From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-172.mta0.migadu.com (out-172.mta0.migadu.com [91.218.175.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AF1B538E126 for ; Mon, 6 Jul 2026 11:05:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783335932; cv=none; b=K672+NLo7EvgvVmHU7JujfIBUW87MGwLXa9KeRMe4jA62y8KNj6VvWnXgWmuBiUymahnSGj7r6B8nJwwT6bdm0J3XcCMMwaue+hH3aQk9tZpkJ127dnSe+vt+Y7uEah4Q29g7fIPmHaj4JNZNW+cBrzJu+SydfDCaoD9gO7fTBI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783335932; c=relaxed/simple; bh=t2G31hgBIJ/29qiDBvt8CD8go5dt9VH9EKuGK/hNmLw=; h=Content-Type:Mime-Version:Subject:From:In-Reply-To:Date:Cc: Message-Id:References:To; b=kdf4IVhjM7Dpq85tdVCvGwptlx30eHBU5zHtZeA18Z0f4AiBxqipn4qQQC8paenrHpPXBAU+bRMgG4z7Ah22X+bgPeC2lt1LyfB+pe5Xm2uOEmMCprKqDQlUNLfQXPc3CXN7eHAF3MnbIo+3dWo7YY+3QLJ01PdXNVZv2zQ+gH0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=VHL9KSSG; arc=none smtp.client-ip=91.218.175.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="VHL9KSSG" Content-Type: text/plain; charset=utf-8 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1783335928; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=70JWofOLlMgrve9aDAgHG0zmj2dWsVDmKKX/VA1fyUA=; b=VHL9KSSGqlxRYaGJQc9uy9oiC4xOSCeQUo/nl+CaMphFOPWNd+lQJukSEIALJfU39/njtD 8RLuOFpl7fzzo9dgm8IwummIQjaga+zPxFmOc/m/pSGd+HghXQrb6mhFAvSvUvMOFTzAMN 710fjORCfQjp3SJnNqGIg+QRTJFGbS8= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.600.51.1.1\)) Subject: Re: [PATCH v4 01/19] mm/hugetlb: Fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Muchun Song In-Reply-To: Date: Mon, 6 Jul 2026 19:04:50 +0800 Cc: Muchun Song , Oscar Salvador , David Hildenbrand , Andrew Morton , Madhavan Srinivasan , Michael Ellerman , Mike Rapoport , Lorenzo Stoakes , "Liam R . Howlett" , Vlastimil Babka , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Nicholas Piggin , Christophe Leroy , Ritesh Harjani , "Aneesh Kumar K . V" , linuxppc-dev@lists.ozlabs.org, Mike Kravetz Content-Transfer-Encoding: quoted-printable Message-Id: References: <20260612035903.2468601-1-songmuchun@bytedance.com> <20260612035903.2468601-2-songmuchun@bytedance.com> To: =?utf-8?B?TWljaGHFgiBDxYJhcGnFhHNraQ==?= X-Migadu-Flow: FLOW_OUT > On Jul 6, 2026, at 18:07, Micha=C5=82 C=C5=82api=C5=84ski = wrote: >=20 > On 6/12/26 5:58 AM, Muchun Song wrote: >> Commit 622026e87c40 ("mm/hugetlb: remove fake head pages") switched >> HVO to reuse per-zone shared tail pages from zone->vmemmap_tails[]. >> Those shared tail pages were initialized in hugetlb_vmemmap_init(), = but >> bootmem HugeTLB folios are prepared earlier from = gather_bootmem_prealloc(). >> With hugetlb_free_vmemmap=3Don, prep_and_add_bootmem_folios() can = access >> pageblock flags on bootmem HugeTLB pages whose mirrored tail struct = pages >> already point to the shared tail page. On CONFIG_DEBUG_VM kernels, >> get_pfnblock_bitmap_bitidx() then dereferences the = still-uninitialized >> shared tail page and can panic during boot. >> Initialize zone->vmemmap_tails[] from gather_bootmem_prealloc(), = before >> bootmem HugeTLB folios are processed, and drop the later = initialization >> from hugetlb_vmemmap_init(). >> This bug only affects CONFIG_DEBUG_VM kernels, where the relevant >> assertion is evaluated. >> Fixes: 622026e87c40 ("mm/hugetlb: remove fake head pages") >> Signed-off-by: Muchun Song >> Acked-by: Oscar Salvador >> --- >> mm/hugetlb.c | 25 +++++++++++++++++++++++++ >> mm/hugetlb_vmemmap.c | 17 ----------------- >> mm/sparse-vmemmap.c | 2 +- >> 3 files changed, 26 insertions(+), 18 deletions(-) >> diff --git a/mm/hugetlb.c b/mm/hugetlb.c >> index 571212b80835..cd55524c7e30 100644 >> --- a/mm/hugetlb.c >> +++ b/mm/hugetlb.c >> @@ -3365,6 +3365,31 @@ static void __init = gather_bootmem_prealloc(void) >> .max_threads =3D num_node_state(N_MEMORY), >> .numa_aware =3D true, >> }; >> +#ifdef CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP >> + struct zone *zone; >> + >> + for_each_zone(zone) { >> + for (int i =3D 0; i < NR_VMEMMAP_TAILS; i++) { >> + struct page *tail, *p; >> + unsigned int order; >> + >> + tail =3D zone->vmemmap_tails[i]; >> + if (!tail) >> + continue; >> + >> + order =3D i + VMEMMAP_TAIL_MIN_ORDER; >> + p =3D page_to_virt(tail); >> + /* >> + * prep_and_add_bootmem_folios() can access pageblock >> + * flags on bootmem HugeTLB pages, so initialize the >> + * shared tail struct pages here before bootmem folios >> + * start using them. >> + */ >> + for (int j =3D 0; j < PAGE_SIZE / sizeof(struct page); j++) >> + init_compound_tail(p + j, NULL, order, zone); >> + } >> + } >> +#endif >=20 > I think it would be better if this was located in mm/hugetlb_vmemmap.c = as a separate function. This is actually just temporary. I already have another patch [1] that completely removes this code later on. So, to avoid having to update the entire patchset unnecessarily, I figured it's best to just leave it as is for now, as it's not a major issue.. [1] = https://lore.kernel.org/all/20260702093821.2740183-10-songmuchun@bytedance= .com/ >=20 >> padata_do_multithreaded(&job); >> } >> diff --git a/mm/hugetlb_vmemmap.c b/mm/hugetlb_vmemmap.c >> index 133b46dfb09f..c713c0d2593a 100644 >> --- a/mm/hugetlb_vmemmap.c >> +++ b/mm/hugetlb_vmemmap.c >> @@ -870,27 +870,10 @@ static const struct ctl_table = hugetlb_vmemmap_sysctls[] =3D { >> static int __init hugetlb_vmemmap_init(void) >> { >> const struct hstate *h; >> - struct zone *zone; >> /* HUGETLB_VMEMMAP_RESERVE_SIZE should cover all used struct = pages */ >> BUILD_BUG_ON(__NR_USED_SUBPAGE > HUGETLB_VMEMMAP_RESERVE_PAGES); >> - for_each_zone(zone) { >> - for (int i =3D 0; i < NR_VMEMMAP_TAILS; i++) { >> - struct page *tail, *p; >> - unsigned int order; >> - >> - tail =3D zone->vmemmap_tails[i]; >> - if (!tail) >> - continue; >> - >> - order =3D i + VMEMMAP_TAIL_MIN_ORDER; >> - p =3D page_to_virt(tail); >> - for (int j =3D 0; j < PAGE_SIZE / sizeof(struct page); j++) >> - init_compound_tail(p + j, NULL, order, zone); >> - } >> - } >> - >> for_each_hstate(h) { >> if (hugetlb_vmemmap_optimizable(h)) { >> register_sysctl_init("vm", hugetlb_vmemmap_sysctls); >> diff --git a/mm/sparse-vmemmap.c b/mm/sparse-vmemmap.c >> index 99e2be39671b..bb23fb3077a3 100644 >> --- a/mm/sparse-vmemmap.c >> +++ b/mm/sparse-vmemmap.c >> @@ -342,7 +342,7 @@ static __meminit struct page = *vmemmap_get_tail(unsigned int order, struct zone * >> * >> * Any initialization done here will be overwritten by = memmap_init(). >> * >> - * hugetlb_vmemmap_init() will take care of initialization after >> + * gather_bootmem_prealloc() will take care of initialization after >> * memmap_init(). >> */ >> =20 >=20 > It gets the job done. >=20 > Tested-by: Michal Clapinski > Reviewed-by: Michal Clapinski Really thanks for your test. Muchun, Thanks.