Re: [PATCH] mm/alloc_tag: clear codetag for pages allocated before page_ext initialization

[Suren Baghdasaryan <surenb@google.com>]

On Mon, Mar 23, 2026 at 2:16 AM Hao Ge <hao.ge@linux.dev> wrote:
>
>
> On 2026/3/20 10:14, Suren Baghdasaryan wrote:
> > On Thu, Mar 19, 2026 at 6:58 PM Hao Ge <hao.ge@linux.dev> wrote:
> >>
> >> On 2026/3/20 07:48, Suren Baghdasaryan wrote:
> >>> On Thu, Mar 19, 2026 at 4:44 PM Suren Baghdasaryan <surenb@google.com> wrote:
> >>>> On Thu, Mar 19, 2026 at 3:28 PM Andrew Morton <akpm@linux-foundation.org> wrote:
> >>>>> On Thu, 19 Mar 2026 16:31:53 +0800 Hao Ge <hao.ge@linux.dev> wrote:
> >>>>>
> >>>>>> Due to initialization ordering, page_ext is allocated and initialized
> >>>>>> relatively late during boot. Some pages have already been allocated
> >>>>>> and freed before page_ext becomes available, leaving their codetag
> >>>>>> uninitialized.
> >>>> Hi Hao,
> >>>> Thanks for the report.
> >>>> Hmm. So, we are allocating pages before page_ext is initialized...
> >>>>
> >>>>>> A clear example is in init_section_page_ext(): alloc_page_ext() calls
> >>>>>> kmemleak_alloc().
> >>> Forgot to ask. The example you are using here is for page_ext
> >>> allocation itself. Do you have any other examples where page
> >>> allocation happens before page_ext initialization? If that's the only
> >>> place, then we might be able to fix this in a simpler way by doing
> >>> something special for alloc_page_ext().
> >> Hi Suren
> >>
> >> To help illustrate the point, here's the debug log I added:
> >>
> >> diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> >> index 2d4b6f1a554e..ebfe636f5b07 100644
> >> --- a/mm/page_alloc.c
> >> +++ b/mm/page_alloc.c
> >> @@ -1293,6 +1293,9 @@ void __pgalloc_tag_add(struct page *page, struct
> >> task_struct *task,
> >>                   alloc_tag_add(&ref, task->alloc_tag, PAGE_SIZE * nr);
> >>                   update_page_tag_ref(handle, &ref);
> >>                   put_page_tag_ref(handle);
> >> +       } else {
> >> +               pr_warn("__pgalloc_tag_add: get_page_tag_ref failed!
> >> page=%p pfn=%lu nr=%u\n", page, page_to_pfn(page), nr);
> >> +               dump_stack();
> >>           }
> >>    }
> >>
> >>
> >> And I caught the following logs:
> >>
> >> [    0.296399] __pgalloc_tag_add: get_page_tag_ref failed!
> >> page=ffffea000400c700 pfn=1049372 nr=1
> >> [    0.296400] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted
> >> 7.0.0-rc4-dirty #12 PREEMPT(lazy)
> >> [    0.296402] Hardware name: Red Hat KVM, BIOS
> >> rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
> >> [    0.296402] Call Trace:
> >> [    0.296403]  <TASK>
> >> [    0.296403]  dump_stack_lvl+0x53/0x70
> >> [    0.296405]  __pgalloc_tag_add+0x3a3/0x6e0
> >> [    0.296406]  ? __pfx___pgalloc_tag_add+0x10/0x10
> >> [    0.296407]  ? kasan_unpoison+0x27/0x60
> >> [    0.296409]  ? __kasan_unpoison_pages+0x2c/0x40
> >> [    0.296411]  get_page_from_freelist+0xa54/0x1310
> >> [    0.296413]  __alloc_frozen_pages_noprof+0x206/0x4c0
> >> [    0.296415]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
> >> [    0.296417]  ? stack_depot_save_flags+0x3f/0x680
> >> [    0.296418]  ? ___slab_alloc+0x518/0x530
> >> [    0.296420]  alloc_pages_mpol+0x13a/0x3f0
> >> [    0.296421]  ? __pfx_alloc_pages_mpol+0x10/0x10
> >> [    0.296423]  ? _raw_spin_lock_irqsave+0x8a/0xf0
> >> [    0.296424]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
> >> [    0.296426]  alloc_slab_page+0xc2/0x130
> >> [    0.296427]  allocate_slab+0x77/0x2c0
> >> [    0.296429]  ? syscall_enter_define_fields+0x3bb/0x5f0
> >> [    0.296430]  ___slab_alloc+0x125/0x530
> >> [    0.296432]  ? __trace_define_field+0x252/0x3d0
> >> [    0.296433]  __kmalloc_noprof+0x329/0x630
> >> [    0.296435]  ? syscall_enter_define_fields+0x3bb/0x5f0
> >> [    0.296436]  syscall_enter_define_fields+0x3bb/0x5f0
> >> [    0.296438]  ? __pfx_syscall_enter_define_fields+0x10/0x10
> >> [    0.296440]  event_define_fields+0x326/0x540
> >> [    0.296441]  __trace_early_add_events+0xac/0x3c0
> >> [    0.296443]  trace_event_init+0x24c/0x460
> >> [    0.296445]  trace_init+0x9/0x20
> >> [    0.296446]  start_kernel+0x199/0x3c0
> >> [    0.296448]  x86_64_start_reservations+0x18/0x30
> >> [    0.296449]  x86_64_start_kernel+0xe2/0xf0
> >> [    0.296451]  common_startup_64+0x13e/0x141
> >> [    0.296453]  </TASK>
> >>
> >>
> >> [    0.312234] __pgalloc_tag_add: get_page_tag_ref failed!
> >> page=ffffea000400f900 pfn=1049572 nr=1
> >> [    0.312234] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted
> >> 7.0.0-rc4-dirty #12 PREEMPT(lazy)
> >> [    0.312236] Hardware name: Red Hat KVM, BIOS
> >> rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
> >> [    0.312236] Call Trace:
> >> [    0.312237]  <TASK>
> >> [    0.312237]  dump_stack_lvl+0x53/0x70
> >> [    0.312239]  __pgalloc_tag_add+0x3a3/0x6e0
> >> [    0.312240]  ? __pfx___pgalloc_tag_add+0x10/0x10
> >> [    0.312241]  ? rmqueue.constprop.0+0x4fc/0x1ce0
> >> [    0.312243]  ? kasan_unpoison+0x27/0x60
> >> [    0.312244]  ? __kasan_unpoison_pages+0x2c/0x40
> >> [    0.312246]  get_page_from_freelist+0xa54/0x1310
> >> [    0.312248]  __alloc_frozen_pages_noprof+0x206/0x4c0
> >> [    0.312250]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
> >> [    0.312253]  alloc_slab_page+0x39/0x130
> >> [    0.312254]  allocate_slab+0x77/0x2c0
> >> [    0.312255]  ? alloc_cpumask_var_node+0xc7/0x230
> >> [    0.312257]  ___slab_alloc+0x46d/0x530
> >> [    0.312259]  __kmalloc_node_noprof+0x2fa/0x680
> >> [    0.312261]  ? alloc_cpumask_var_node+0xc7/0x230
> >> [    0.312263]  alloc_cpumask_var_node+0xc7/0x230
> >> [    0.312264]  init_desc+0x141/0x6b0
> >> [    0.312266]  alloc_desc+0x108/0x1b0
> >> [    0.312267]  early_irq_init+0xee/0x1c0
> >> [    0.312268]  ? __pfx_early_irq_init+0x10/0x10
> >> [    0.312271]  start_kernel+0x1ab/0x3c0
> >> [    0.312272]  x86_64_start_reservations+0x18/0x30
> >> [    0.312274]  x86_64_start_kernel+0xe2/0xf0
> >> [    0.312275]  common_startup_64+0x13e/0x141
> >> [    0.312277]  </TASK>
> >>
> >> [    0.312834] __pgalloc_tag_add: get_page_tag_ref failed!
> >> page=ffffea000400fc00 pfn=1049584 nr=1
> >> [    0.312835] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted
> >> 7.0.0-rc4-dirty #12 PREEMPT(lazy)
> >> [    0.312836] Hardware name: Red Hat KVM, BIOS
> >> rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
> >> [    0.312837] Call Trace:
> >> [    0.312837]  <TASK>
> >> [    0.312838]  dump_stack_lvl+0x53/0x70
> >> [    0.312840]  __pgalloc_tag_add+0x3a3/0x6e0
> >> [    0.312841]  ? __pfx___pgalloc_tag_add+0x10/0x10
> >> [    0.312842]  ? rmqueue.constprop.0+0x4fc/0x1ce0
> >> [    0.312844]  ? kasan_unpoison+0x27/0x60
> >> [    0.312845]  ? __kasan_unpoison_pages+0x2c/0x40
> >> [    0.312847]  get_page_from_freelist+0xa54/0x1310
> >> [    0.312849]  __alloc_frozen_pages_noprof+0x206/0x4c0
> >> [    0.312851]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
> >> [    0.312853]  alloc_pages_mpol+0x13a/0x3f0
> >> [    0.312855]  ? __pfx_alloc_pages_mpol+0x10/0x10
> >> [    0.312856]  ? xas_find+0x2d8/0x450
> >> [    0.312858]  ? _raw_spin_lock+0x84/0xe0
> >> [    0.312859]  ? __pfx__raw_spin_lock+0x10/0x10
> >> [    0.312861]  alloc_pages_noprof+0xf6/0x2b0
> >> [    0.312862]  __change_page_attr+0x293/0x850
> >> [    0.312864]  ? __pfx___change_page_attr+0x10/0x10
> >> [    0.312865]  ? _vm_unmap_aliases+0x2d0/0x650
> >> [    0.312868]  ? __pfx__vm_unmap_aliases+0x10/0x10
> >> [    0.312869]  __change_page_attr_set_clr+0x16c/0x360
> >> [    0.312871]  ? spp_getpage+0xbb/0x1e0
> >> [    0.312872]  change_page_attr_set_clr+0x220/0x3c0
> >> [    0.312873]  ? flush_tlb_one_kernel+0xf/0x30
> >> [    0.312875]  ? set_pte_vaddr_p4d+0x110/0x180
> >> [    0.312877]  ? __pfx_change_page_attr_set_clr+0x10/0x10
> >> [    0.312878]  ? __pfx_set_pte_vaddr_p4d+0x10/0x10
> >> [    0.312881]  ? __pfx_mtree_load+0x10/0x10
> >> [    0.312883]  ? __pfx_mtree_load+0x10/0x10
> >> [    0.312884]  ? __asan_memcpy+0x3c/0x60
> >> [    0.312886]  ? set_intr_gate+0x10c/0x150
> >> [    0.312888]  set_memory_ro+0x76/0xa0
> >> [    0.312889]  ? __pfx_set_memory_ro+0x10/0x10
> >> [    0.312891]  idt_setup_apic_and_irq_gates+0x2c1/0x390
> >>
> >> and more.
> > Ok, it's not the only place. Got your point.
> >
> >> off topic -  if we were to handle only alloc_page_ext() specifically,
> >> what would be the most straightforward
> >>
> >> solution in your mind? I'd really appreciate your insight.
> > I was thinking if it's the only special case maybe we can handle it
> > somehow differently, like we do when we allocate obj_ext vectors for
> > slabs using __GFP_NO_OBJ_EXT. I haven't found a good solution yet but
> > since it's not a special case we would not be able to use it even if I
> > came up with something...
> > I think your way is the most straight-forward but please try my
> > suggestion to see if we can avoid extra overhead.
> > Thanks,
> > Suren.
>

Hi Hao,

> Hi Suren
>
> Thank you for your feedback. After re-examining this issue,
>
> I realize my previous focus was misplaced.
>
> Upon deeper consideration, I understand that this is not merely a bug,
>
> but rather a warning that indicates a gap in our memory profiling mechanism.
>
> Specifically, the current implementation appears to be missing memory
> allocation
>
> tracking during the period between the buddy system allocation and page_ext
>
> initialization.
>
> This profiling gap means we may not be capturing all relevant memory
> allocation
>
> events during this critical transition phase.

Correct, this limitation exists because memory profiling relies on
some kernel facilities (page_ext, objj_ext) which might not be
initialized yet at the time of allocation.

>
> My approach is to dynamically allocate codetag_ref when get_page_tag_ref
> fails,
>
> and maintain a linked list to track all buddy system allocations that
> occur prior to page_ext initialization.
>
>   However, this introduces performance concerns:
>
> 1. Free Path Overhead: When freeing these pages, we would need to
> traverse the entire linked list to locate
>
>       the corresponding codetag_ref, resulting in O(n) lookup complexity
> per free operation.
>
> 2. Initialization Overhead: During init_page_alloc_tagging, iterating
> through the linked list to assign codetag_ref to
>
>       page_ext would introduce additional traversal cost.
>
> If the number of pages is substantial, this could incur significant
> overhead. What are your thoughts on this? I look forward to your
> suggestions.

My thinking is that these early allocations comprise a small portion
of overall memory consumed by the system. So, instead of trying to
record and handle them in some alternative way, we just accept that
some counters might not be exactly accurate and ignore those early
allocations. See how the early slab allocations are marked with the
CODETAG_FLAG_INACCURATE flag and later reported as inaccurate. I think
that's an acceptable alternative to introducing extra complexity and
performance overhead. IOW, the benefits of accounting for these early
allocations are low compared to the effort required to account for
them. Unless you found a simple and performant way to do that...
I think your earlier patch can effectively detect these early
allocations and suppress the warnings. We should also mark these
allocations with CODETAG_FLAG_INACCURATE.
Thanks,
Suren.

>
>
> Thanks
>
> Hao
>
> >
> >> Thanks.
> >>
> >>
> >>>>>> If the slab cache has no free objects, it falls back
> >>>>>> to the buddy allocator to allocate memory. However, at this point page_ext
> >>>>>> is not yet fully initialized, so these newly allocated pages have no
> >>>>>> codetag set. These pages may later be reclaimed by KASAN,which causes
> >>>>>> the warning to trigger when they are freed because their codetag ref is
> >>>>>> still empty.
> >>>>>>
> >>>>>> Use a global array to track pages allocated before page_ext is fully
> >>>>>> initialized, similar to how kmemleak tracks early allocations.
> >>>>>> When page_ext initialization completes, set their codetag
> >>>>>> to empty to avoid warnings when they are freed later.
> >>>>>>
> >>>>>> ...
> >>>>>>
> >>>>>> --- a/include/linux/alloc_tag.h
> >>>>>> +++ b/include/linux/alloc_tag.h
> >>>>>> @@ -74,6 +74,9 @@ static inline void set_codetag_empty(union codetag_ref *ref)
> >>>>>>
> >>>>>>    #ifdef CONFIG_MEM_ALLOC_PROFILING
> >>>>>>
> >>>>>> +bool mem_profiling_is_available(void);
> >>>>>> +void alloc_tag_add_early_pfn(unsigned long pfn);
> >>>>>> +
> >>>>>>    #define ALLOC_TAG_SECTION_NAME       "alloc_tags"
> >>>>>>
> >>>>>>    struct codetag_bytes {
> >>>>>> diff --git a/lib/alloc_tag.c b/lib/alloc_tag.c
> >>>>>> index 58991ab09d84..a5bf4e72c154 100644
> >>>>>> --- a/lib/alloc_tag.c
> >>>>>> +++ b/lib/alloc_tag.c
> >>>>>> @@ -6,6 +6,7 @@
> >>>>>>    #include <linux/kallsyms.h>
> >>>>>>    #include <linux/module.h>
> >>>>>>    #include <linux/page_ext.h>
> >>>>>> +#include <linux/pgalloc_tag.h>
> >>>>>>    #include <linux/proc_fs.h>
> >>>>>>    #include <linux/seq_buf.h>
> >>>>>>    #include <linux/seq_file.h>
> >>>>>> @@ -26,6 +27,82 @@ static bool mem_profiling_support;
> >>>>>>
> >>>>>>    static struct codetag_type *alloc_tag_cttype;
> >>>>>>
> >>>>>> +/*
> >>>>>> + * State of the alloc_tag
> >>>>>> + *
> >>>>>> + * This is used to describe the states of the alloc_tag during bootup.
> >>>>>> + *
> >>>>>> + * When we need to allocate page_ext to store codetag, we face an
> >>>>>> + * initialization timing problem:
> >>>>>> + *
> >>>>>> + * Due to initialization order, pages may be allocated via buddy system
> >>>>>> + * before page_ext is fully allocated and initialized. Although these
> >>>>>> + * pages call the allocation hooks, the codetag will not be set because
> >>>>>> + * page_ext is not yet available.
> >>>>>> + *
> >>>>>> + * When these pages are later free to the buddy system, it triggers
> >>>>>> + * warnings because their codetag is actually empty if
> >>>>>> + * CONFIG_MEM_ALLOC_PROFILING_DEBUG is enabled.
> >>>>>> + *
> >>>>>> + * Additionally, in this situation, we cannot record detailed allocation
> >>>>>> + * information for these pages.
> >>>>>> + */
> >>>>>> +enum mem_profiling_state {
> >>>>>> +     DOWN,                   /* No mem_profiling functionality yet */
> >>>>>> +     UP                      /* Everything is working */
> >>>>>> +};
> >>>>>> +
> >>>>>> +static enum mem_profiling_state mem_profiling_state = DOWN;
> >>>>>> +
> >>>>>> +bool mem_profiling_is_available(void)
> >>>>>> +{
> >>>>>> +     return mem_profiling_state == UP;
> >>>>>> +}
> >>>>>> +
> >>>>>> +#ifdef CONFIG_MEM_ALLOC_PROFILING_DEBUG
> >>>>>> +
> >>>>>> +#define EARLY_ALLOC_PFN_MAX          256
> >>>>>> +
> >>>>>> +static unsigned long early_pfns[EARLY_ALLOC_PFN_MAX];
> >>>>> It's unfortunate that this isn't __initdata.
> >>>>>
> >>>>>> +static unsigned int early_pfn_count;
> >>>>>> +static DEFINE_SPINLOCK(early_pfn_lock);
> >>>>>> +
> >>>>>>
> >>>>>> ...
> >>>>>>
> >>>>>> --- a/mm/page_alloc.c
> >>>>>> +++ b/mm/page_alloc.c
> >>>>>> @@ -1293,6 +1293,13 @@ void __pgalloc_tag_add(struct page *page, struct task_struct *task,
> >>>>>>                 alloc_tag_add(&ref, task->alloc_tag, PAGE_SIZE * nr);
> >>>>>>                 update_page_tag_ref(handle, &ref);
> >>>>>>                 put_page_tag_ref(handle);
> >>>>>> +     } else {
> >>>> This branch can be marked as "unlikely".
> >>>>
> >>>>>> +             /*
> >>>>>> +              * page_ext is not available yet, record the pfn so we can
> >>>>>> +              * clear the tag ref later when page_ext is initialized.
> >>>>>> +              */
> >>>>>> +             if (!mem_profiling_is_available())
> >>>>>> +                     alloc_tag_add_early_pfn(page_to_pfn(page));
> >>>>>>         }
> >>>>>>    }
> >>>>> All because of this, I believe.  Is this fixable?
> >>>>>
> >>>>> If we take that `else', we know we're running in __init code, yes?  I
> >>>>> don't see how `__init pgalloc_tag_add_early()' could be made to work.
> >>>>> hrm.  Something clever, please.
> >>>> We can have a pointer to a function that is initialized to point to
> >>>> alloc_tag_add_early_pfn, which is defined as __init and uses
> >>>> early_pfns which now can be defined as __initdata. After
> >>>> clear_early_alloc_pfn_tag_refs() is done we reset that pointer to
> >>>> NULL. __pgalloc_tag_add() instead of calling alloc_tag_add_early_pfn()
> >>>> directly checks that pointer and if it's not NULL then calls the
> >>>> function that it points to. This way __pgalloc_tag_add() which is not
> >>>> an __init function will be invoking alloc_tag_add_early_pfn() __init
> >>>> function only until we are done with initialization. I haven't tried
> >>>> this but I think that should work. This also eliminates the need for
> >>>> mem_profiling_state variable since we can use this function pointer
> >>>> instead.
> >>>>
> >>>>