Re: [PATCH v2 2/2] mm/hugetlb: optimize bootmem hugepage tail vmemmap init

[Mike Rapoport <rppt@kernel.org>]

On Wed, Nov 11, 2026 at 11:14:46AM +0800, Li Zhe wrote:
> On 11/10/26 9:35 PM, sashiko-bot@kernel.org wrote:
> > Thank you for your contribution! Sashiko AI review found 1 potential
> > issue to consider:
> > - [High] mm/hugetlb: out-of-bounds write in
> >    hugetlb_folio_init_tail_vmemmap()
> > --
> >
> > commit 5be89b38412d58045fd600596787f54c7559d32c
> > Author: Li Zhe <lizhe.67@bytedance.com>
> >
> > mm/hugetlb: optimize bootmem hugepage tail vmemmap init
> >
> > This commit optimizes bootmem hugepage tail struct page initialization by
> > seeding a template from the first tail page and initializing the remaining
> > tail pages via memmap_init_page_from_template().
> >
> >> diff --git a/mm/hugetlb.c b/mm/hugetlb.c
> >> index cb2de24affdc4..6ae5d2679e3aa 100644
> >> --- a/mm/hugetlb.c
> >> +++ b/mm/hugetlb.c
> >> @@ -3239,6 +3239,7 @@ static void __init hugetlb_folio_init_tail_vmemmap(struct folio *folio,
> >>   	enum zone_type zone = folio_zonenum(folio);
> >>   	int nid = folio_nid(folio);
> >>   	struct page *page = folio_page(folio, start_page_number);
> >> +	struct page template;
> >>   	unsigned long head_pfn = folio_pfn(folio);
> >>   	unsigned long pfn, end_pfn = head_pfn + end_page_number;
> >>   	unsigned int order = huge_page_order(h);
> >> @@ -3247,11 +3248,20 @@ static void __init hugetlb_folio_init_tail_vmemmap(struct folio *folio,
> >>   	 * As we marked all tail pages with memblock_reserved_mark_noinit(),
> >>   	 * we must initialize them ourselves here.
> >>   	 */
> >> -	for (pfn = head_pfn + start_page_number; pfn < end_pfn; page++, pfn++) {
> >> -		__init_single_page(page, pfn, zone, nid);
> >> -		prep_compound_tail(page, &folio->page, order);
> >> -		set_page_count(page, 0);
> >> -	}
> >> +	pfn = head_pfn + start_page_number;
> >> +
> >> +	/*
> >> +	 * Seed a template from the first real tail page and refresh only
> >> +	 * PFN-dependent fields before copying it.
> >> +	 */
> >> +	__init_single_page(page, pfn, zone, nid);
> >> +	prep_compound_tail(page, &folio->page, order);
> >> +	set_page_count(page, 0);
> >> +	memcpy(&template, page, sizeof(template));
> >> +
> >> +	for (pfn++; pfn < end_pfn; pfn++)
> >> +		memmap_init_page_from_template(pfn_to_page(pfn), pfn, zone,
> >> +					       &template);
> > [Severity: High]
> > Can peeling the first iteration out of the loop overwrite the struct page
> > past the end of folio when start_page_number >= end_page_number?
> >
> > Previously, the loop was a no-op when pfn >= end_pfn.  Now, when HVO does
> > not optimize a gigantic folio, prep_and_add_bootmem_folios() calls
> > hugetlb_folio_init_tail_vmemmap(folio, h,
> > VMEMMAP_OPTIMIZATION_NR_STRUCT_PAGES, pages_per_huge_page(h)) after
> > gather_bootmem_prealloc_node() has already initialized the first
> > VMEMMAP_OPTIMIZATION_NR_STRUCT_PAGES pages.
> >
> > On configurations where a gigantic page has pages_per_huge_page(h) <=
> > VMEMMAP_OPTIMIZATION_NR_STRUCT_PAGES (for example, powerpc
> > mpc885_ads_defconfig with 16 KiB pages, MAX_PAGE_ORDER == 8, and 8 MiB
> > gigantic hugepages of order 9, where both values are 512), this
> > unconditionally initializes folio_page(folio, start_page_number) and marks
> > the adjacent physical page's struct page as a compound tail of folio,
> > corrupting mem_map.
> 
> Thanks for the report. This looks valid.

I love how sashiko finds issue on very niche systems.

But yeah, ppc8xx actually uses hugetlb :(

> I will restore the empty-range check before seeding the template in v3.
> 
> Thanks,
> Zhe
> 

-- 
Sincerely yours,
Mike.