[PATCH v6 0/2] kexec: keep the next kernel off hardware-poisoned pages

[PATCH v6 0/2] kexec: keep the next kernel off hardware-poisoned pages

[Breno Leitao]

Memory failures are common enough on large fleets that kexec regularly
lands the next kernel on a frame the memory failure subsystem has already
marked bad. Patch 2 teaches the segment placement to avoid those frames.

Patch 1 is a prerequisite. locate_mem_hole_top_down() walks candidates
downwards without ever checking that the subtraction stays above zero, so
the walk can wrap and report success with a destination outside of RAM.
Patch 2 adds one more downward step to that loop, so the bug is fixed
first and both patches rely on the same bail-out.

Signed-off-by: Breno Leitao <leitao@debian.org>
---
Changes in v6:
- Split the pre-existing top-down underflow out into its own patch, and
  drop the "if (poison < kbuf->memsz)" guard from the hwpoison hunk now
  that the loop bail-out covers it. (Mike Rapoport, Sashiko)
- Reword the changelog: the MCE comes from reading the poison back, not
  from the relocation copy writing it, and the placement paragraphs read
  better split up. (Mike Rapoport)
- Move cond_resched() after the struct page dereference, so the scan does
  not yield between pfn_to_online_page() and is_page_hwpoison().
  (Pratyush Yadav, Sashiko)
- Keep cond_resched() per pfn rather than batching it. (Kiryl Shutsemau,
  Rik van Riel)
- Link to v5: https://patch.msgid.link/20260810-kexec_posioned-v5-1-95e1b5e2e656@debian.org

Changes in v5:
- Return -EHWPOISON instead of -EADDRNOTAVAIL
- Leverage is_page_hwpoison() instead of per-page check
- Link to v4: https://patch.msgid.link/20260807-kexec_posioned-v4-1-70d57f14625d@debian.org

Changes in v4:
- Anchor the top-down hole finder on the first poisoned page in the
  window and the bottom-up one on the last, so each jumps clear of the
  poison in one step. New range_first_hwpoison(). (Kiryl Shutsemau)
- Count a poisoned hugetlb folio in full: the flag lives on the folio,
  not on the subpages, so the per-pfn scan missed poisoned tail pages.
  (Kiryl Shutsemau)
- Link to v3: https://patch.msgid.link/20260803-kexec_posioned-v3-1-83aa6ede0351@debian.org

Changes in v3:
- Return the address of the last poisoned page in the range, or
  PHYS_ADDR_MAX when it is clean, instead of a bool plus an output
  parameter. Renamed to range_last_hwpoison(). (Pratyush Yadav)
- Add cond_resched() to the scan loop, as a segment can span half of
  memory. (Sashiko)
- Link to v2: https://patch.msgid.link/20260730-kexec_posioned-v2-1-f92d18551f64@debian.org

Changes in v2:
- Change from pfn_to_page() to pfn_to_online_page(). (Miaohe Lin)
- Return the poisoned address once we find a hit, to avoid the O(n^2)
  rescan. (Sashiko)
- Link to v1: https://patch.msgid.link/20260728-kexec_posioned-v1-1-160c81d180fe@debian.org

To: Andrew Morton <akpm@linux-foundation.org>
To: David Hildenbrand <david@kernel.org>
To: Lorenzo Stoakes <ljs@kernel.org>
To: "Liam R. Howlett" <liam@infradead.org>
To: Vlastimil Babka <vbabka@kernel.org>
To: Mike Rapoport <rppt@kernel.org>
To: Suren Baghdasaryan <surenb@google.com>
To: Michal Hocko <mhocko@suse.com>
To: Baoquan He <baoquan.he@linux.dev>
To: Pasha Tatashin <pasha.tatashin@soleen.com>
To: Pratyush Yadav <pratyush@kernel.org>
To: Miaohe Lin <linmiaohe@huawei.com>
To: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: linux-mm@kvack.org
Cc: linux-kernel@vger.kernel.org
Cc: kexec@lists.infradead.org
Cc: rmikey@meta.com
Cc: riel@surriel.com

---
Breno Leitao (2):
      kexec_file: stop the top-down search before it underflows
      kexec: keep the next kernel off hardware-poisoned pages

 include/linux/mm.h  | 14 ++++++++++++++
 kernel/kexec_core.c | 10 ++++++++++
 kernel/kexec_file.c | 20 +++++++++++++++++++-
 mm/memory-failure.c | 40 ++++++++++++++++++++++++++++++++++++++++
 4 files changed, 83 insertions(+), 1 deletion(-)
---
base-commit: c5e32e86ca02b003f86e095d379b38148999293d
change-id: 20260727-kexec_posioned-72bb0a4143a0

Best regards,
--  
Breno Leitao <leitao@debian.org>

[PATCH v6 1/2] kexec_file: stop the top-down search before it underflows

[Breno Leitao]

locate_mem_hole_top_down() walks candidates downwards by subtracting
PAGE_SIZE whenever the window conflicts with an existing segment or with
an architecture exclude range.

Nothing stops that subtraction at zero, so a search that reaches the
bottom of the address space wraps temp_start around and continues.

The walk starts inside the range being scanned and only moves down, so
bail out once a candidate ends up above end. That covers every step in
the loop rather than the subtractions alone, and it matches
locate_mem_hole_bottom_up(), which already bounds its candidate on both
sides.

This is a better check than subtracting with check_sub_overflow(), given
that we would have 3 subtractions in this block, and this single fix
would take care of them all (instead of three check_sub_overflow()).

Fixes: cb1052581e2b ("kexec: implementation of new syscall kexec_file_load")
Signed-off-by: Breno Leitao <leitao@debian.org>
---
 kernel/kexec_file.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index 59fb9d71e9d86..01a64d98fbcd7 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -484,7 +484,9 @@ static int locate_mem_hole_top_down(unsigned long start, unsigned long end,
 		/* align down start */
 		temp_start = ALIGN_DOWN(temp_start, kbuf->buf_align);
 
-		if (temp_start < start || temp_start < kbuf->buf_min)
+		/* A candidate above the range means the walk wrapped around */
+		if (temp_start < start || temp_start < kbuf->buf_min ||
+		    temp_start > end)
 			return 0;
 
 		temp_end = temp_start + kbuf->memsz - 1;

-- 
2.53.0-Meta

Re: [PATCH v6 1/2] kexec_file: stop the top-down search before it underflows

[Bradley Morgan]

Hi Breno,

> Nothing stops that subtraction at zero, so a search that reaches the
> bottom of the address space wraps temp_start around and continues.

ack, and the wrapped value sails through both existing checks since
it is not below start or buf_min, misses every segment and exclude
range, and the loop breaks with kbuf->mem pointing outside of RAM.

since the walk only moves down... temp_start > end can only be true after
a wrap, so the new check has no false positives. It is also what lets
patch 2 drop the poison < memsz guard.


Please absolutely add:


Reviewed-by: Bradley Morgan <include@grrlz.net>

Thanks!

[PATCH v6 2/2] kexec: keep the next kernel off hardware-poisoned pages

[Breno Leitao]

Memory failures (such as unrecoverable ECCs errors) are getting more and
more common. The kernel knows how to handle it while running, marking it
as poisoned (and SIGBUS user tasks).

Poisoned memory is removed from the buddy allocator, but, not from
other places. A current problem is that kexec will load new kernel
on top of a bad/poisoned memory, which is undesirable.

If the next kernel's image, initrd or purgatory lands on a poisoned
frame, the relocation copy puts it on memory that is known bad. The
error happens on the first read from a bad page, and that is what we
want to avoid.

Skip hardware-poisoned frames that were detected by the memory failure
subsystem earlier when placing kexec segments.

To do so, add a helper that reports the first or the last poisoned page
in a range: memory is walked top-down by locate_mem_hole_top_down() and
bottom-up by locate_mem_hole_bottom_up(), so each direction needs a
different answer to stay clear of the poison.

kexec_load() gets its destinations from userspace and cannot move them,
so there sanity_check_segment_list() just rejects a segment that happens
to have a poisoned page.

is_page_hwpoison() also covers hugetlb, so a poisoned hugetlb folio is
skipped as a whole.

Suggested-by: Kiryl Shutsemau <kas@kernel.org>
Signed-off-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Reviewed-by: Pratyush Yadav <pratyush@kernel.org>
Reviewed-by: Bradley Morgan <include@grrlz.net>
---
 include/linux/mm.h  | 14 ++++++++++++++
 kernel/kexec_core.c | 10 ++++++++++
 kernel/kexec_file.c | 16 ++++++++++++++++
 mm/memory-failure.c | 40 ++++++++++++++++++++++++++++++++++++++++
 4 files changed, 80 insertions(+)

diff --git a/include/linux/mm.h b/include/linux/mm.h
index 7fabe6c66b4b7..41b923901b193 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -5192,6 +5192,8 @@ extern const struct attribute_group memory_failure_attr_group;
 extern void memory_failure_queue(unsigned long pfn, int flags);
 void num_poisoned_pages_inc(unsigned long pfn);
 void num_poisoned_pages_sub(unsigned long pfn, long i);
+phys_addr_t range_first_hwpoison(phys_addr_t start, unsigned long size);
+phys_addr_t range_last_hwpoison(phys_addr_t start, unsigned long size);
 #else
 static inline void memory_failure_queue(unsigned long pfn, int flags)
 {
@@ -5204,6 +5206,18 @@ static inline void num_poisoned_pages_inc(unsigned long pfn)
 static inline void num_poisoned_pages_sub(unsigned long pfn, long i)
 {
 }
+
+static inline phys_addr_t range_first_hwpoison(phys_addr_t start,
+					       unsigned long size)
+{
+	return PHYS_ADDR_MAX;
+}
+
+static inline phys_addr_t range_last_hwpoison(phys_addr_t start,
+					      unsigned long size)
+{
+	return PHYS_ADDR_MAX;
+}
 #endif
 
 #if defined(CONFIG_MEMORY_FAILURE) && defined(CONFIG_MEMORY_HOTPLUG)
diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
index dc770b9a6d053..7ee8c9f078f6b 100644
--- a/kernel/kexec_core.c
+++ b/kernel/kexec_core.c
@@ -212,6 +212,16 @@ int sanity_check_segment_list(struct kimage *image)
 	}
 #endif
 
+	/*
+	 * Reject destinations that land on hardware-poisoned memory: the
+	 * relocation copy would machine-check on the bad frame.
+	 */
+	for (i = 0; i < nr_segments; i++) {
+		if (range_first_hwpoison(image->segment[i].mem,
+					 image->segment[i].memsz) != PHYS_ADDR_MAX)
+			return -EHWPOISON;
+	}
+
 	/*
 	 * The destination addresses are searched from system RAM rather than
 	 * being allocated from the buddy allocator, so they are not guaranteed
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index 01a64d98fbcd7..8b0fc8a5d3c36 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -475,6 +475,7 @@ static int locate_mem_hole_top_down(unsigned long start, unsigned long end,
 {
 	struct kimage *image = kbuf->image;
 	unsigned long temp_start, temp_end;
+	phys_addr_t poison;
 
 	temp_end = min(end, kbuf->buf_max);
 	temp_start = temp_end - kbuf->memsz + 1;
@@ -506,6 +507,13 @@ static int locate_mem_hole_top_down(unsigned long start, unsigned long end,
 			continue;
 		}
 
+		poison = range_first_hwpoison(temp_start, kbuf->memsz);
+		if (poison != PHYS_ADDR_MAX) {
+			/* we hit a poisoned page */
+			temp_start = poison - kbuf->memsz;
+			continue;
+		}
+
 		/* We found a suitable memory range */
 		break;
 	} while (1);
@@ -522,6 +530,7 @@ static int locate_mem_hole_bottom_up(unsigned long start, unsigned long end,
 {
 	struct kimage *image = kbuf->image;
 	unsigned long temp_start, temp_end;
+	phys_addr_t poison;
 
 	temp_start = max(start, kbuf->buf_min);
 
@@ -548,6 +557,13 @@ static int locate_mem_hole_bottom_up(unsigned long start, unsigned long end,
 			continue;
 		}
 
+		poison = range_last_hwpoison(temp_start, kbuf->memsz);
+		if (poison != PHYS_ADDR_MAX) {
+			/* we hit a poisoned page */
+			temp_start = poison + PAGE_SIZE;
+			continue;
+		}
+
 		/* We found a suitable memory range */
 		break;
 	} while (1);
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index a8b03e2920ba8..a2ca8df501cae 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -96,6 +96,46 @@ void num_poisoned_pages_sub(unsigned long pfn, long i)
 		memblk_nr_poison_sub(pfn, i);
 }
 
+/*
+ * Return the first or the last hardware-poisoned online page in [start,
+ * start + size), or PHYS_ADDR_MAX if the range is clean.
+ */
+static phys_addr_t range_hwpoison(phys_addr_t start, unsigned long size,
+				  bool first)
+{
+	phys_addr_t poison = PHYS_ADDR_MAX;
+	unsigned long pfn, end_pfn;
+
+	if (!size || !atomic_long_read(&num_poisoned_pages))
+		return poison;
+
+	end_pfn = PHYS_PFN(start + size - 1);
+	for (pfn = PHYS_PFN(start); pfn <= end_pfn; pfn++) {
+		struct page *page = pfn_to_online_page(pfn);
+
+		if (page && is_page_hwpoison(page)) {
+			if (first)
+				return PFN_PHYS(pfn);
+
+			poison = PFN_PHYS(pfn);
+		}
+
+		cond_resched();
+	}
+
+	return poison;
+}
+
+phys_addr_t range_first_hwpoison(phys_addr_t start, unsigned long size)
+{
+	return range_hwpoison(start, size, true);
+}
+
+phys_addr_t range_last_hwpoison(phys_addr_t start, unsigned long size)
+{
+	return range_hwpoison(start, size, false);
+}
+
 /**
  * MF_ATTR_RO - Create sysfs entry for each memory failure statistics.
  * @_name: name of the file in the per NUMA sysfs directory.

-- 
2.53.0-Meta

Re: [PATCH v6 0/2] kexec: keep the next kernel off hardware-poisoned pages

[Bradley Morgan]

On 12 August 2026 12:31:50 BST, Breno Leitao <leitao@debian.org> wrote:
>Memory failures are common enough on large fleets that kexec regularly
>lands the next kernel on a frame the memory failure subsystem has already
>marked bad. Patch 2 teaches the segment placement to avoid those frames.
>
>Patch 1 is a prerequisite. locate_mem_hole_top_down() walks candidates
>downwards without ever checking that the subtraction stays above zero, so
>the walk can wrap and report success with a destination outside of RAM.
>Patch 2 adds one more downward step to that loop, so the bug is fixed
>first and both patches rely on the same bail-out.
>
>Signed-off-by: Breno Leitao <leitao@debian.org>
>---
>Changes in v6:
>- Split the pre-existing top-down underflow out into its own patch, and
>  drop the "if (poison < kbuf->memsz)" guard from the hwpoison hunk now
>  that the loop bail-out covers it. (Mike Rapoport, Sashiko)
>- Reword the changelog: the MCE comes from reading the poison back, not
>  from the relocation copy writing it, and the placement paragraphs read
>  better split up. (Mike Rapoport)
>- Move cond_resched() after the struct page dereference, so the scan does
>  not yield between pfn_to_online_page() and is_page_hwpoison().
>  (Pratyush Yadav, Sashiko)
>- Keep cond_resched() per pfn rather than batching it. (Kiryl Shutsemau,
>  Rik van Riel)
>- Link to v5: https://patch.msgid.link/20260810-kexec_posioned-v5-1-95e1b5e2e656@debian.org

This is a two patch series with one patch, why?


>
>Changes in v5:
>- Return -EHWPOISON instead of -EADDRNOTAVAIL
>- Leverage is_page_hwpoison() instead of per-page check
>- Link to v4: https://patch.msgid.link/20260807-kexec_posioned-v4-1-70d57f14625d@debian.org
>
>Changes in v4:
>- Anchor the top-down hole finder on the first poisoned page in the
>  window and the bottom-up one on the last, so each jumps clear of the
>  poison in one step. New range_first_hwpoison(). (Kiryl Shutsemau)
>- Count a poisoned hugetlb folio in full: the flag lives on the folio,
>  not on the subpages, so the per-pfn scan missed poisoned tail pages.
>  (Kiryl Shutsemau)
>- Link to v3: https://patch.msgid.link/20260803-kexec_posioned-v3-1-83aa6ede0351@debian.org
>
>Changes in v3:
>- Return the address of the last poisoned page in the range, or
>  PHYS_ADDR_MAX when it is clean, instead of a bool plus an output
>  parameter. Renamed to range_last_hwpoison(). (Pratyush Yadav)
>- Add cond_resched() to the scan loop, as a segment can span half of
>  memory. (Sashiko)
>- Link to v2: https://patch.msgid.link/20260730-kexec_posioned-v2-1-f92d18551f64@debian.org
>
>Changes in v2:
>- Change from pfn_to_page() to pfn_to_online_page(). (Miaohe Lin)
>- Return the poisoned address once we find a hit, to avoid the O(n^2)
>  rescan. (Sashiko)
>- Link to v1: https://patch.msgid.link/20260728-kexec_posioned-v1-1-160c81d180fe@debian.org
>
>To: Andrew Morton <akpm@linux-foundation.org>
>To: David Hildenbrand <david@kernel.org>
>To: Lorenzo Stoakes <ljs@kernel.org>
>To: "Liam R. Howlett" <liam@infradead.org>
>To: Vlastimil Babka <vbabka@kernel.org>
>To: Mike Rapoport <rppt@kernel.org>
>To: Suren Baghdasaryan <surenb@google.com>
>To: Michal Hocko <mhocko@suse.com>
>To: Baoquan He <baoquan.he@linux.dev>
>To: Pasha Tatashin <pasha.tatashin@soleen.com>
>To: Pratyush Yadav <pratyush@kernel.org>
>To: Miaohe Lin <linmiaohe@huawei.com>
>To: Naoya Horiguchi <nao.horiguchi@gmail.com>
>Cc: linux-mm@kvack.org
>Cc: linux-kernel@vger.kernel.org
>Cc: kexec@lists.infradead.org
>Cc: rmikey@meta.com
>Cc: riel@surriel.com
>
>---
>Breno Leitao (2):
>      kexec_file: stop the top-down search before it underflows
>      kexec: keep the next kernel off hardware-poisoned pages
>
> include/linux/mm.h  | 14 ++++++++++++++
> kernel/kexec_core.c | 10 ++++++++++
> kernel/kexec_file.c | 20 +++++++++++++++++++-
> mm/memory-failure.c | 40 ++++++++++++++++++++++++++++++++++++++++
> 4 files changed, 83 insertions(+), 1 deletion(-)
>---
>base-commit: c5e32e86ca02b003f86e095d379b38148999293d
>change-id: 20260727-kexec_posioned-72bb0a4143a0
>
>Best regards,
>--  
>Breno Leitao <leitao@debian.org>
>
>

Thanks!

Re: [PATCH v6 0/2] kexec: keep the next kernel off hardware-poisoned pages

[Breno Leitao]

Hello Bradley,

On Wed, Aug 12, 2026 at 12:36:59PM +0100, Bradley Morgan wrote:
> On 12 August 2026 12:31:50 BST, Breno Leitao <leitao@debian.org> wrote:
> >Changes in v6:
> >- Split the pre-existing top-down underflow out into its own patch, and
> >  drop the "if (poison < kbuf->memsz)" guard from the hwpoison hunk now
> >  that the loop bail-out covers it. (Mike Rapoport, Sashiko)

<snip>

> >- Link to v5: https://patch.msgid.link/20260810-kexec_posioned-v5-1-95e1b5e2e656@debian.org
> 
> This is a two patch series with one patch, why?

This is a patch series with _two_ patches, isn't it?

	[PATCH v6 1/2] kexec_file: stop the top-down search before it underflows
	[PATCH v6 2/2] kexec: keep the next kernel off hardware-poisoned pages

If you asking why it was split, we decided to split the fix into
a separate patch, and keep the "feature" in separate patch. The
discussion happened in

https://lore.kernel.org/all/anskyrEVUlnTVEgF@kernel.org/

Re: [PATCH v6 0/2] kexec: keep the next kernel off hardware-poisoned pages

[Bradley Morgan]

On 12 August 2026 13:07:49 BST, Breno Leitao <leitao@debian.org> wrote:
>Hello Bradley,
>
>On Wed, Aug 12, 2026 at 12:36:59PM +0100, Bradley Morgan wrote:
>> On 12 August 2026 12:31:50 BST, Breno Leitao <leitao@debian.org> wrote:
>> >Changes in v6:
>> >- Split the pre-existing top-down underflow out into its own patch, and
>> >  drop the "if (poison < kbuf->memsz)" guard from the hwpoison hunk now
>> >  that the loop bail-out covers it. (Mike Rapoport, Sashiko)
>
><snip>
>
>> >- Link to v5:
>https://patch.msgid.link/20260810-kexec_posioned-v5-1-95e1b5e2e656@debian.org
>> 
>> This is a two patch series with one patch, why?
>
>This is a patch series with _two_ patches, isn't it?
>
>	[PATCH v6 1/2] kexec_file: stop the top-down search before it underflows
>	[PATCH v6 2/2] kexec: keep the next kernel off hardware-poisoned pages
>
>If you asking why it was split, we decided to split the fix into
>a separate patch, and keep the "feature" in separate patch. The
>discussion happened in
>

I'm only CCed in 2/2 :(


>https://lore.kernel.org/all/anskyrEVUlnTVEgF@kernel.org/
>

Thanks!