Re: [PATCH] mm/mm_init: fix out-of-range first_deferred_pfn

["Graf (AWS), Alexander" <graf@amazon.de>]

On 06.08.26 07:47, Mike Rapoport wrote:
> Hi Alex,
>
> On Wed, Aug 05, 2026 at 10:44:21PM +0000, Alexander Graf wrote:
>> deferred_grow_zone() initializes deferred struct pages a section at a
>> time until the allocation that called into it can be satisfied, and
>> records where to resume in pgdat->first_deferred_pfn.  Reserve most of
>> the top zone early (a large CMA reservation is the easy way) and a single
>> early allocation has to walk the whole zone instead of stopping in its
>> first free section.  If that zone does not end on a section boundary, the
>> pgdatinit kthread then dies:
>>
>>    kernel BUG at mm/mm_init.c:2131!
>>    Oops: invalid opcode: 0000 [#1] SMP NOPTI
>>    CPU: 3 UID: 0 PID: 36 Comm: pgdatinit0 Not tainted 7.2.0-rc6 #1
>>    RIP: 0010:deferred_init_memmap+0x1b8/0x1c0
>>    RAX: 0000000000236000 R13: 0000000000238000
>>    Call Trace:
>>     kthread+0xdf/0x120
>>     ret_from_fork+0x187/0x250
>>
>> RAX is pgdat_end_pfn(), R13 the pfn that was stored.  The loop advances
>> spfn in whole PAGES_PER_SECTION steps and only tests it before entering
>> an iteration, so once the walk reaches the end of a zone that ends
>> mid-section the escaping spfn is SECTION_ALIGN_UP(zone_end_pfn()).
>> Commit 3acb913c9d5b ("mm/mm_init: use deferred_init_memmap_chunk() in
>> deferred_grow_zone()") dropped the clamp that used to prevent that: epfn
>> came from __next_mem_pfn_range_in_zone(), since removed, which capped it
>> with min(zone_end_pfn(zone), epfn), so spfn could reach zone_end_pfn but
>> never pass it.  The assert is fatal either way, panicking under
>> panic_on_oops and otherwise leaving page_alloc_init_late() waiting
>> forever for a completion the dead kthread never reports.
>>
>> Store ULONG_MAX once spfn has left the zone.  Nothing is left
>> uninitialized: the loop covers a single gap-free interval, and because it
>> only enters with spfn < zone_end_pfn() the escaping value is exactly
>> SECTION_ALIGN_UP(zone_end_pfn()), which is the last_pfn that
>> deferred_init_memmap() would have used for the same pfn range.  A zone
>> that does end section-aligned now takes this path too and loses its
>> zero-work padata job along with that node's pr_info() and the WARN_ON()
>> on the next zone.
>>
>> To reproduce with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y and CONFIG_CMA=y:
>>
>>    qemu-system-x86_64 -enable-kvm -m 8032M -kernel bzImage \
>>        -append "nokaslr cma=4768M@0x100000000"
> The only two paragraphs I understood is this and the BUG splat ;-P
>
> Can we please have a lot more of human touch on the changelog?


Fair callout. The patch description is truly awful :(. Please excuse the 
slop. I wanted to send this out quickly before it keeps collecting dust :).

The problem is that with CONFIG_DEFERRED_STRUCT_PAGE_INIT enabled, we 
undefer some struct page ranges early in boot in deferred_grow_zone(). 
With a large CMA allocation in place, the early allocation we can 
satisfy may not span the full desired allocation and we end up 
undeferring all available RAM and still not satisfy the fully targeted 
allocation. That is perfectly fine: The function accounts for that case 
and leaves it to the caller to determine whether it now has sufficient 
available memory.

However, the function *also* remembers where deferred allocation starts 
next (pgdat->first_deferred_pfn). And it does so based on 
PAGES_PER_SECTION (128M) chunks. If the node's RAM end is not 128M 
aligned and we undeferred everything, then that "next" points past end 
of the node's RAM end.

When later deferred_init_memmap() tries to pick up from 
first_deferred_pfn, it runs into a BUG_ON because it expects the pfn to 
be within its node's RAM range. The canary for "everything is already 
initialized" is ULONG_MAX.

Hence this patch modifies the check in deferred_grow_zone() to already 
properly detect end of RAM. Instead of assuming that there is always 
more deferral available, we cap it at end of zone (which is equivalent 
to end of this node's end of RAM).


Let me send a v2 with the description above.

Alex