* [linux-next:master 1977/2307] mm/hugetlb.c:3095:4: warning: array subscript -1 is below array bounds of 'struct list_head[1]'
@ 2026-07-01 1:36 kernel test robot
2026-07-01 14:53 ` Muchun Song
0 siblings, 1 reply; 3+ messages in thread
From: kernel test robot @ 2026-07-01 1:36 UTC (permalink / raw)
To: Muchun Song; +Cc: oe-kbuild-all, Andrew Morton, Linux Memory Management List
tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
head: be5c93fa674f0fc3c8f359c2143abce6bbb422e6
commit: f48ee682d55e3602fcc194cb93b8398f2546e53f [1977/2307] mm/hugetlb: free cross-zone bootmem gigantic pages after allocation
config: sparc-randconfig-r131-20260701 (https://download.01.org/0day-ci/archive/20260701/202607010945.6lDjBFTU-lkp@intel.com/config)
compiler: sparc64-linux-gcc (GCC) 8.5.0
sparse: v0.6.5-rc1
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260701/202607010945.6lDjBFTU-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202607010945.6lDjBFTU-lkp@intel.com/
All warnings (new ones prefixed by >>):
mm/hugetlb.c: In function 'alloc_bootmem_huge_page':
>> mm/hugetlb.c:3095:4: warning: array subscript -1 is below array bounds of 'struct list_head[1]' [-Warray-bounds]
list_add(&m->list, &huge_boot_pages[nid_request]);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
vim +3095 mm/hugetlb.c
3060
3061 static bool __init alloc_bootmem_huge_page(struct hstate *h, int nid)
3062 {
3063 unsigned long pfn;
3064 unsigned int nid_request = nid;
3065 struct huge_bootmem_page *m = arch_alloc_bootmem_huge_page(h, nid);
3066
3067 if (!m)
3068 return false;
3069
3070 pfn = PHYS_PFN(__pa(m));
3071 nid = early_pfn_to_nid(pfn);
3072 /*
3073 * Use the beginning of the huge page to store the huge_bootmem_page
3074 * struct (until gather_bootmem puts them into the mem_map).
3075 *
3076 * Put them into a private list first because mem_map is not up yet.
3077 */
3078 INIT_LIST_HEAD(&m->list);
3079 m->hstate = h;
3080 if (!hugetlb_early_cma(h)) {
3081 m->cma = NULL;
3082 m->flags = 0;
3083 }
3084
3085 /* CMA pages: zone-crossing is validated in hugetlb_cma_reserve(). */
3086 if (!hugetlb_early_cma(h) &&
3087 pfn_range_intersects_zones(nid, pfn, pages_per_huge_page(h))) {
3088 /*
3089 * If the allocated page is on a different node than requested
3090 * (e.g., on PowerPC LPARs), put it on the requested node's list,
3091 * because hugetlb_free_cross_zone_pages() only frees cross-zone
3092 * pages belonging to the requested node.
3093 */
3094 if (WARN_ON_ONCE(nid_request != NUMA_NO_NODE && nid != nid_request))
> 3095 list_add(&m->list, &huge_boot_pages[nid_request]);
3096 else
3097 list_add(&m->list, &huge_boot_pages[nid]);
3098 } else {
3099 list_add_tail(&m->list, &huge_boot_pages[nid]);
3100 m->flags |= HUGE_BOOTMEM_ZONES_VALID;
3101 /*
3102 * Only initialize the head struct page in memmap_init_reserved_pages,
3103 * rest of the struct pages will be initialized by the HugeTLB
3104 * subsystem itself.
3105 * The head struct page is used to get folio information by the HugeTLB
3106 * subsystem like zone id and node id.
3107 */
3108 memblock_reserved_mark_noinit(__pa((void *)m + PAGE_SIZE),
3109 huge_page_size(h) - PAGE_SIZE);
3110 }
3111
3112 return true;
3113 }
3114
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [linux-next:master 1977/2307] mm/hugetlb.c:3095:4: warning: array subscript -1 is below array bounds of 'struct list_head[1]'
2026-07-01 1:36 [linux-next:master 1977/2307] mm/hugetlb.c:3095:4: warning: array subscript -1 is below array bounds of 'struct list_head[1]' kernel test robot
@ 2026-07-01 14:53 ` Muchun Song
2026-07-01 18:13 ` Andrew Morton
0 siblings, 1 reply; 3+ messages in thread
From: Muchun Song @ 2026-07-01 14:53 UTC (permalink / raw)
To: kernel test robot
Cc: oe-kbuild-all, Andrew Morton, Linux Memory Management List
On Wed, Jul 1, 2026 at 9:37 AM kernel test robot <lkp@intel.com> wrote:
>
> tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
> head: be5c93fa674f0fc3c8f359c2143abce6bbb422e6
> commit: f48ee682d55e3602fcc194cb93b8398f2546e53f [1977/2307] mm/hugetlb: free cross-zone bootmem gigantic pages after allocation
> config: sparc-randconfig-r131-20260701 (https://download.01.org/0day-ci/archive/20260701/202607010945.6lDjBFTU-lkp@intel.com/config)
> compiler: sparc64-linux-gcc (GCC) 8.5.0
> sparse: v0.6.5-rc1
> reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260701/202607010945.6lDjBFTU-lkp@intel.com/reproduce)
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@intel.com>
> | Closes: https://lore.kernel.org/oe-kbuild-all/202607010945.6lDjBFTU-lkp@intel.com/
>
> All warnings (new ones prefixed by >>):
>
> mm/hugetlb.c: In function 'alloc_bootmem_huge_page':
> >> mm/hugetlb.c:3095:4: warning: array subscript -1 is below array bounds of 'struct list_head[1]' [-Warray-bounds]
> list_add(&m->list, &huge_boot_pages[nid_request]);
> ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
It seems like a false positive?
>
> vim +3095 mm/hugetlb.c
>
> 3060
> 3061 static bool __init alloc_bootmem_huge_page(struct hstate *h, int nid)
> 3062 {
> 3063 unsigned long pfn;
> 3064 unsigned int nid_request = nid;
> 3065 struct huge_bootmem_page *m = arch_alloc_bootmem_huge_page(h, nid);
> 3066
> 3067 if (!m)
> 3068 return false;
> 3069
> 3070 pfn = PHYS_PFN(__pa(m));
> 3071 nid = early_pfn_to_nid(pfn);
> 3072 /*
> 3073 * Use the beginning of the huge page to store the huge_bootmem_page
> 3074 * struct (until gather_bootmem puts them into the mem_map).
> 3075 *
> 3076 * Put them into a private list first because mem_map is not up yet.
> 3077 */
> 3078 INIT_LIST_HEAD(&m->list);
> 3079 m->hstate = h;
> 3080 if (!hugetlb_early_cma(h)) {
> 3081 m->cma = NULL;
> 3082 m->flags = 0;
> 3083 }
> 3084
> 3085 /* CMA pages: zone-crossing is validated in hugetlb_cma_reserve(). */
> 3086 if (!hugetlb_early_cma(h) &&
> 3087 pfn_range_intersects_zones(nid, pfn, pages_per_huge_page(h))) {
> 3088 /*
> 3089 * If the allocated page is on a different node than requested
> 3090 * (e.g., on PowerPC LPARs), put it on the requested node's list,
> 3091 * because hugetlb_free_cross_zone_pages() only frees cross-zone
> 3092 * pages belonging to the requested node.
> 3093 */
> 3094 if (WARN_ON_ONCE(nid_request != NUMA_NO_NODE && nid != nid_request))
We have a check here to make sure that nid_request cannot be -1.
> > 3095 list_add(&m->list, &huge_boot_pages[nid_request]);
> 3096 else
> 3097 list_add(&m->list, &huge_boot_pages[nid]);
> 3098 } else {
> 3099 list_add_tail(&m->list, &huge_boot_pages[nid]);
> 3100 m->flags |= HUGE_BOOTMEM_ZONES_VALID;
> 3101 /*
> 3102 * Only initialize the head struct page in memmap_init_reserved_pages,
> 3103 * rest of the struct pages will be initialized by the HugeTLB
> 3104 * subsystem itself.
> 3105 * The head struct page is used to get folio information by the HugeTLB
> 3106 * subsystem like zone id and node id.
> 3107 */
> 3108 memblock_reserved_mark_noinit(__pa((void *)m + PAGE_SIZE),
> 3109 huge_page_size(h) - PAGE_SIZE);
> 3110 }
> 3111
> 3112 return true;
> 3113 }
> 3114
>
> --
> 0-DAY CI Kernel Test Service
> https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-07-01 18:13 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-01 1:36 [linux-next:master 1977/2307] mm/hugetlb.c:3095:4: warning: array subscript -1 is below array bounds of 'struct list_head[1]' kernel test robot
2026-07-01 14:53 ` Muchun Song
2026-07-01 18:13 ` Andrew Morton
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox