From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pdx-out-010.esa.us-west-2.outbound.mail-perimeter.amazon.com (pdx-out-010.esa.us-west-2.outbound.mail-perimeter.amazon.com [52.12.53.23]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 205713F3269 for ; Wed, 5 Aug 2026 22:44:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=52.12.53.23 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785969869; cv=none; b=Xm62/GNzK3ELUiyCKrGAPj4z+1+1mwjvZ8dp9n3ha3oC74WFAbpBgTzodeMeq2Z59B9D5nfNb+E0iaX6zBrVS+PaYLMFs8p6rdFoCplgm7MZxT9d+Y5OgbXx2deASZ/WEEvlN1GNIIxAbfWVeYZ7g50ezikSGvj68zXmIyZ1IQ0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785969869; c=relaxed/simple; bh=U3XvfWGGYzkXRynuk/KkOTYI9xXn5WbzhvFXmfjls1I=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=SONcRWk1q7fa5dqopddJKLxxr5T/DDtg4YdVBoFZ6egbvvFzE4uB0/TuIAMXIZ8UGqfAi02F3kd6WoaM2vOcTqqL82ug7zRc+fkdxCK1+avyKpSKWcA4IlMqD7PkiTkwDUADvui37ClQbBPKngWn0hioHELHZgucazQlMC+Xny0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amazon.com; spf=pass smtp.mailfrom=amazon.de; dkim=pass (2048-bit key) header.d=amazon.com header.i=@amazon.com header.b=iayv9nlO; arc=none smtp.client-ip=52.12.53.23 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amazon.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=amazon.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=amazon.com header.i=@amazon.com header.b="iayv9nlO" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazoncorp2; t=1785969868; x=1817505868; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=AqdTahBef6W+qz0ca7YQRCVOTpwpbcb4mth3B7j9O40=; b=iayv9nlOqm7nr/2gev9jT2XtFptwrTCyXT0Z3u74pmbf4TJ+qjE7Oihl 4AINOPGSi1jLIYSoNHBNIVrzCXwIYi2IzuU4tOitU0DZQNvtiAzMxvH3X Rngtz0mstfwWO+4+2cxJsSqc+Wn+ox8FKna5s3cvLf2fuwmY223liBP/z gMlPuc0OnDlxt5FJIOy92+PoVh08M1D0vyYAfMp6B4XgcxvC8lFruM3tl aDOFCapenj9E4yPrBXfVE30aZCSsdfS6oS6DsX/C/VYx9JUv91rUjSSgj BzIjQu5bH7sHsbvzBvkVgp+NFzSl/HKdWU8BLhVAyU/Jd+fX/IlTGKUAV g==; X-CSE-ConnectionGUID: 1GH5ZLG8SWGFpXXvU+ZrHA== X-CSE-MsgGUID: sNWm2TRFS42CX80lQetBSw== X-IronPort-AV: E=Sophos;i="6.25,207,1779148800"; d="scan'208";a="25093037" Received: from ip-10-5-6-203.us-west-2.compute.internal (HELO smtpout.naws.us-west-2.prod.farcaster.email.amazon.dev) ([10.5.6.203]) by internal-pdx-out-010.esa.us-west-2.outbound.mail-perimeter.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Aug 2026 22:44:25 +0000 Received: from EX19MTAUWB001.ant.amazon.com [205.251.233.104:7366] by smtpin.naws.us-west-2.prod.farcaster.email.amazon.dev [10.0.47.97:2525] with esmtp (Farcaster) id c8a4d6dc-23bf-4635-99f3-b313ad40cc71; Wed, 5 Aug 2026 22:44:24 +0000 (UTC) X-Farcaster-Flow-ID: c8a4d6dc-23bf-4635-99f3-b313ad40cc71 Received: from EX19D001UWA001.ant.amazon.com (10.13.138.214) by EX19MTAUWB001.ant.amazon.com (10.250.64.248) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.2562.45; Wed, 5 Aug 2026 22:44:24 +0000 Received: from ip-10-253-83-51.amazon.com (172.19.99.218) by EX19D001UWA001.ant.amazon.com (10.13.138.214) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.2562.45; Wed, 5 Aug 2026 22:44:23 +0000 From: Alexander Graf To: Andrew Morton , Mike Rapoport CC: David Hildenbrand , Wei Yang , , , Subject: [PATCH] mm/mm_init: fix out-of-range first_deferred_pfn Date: Wed, 5 Aug 2026 22:44:21 +0000 Message-ID: <20260805224421.15794-1-graf@amazon.com> X-Mailer: git-send-email 2.47.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: EX19D039UWA003.ant.amazon.com (10.13.139.49) To EX19D001UWA001.ant.amazon.com (10.13.138.214) deferred_grow_zone() initializes deferred struct pages a section at a time until the allocation that called into it can be satisfied, and records where to resume in pgdat->first_deferred_pfn. Reserve most of the top zone early (a large CMA reservation is the easy way) and a single early allocation has to walk the whole zone instead of stopping in its first free section. If that zone does not end on a section boundary, the pgdatinit kthread then dies: kernel BUG at mm/mm_init.c:2131! Oops: invalid opcode: 0000 [#1] SMP NOPTI CPU: 3 UID: 0 PID: 36 Comm: pgdatinit0 Not tainted 7.2.0-rc6 #1 RIP: 0010:deferred_init_memmap+0x1b8/0x1c0 RAX: 0000000000236000 R13: 0000000000238000 Call Trace: kthread+0xdf/0x120 ret_from_fork+0x187/0x250 RAX is pgdat_end_pfn(), R13 the pfn that was stored. The loop advances spfn in whole PAGES_PER_SECTION steps and only tests it before entering an iteration, so once the walk reaches the end of a zone that ends mid-section the escaping spfn is SECTION_ALIGN_UP(zone_end_pfn()). Commit 3acb913c9d5b ("mm/mm_init: use deferred_init_memmap_chunk() in deferred_grow_zone()") dropped the clamp that used to prevent that: epfn came from __next_mem_pfn_range_in_zone(), since removed, which capped it with min(zone_end_pfn(zone), epfn), so spfn could reach zone_end_pfn but never pass it. The assert is fatal either way, panicking under panic_on_oops and otherwise leaving page_alloc_init_late() waiting forever for a completion the dead kthread never reports. Store ULONG_MAX once spfn has left the zone. Nothing is left uninitialized: the loop covers a single gap-free interval, and because it only enters with spfn < zone_end_pfn() the escaping value is exactly SECTION_ALIGN_UP(zone_end_pfn()), which is the last_pfn that deferred_init_memmap() would have used for the same pfn range. A zone that does end section-aligned now takes this path too and loses its zero-work padata job along with that node's pr_info() and the WARN_ON() on the next zone. To reproduce with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y and CONFIG_CMA=y: qemu-system-x86_64 -enable-kvm -m 8032M -kernel bzImage \ -append "nokaslr cma=4768M@0x100000000" Top of RAM is then 0x235ffffff, so ZONE_NORMAL ends 96 MiB into its last section, and less than a section stays free above the reservation once the early memblock allocations are done. The walk therefore runs off the end of the zone and stores 0x238000. Sweeping that free remainder from 96M to 288M in 16M steps, an unpatched kernel dies on 7 of the 13 boots and a patched one on none. On an 8 GiB cloud instance that reserves most of its top zone for a memory pool, roughly one boot in three panicked before reaching userspace. Fixes: 3acb913c9d5b ("mm/mm_init: use deferred_init_memmap_chunk() in deferred_grow_zone()") Cc: stable@vger.kernel.org Assisted-by: Kiro:claude-opus-5 Signed-off-by: Alexander Graf --- Notes: Applies unchanged to 6.18.y, 6.19.y, 7.0.y and 7.1.y (checked against v6.18.39, v6.19.14, v7.0.14 and v7.1.4); the deferred_init_memmap_chunk() signature change in cbbbf7795fc3 sits outside the hunk context, so stable needs no separate backport. First seen on 6.18.y and 6.19-rc distribution kernels. There is no public report to link, hence no Closes: tag. mm/mm_init.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/mm/mm_init.c b/mm/mm_init.c index 498d62c4ece3..91177be58a00 100644 --- a/mm/mm_init.c +++ b/mm/mm_init.c @@ -2214,10 +2214,13 @@ bool __init deferred_grow_zone(struct zone *zone, unsigned int order) } /* - * There were no pages to initialize and free which means the zone's - * memory map is completely initialized. + * The loop only tests spfn before entering an iteration, so on exit it + * may point up to a section past the end of the zone. When it does, + * the rest of the zone has already been handed to + * deferred_init_memmap_chunk() and nothing is left to initialize. */ - pgdat->first_deferred_pfn = nr_pages ? spfn : ULONG_MAX; + pgdat->first_deferred_pfn = + spfn < zone_end_pfn(zone) ? spfn : ULONG_MAX; pgdat_resize_unlock(pgdat, &flags); base-commit: 0d839570765118029aa8bf4a95444c6a11aacf85 -- 2.47.1