+void __init hugetlb_vmemmap_init_tails(void)
 {
-	const struct hstate *h;
 	struct zone *zone;
 
-	/* HUGETLB_VMEMMAP_RESERVE_SIZE should cover all used struct pages */
-	BUILD_BUG_ON(__NR_USED_SUBPAGE > HUGETLB_VMEMMAP_RESERVE_PAGES);
-
 	for_each_zone(zone) {
 		for (int i = 0; i < NR_VMEMMAP_TAILS; i++) {
 			struct page *tail, *p;
@@ -890,6 +886,14 @@ static int __init hugetlb_vmemmap_init(void)
 				init_compound_tail(p + j, NULL, order, zone);
 		}
 	}
+}
+
+static int __init hugetlb_vmemmap_init(void)
+{
+	const struct hstate *h;
+
+	/* HUGETLB_VMEMMAP_RESERVE_SIZE should cover all used struct pages */
+	BUILD_BUG_ON(__NR_USED_SUBPAGE > HUGETLB_VMEMMAP_RESERVE_PAGES);
 
 	for_each_hstate(h) {
 		if (hugetlb_vmemmap_optimizable(h)) {
diff --git a/mm/hugetlb_vmemmap.h b/mm/hugetlb_vmemmap.h
index 18b490825215..91cdb28969fa 100644
--- a/mm/hugetlb_vmemmap.h
+++ b/mm/hugetlb_vmemmap.h
@@ -20,6 +20,7 @@
 #define HUGETLB_VMEMMAP_RESERVE_PAGES	(HUGETLB_VMEMMAP_RESERVE_SIZE / sizeof(struct page))
 
 #ifdef CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP
+void hugetlb_vmemmap_init_tails(void);
 int hugetlb_vmemmap_restore_folio(const struct hstate *h, struct folio *folio);
 long hugetlb_vmemmap_restore_folios(const struct hstate *h,
 					struct list_head *folio_list,
@@ -72,6 +73,10 @@ static inline void hugetlb_vmemmap_optimize_folios(struct hstate *h, struct list
 {
 }
 
+static inline void hugetlb_vmemmap_init_tails(void)
+{
+}
+
 static inline void hugetlb_vmemmap_optimize_bootmem_folios(struct hstate *h,
 						struct list_head *folio_list)
 {
-- 
2.55.0.rc0.799.gd6f94ed593-goog

Re: [PATCH] mm/hugetlb: init tails before init_migratetype

[Kiryl Shutsemau]

On Mon, Jun 22, 2026 at 12:19:01PM +0200, Michal Clapinski wrote:
> Currently, if you enable HVO, DEFERRED_STRUCT_PAGE_INIT and VM_DEBUG
> the kernel will crash with the following stack trace
> 
> get_pfnblock_bitmap_bitidx
> __set_pfnblock_flags_mask
> hugetlb_bootmem_init_migratetype
> prep_and_add_bootmem_folios
> gather_bootmem_prealloc_node
> gather_bootmem_prealloc_parallel
> padata_do_multithreaded
> gather_bootmem_prealloc
> hugetlb_init
> 
> on this code
> 
> VM_BUG_ON_PAGE(!zone_spans_pfn(page_zone(page), pfn), page);
> 
> This code looks inside the struct page which will be uninitialized
> for hugetlb tail pages, which will cause a false positive.
> 
> So let's initialize the tail pages before this happens.
> 
> Fixes: 622026e87c40 ("mm/hugetlb: remove fake head pages")
> Signed-off-by: Michal Clapinski <mclapinski@google.com>

Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Tested-by: Kiryl Shutsemau (Meta) <kas@kernel.org>

One nit below.

> ---
> I think this one check is the only thing that fails, so I can probably
> just remove it instead.

Please don't. It caught a legitimate issue.

> ---
>  mm/hugetlb.c         |  1 +
>  mm/hugetlb_vmemmap.c | 14 +++++++++-----
>  mm/hugetlb_vmemmap.h |  5 +++++
>  3 files changed, 15 insertions(+), 5 deletions(-)
> 
> diff --git a/mm/hugetlb.c b/mm/hugetlb.c
> index 571212b80835..de5e7c104c10 100644
> --- a/mm/hugetlb.c
> +++ b/mm/hugetlb.c
> @@ -4127,6 +4127,7 @@ static int __init hugetlb_init(void)
>  	}
>  
>  	hugetlb_init_hstates();
> +	hugetlb_vmemmap_init_tails();
>  	gather_bootmem_prealloc();
>  	report_hugepages();
>  
> diff --git a/mm/hugetlb_vmemmap.c b/mm/hugetlb_vmemmap.c
> index 133b46dfb09f..cf485c101926 100644
> --- a/mm/hugetlb_vmemmap.c
> +++ b/mm/hugetlb_vmemmap.c
> @@ -867,14 +867,10 @@ static const struct ctl_table hugetlb_vmemmap_sysctls[] = {
>  	},
>  };
>  
> -static int __init hugetlb_vmemmap_init(void)
> +void __init hugetlb_vmemmap_init_tails(void)

While you're touching this, please also fix up the now-stale comment in
vmemmap_get_tail() in mm/sparse-vmemmap.c, which still points at the
old function.

-- 
  Kiryl Shutsemau / Kirill A. Shutemov

Re: [PATCH] mm/hugetlb: init tails before init_migratetype

[Muchun Song]

> On Jun 22, 2026, at 18:19, Michal Clapinski <mclapinski@google.com> wrote:
> 
> Currently, if you enable HVO, DEFERRED_STRUCT_PAGE_INIT and VM_DEBUG
> the kernel will crash with the following stack trace
> 
> get_pfnblock_bitmap_bitidx
> __set_pfnblock_flags_mask
> hugetlb_bootmem_init_migratetype
> prep_and_add_bootmem_folios
> gather_bootmem_prealloc_node
> gather_bootmem_prealloc_parallel
> padata_do_multithreaded
> gather_bootmem_prealloc
> hugetlb_init
> 
> on this code
> 
> VM_BUG_ON_PAGE(!zone_spans_pfn(page_zone(page), pfn), page);
> 
> This code looks inside the struct page which will be uninitialized
> for hugetlb tail pages, which will cause a false positive.
> 
> So let's initialize the tail pages before this happens.
> 
> Fixes: 622026e87c40 ("mm/hugetlb: remove fake head pages")
> Signed-off-by: Michal Clapinski <mclapinski@google.com>

Thanks for catching this! Your fix is perfectly correct and addresses
a real issue. I just wanted to let you know that a similar fix was
actually submitted a few days ago in patch [1].

[1] https://lore.kernel.org/linux-mm/20260612035903.2468601-2-songmuchun@bytedance.com/

Muchun,
Thanks.