Re: [PATCH v2 2/2] mm/hugetlb: optimize bootmem hugepage tail vmemmap init

[Mike Rapoport <rppt@kernel.org>]

Hi,
On Wed, Nov 11, 2026 at 01:28:50PM +0800, Muchun Song wrote:
> 
> On 2026/11/11 11:14, Li Zhe wrote:
> > On 11/10/26 9:35 PM, sashiko-bot@kernel.org wrote:
> > > Thank you for your contribution! Sashiko AI review found 1 potential
> > > issue to consider:
> > > - [High] mm/hugetlb: out-of-bounds write in
> > >     hugetlb_folio_init_tail_vmemmap()
> > > --
> > > 
> > > commit 5be89b38412d58045fd600596787f54c7559d32c
> > > Author: Li Zhe <lizhe.67@bytedance.com>
> > > 
> > > mm/hugetlb: optimize bootmem hugepage tail vmemmap init
> > > 
> > > This commit optimizes bootmem hugepage tail struct page initialization by
> > > seeding a template from the first tail page and initializing the remaining
> > > tail pages via memmap_init_page_from_template().
> > > 
> > > > diff --git a/mm/hugetlb.c b/mm/hugetlb.c
> > > > index cb2de24affdc4..6ae5d2679e3aa 100644
> > > > --- a/mm/hugetlb.c
> > > > +++ b/mm/hugetlb.c
> > > > @@ -3239,6 +3239,7 @@ static void __init hugetlb_folio_init_tail_vmemmap(struct folio *folio,
> > > >    	enum zone_type zone = folio_zonenum(folio);
> > > >    	int nid = folio_nid(folio);
> > > >    	struct page *page = folio_page(folio, start_page_number);
> > > > +	struct page template;
> > > >    	unsigned long head_pfn = folio_pfn(folio);
> > > >    	unsigned long pfn, end_pfn = head_pfn + end_page_number;
> > > >    	unsigned int order = huge_page_order(h);
> > > > @@ -3247,11 +3248,20 @@ static void __init hugetlb_folio_init_tail_vmemmap(struct folio *folio,
> > > >    	 * As we marked all tail pages with memblock_reserved_mark_noinit(),
> > > >    	 * we must initialize them ourselves here.
> > > >    	 */
> > > > -	for (pfn = head_pfn + start_page_number; pfn < end_pfn; page++, pfn++) {
> > > > -		__init_single_page(page, pfn, zone, nid);
> > > > -		prep_compound_tail(page, &folio->page, order);
> > > > -		set_page_count(page, 0);
> > > > -	}
> > > > +	pfn = head_pfn + start_page_number;
> > > > +
> > > > +	/*
> > > > +	 * Seed a template from the first real tail page and refresh only
> > > > +	 * PFN-dependent fields before copying it.
> > > > +	 */
> > > > +	__init_single_page(page, pfn, zone, nid);
> > > > +	prep_compound_tail(page, &folio->page, order);
> > > > +	set_page_count(page, 0);
> > > > +	memcpy(&template, page, sizeof(template));
> > > > +
> > > > +	for (pfn++; pfn < end_pfn; pfn++)
> > > > +		memmap_init_page_from_template(pfn_to_page(pfn), pfn, zone,
> > > > +					       &template);
> > > [Severity: High]
> > > Can peeling the first iteration out of the loop overwrite the struct page
> > > past the end of folio when start_page_number >= end_page_number?
> > > 
> > > Previously, the loop was a no-op when pfn >= end_pfn.  Now, when HVO does
> > > not optimize a gigantic folio, prep_and_add_bootmem_folios() calls
> > > hugetlb_folio_init_tail_vmemmap(folio, h,
> > > VMEMMAP_OPTIMIZATION_NR_STRUCT_PAGES, pages_per_huge_page(h)) after
> > > gather_bootmem_prealloc_node() has already initialized the first
> > > VMEMMAP_OPTIMIZATION_NR_STRUCT_PAGES pages.
> > > 
> > > On configurations where a gigantic page has pages_per_huge_page(h) <=
> > > VMEMMAP_OPTIMIZATION_NR_STRUCT_PAGES (for example, powerpc
> > > mpc885_ads_defconfig with 16 KiB pages, MAX_PAGE_ORDER == 8, and 8 MiB
> > > gigantic hugepages of order 9, where both values are 512), this
> > > unconditionally initializes folio_page(folio, start_page_number) and marks
> > > the adjacent physical page's struct page as a compound tail of folio,
> > > corrupting mem_map.
> > 
> > Thanks for the report. This looks valid.
> > 
> > I will restore the empty-range check before seeding the template in v3.
> 
> Go ahead. I will end up removing this empty-range check here [1].
> 
> [1]
> https://lore.kernel.org/all/20261109095807.41547-8-songmuchun@bytedance.com/
 
Maybe you'll pick these two patches into your series since you anyway
change the same areas?

> > Thanks,
> > Zhe
> 

-- 
Sincerely yours,
Mike.