From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 86D8744B693 for ; Tue, 30 Jun 2026 20:50:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782852618; cv=none; b=H6pY0i+yN5vLeyq2o+NMeEfxaxC9kXCL+7fVobJLLqIIciCBoJ2XElLY6lvRT6TSMq8K2ODzhEK9FKbM8/+dcu40XxcYBseJmzrpTpvDhSxm1I2aUMj8qTtpXwqdiCqG+0JMM/WXIWiTUWDsOr7mIuvMUbeDKZia0BV3FTDspQo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782852618; c=relaxed/simple; bh=grkIZJz7SEvwA1XziBNPEQwCCScInOfq4A7KBrlp8mU=; h=Date:To:From:Subject:Message-Id; b=UIUe0BlzlX8tjblQILTPDfl9S9MNj4lYzKkOgFTWAD4V7uY0fNbtpF7VDgb1qjN2Ebrw7Ry4Zdqw9taJjzXGmME58rXoGkdzntyZE8hNietsx0A1IU8IIYFleEHU4dMhUF28YXUaXcoZSpS6FhuXggnP/krfgM5RKCcDfjkmx8Q= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=EnGM/S3C; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="EnGM/S3C" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 26F301F000E9; Tue, 30 Jun 2026 20:50:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-foundation.org; s=korg; t=1782852617; bh=z2sUXSicFok02DqxshkXs+TvVwcmqLJKtm5j0snE4rA=; h=Date:To:From:Subject; b=EnGM/S3Cqodv1iNBLUVId0RGo2oScu5V8iBZJ5xk3I+DOk7T8Hq0hk515HUg1cTs6 yw/K9dy6bxliuhRNSqyCcTYVygunL/LinqsO2j/L0mYtd9ZZfl+RhrcKwM+lqHIC+Y 8oAvqH11e5/+jV6dWnvxIXdDl8Lnpx/owETu0bM0= Date: Tue, 30 Jun 2026 13:50:16 -0700 To: mm-commits@vger.kernel.org,leitao@debian.org,akpm@linux-foundation.org From: Andrew Morton Subject: [to-be-updated] documentation-document-panic_on_unrecoverable_memory_failure-sysctl.patch removed from -mm tree Message-Id: <20260630205017.26F301F000E9@smtp.kernel.org> Precedence: bulk X-Mailing-List: mm-commits@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: The quilt patch titled Subject: Documentation: document panic_on_unrecoverable_memory_failure sysctl has been removed from the -mm tree. Its filename was documentation-document-panic_on_unrecoverable_memory_failure-sysctl.patch This patch was dropped because an updated version will be issued ------------------------------------------------------ From: Breno Leitao Subject: Documentation: document panic_on_unrecoverable_memory_failure sysctl Date: Fri, 26 Jun 2026 08:33:19 -0700 Add documentation for the new vm.panic_on_unrecoverable_memory_failure sysctl, describing which failures trigger a panic (kernel-owned pages the handler cannot recover) and which are intentionally left out (transient allocator races and unclassified pages). Link: https://lore.kernel.org/20260626-ecc_panic-v10-5-6dacb8ad024d@debian.org Signed-off-by: Breno Leitao Cc: David Hildenbrand (Arm) Cc: Jonathan Corbet Cc: Lance Yang Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Rapoport Cc: Naoya Horiguchi Cc: Shuah Khan Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton --- Documentation/admin-guide/sysctl/vm.rst | 80 ++++++++++++++++++++++ 1 file changed, 80 insertions(+) --- a/Documentation/admin-guide/sysctl/vm.rst~documentation-document-panic_on_unrecoverable_memory_failure-sysctl +++ a/Documentation/admin-guide/sysctl/vm.rst @@ -67,6 +67,7 @@ Currently, these files are in /proc/sys/ - page-cluster - page_lock_unfairness - panic_on_oom +- panic_on_unrecoverable_memory_failure - percpu_pagelist_high_fraction - stat_interval - stat_refresh @@ -925,6 +926,85 @@ panic_on_oom=2+kdump gives you very stro why oom happens. You can get snapshot. +panic_on_unrecoverable_memory_failure +====================================== + +When a hardware memory error (e.g. multi-bit ECC) hits a kernel page +that cannot be recovered by the memory failure handler, the default +behaviour is to ignore the error and continue operation. This is +dangerous because the corrupted data remains accessible to the kernel, +risking silent data corruption or a delayed crash when the poisoned +memory is next accessed. + +When enabled, this sysctl triggers a panic on memory failure events +hitting kernel-owned pages that the handler cannot recover: +``PageReserved`` (firmware reservations, kernel image, vDSO, zero +page, and similar memblock-reserved regions), ``PageSlab``, +``PageTable``, and ``PageLargeKmalloc``. These are owned by the +kernel and the memory failure handler cannot reliably evict their +contents. + +Other unrecoverable kernel-owned populations (vmalloc allocations, +kernel stack pages, ...) are not currently covered because the +handler has no page-type signal that distinguishes them from a +userspace folio temporarily off the LRU during migration or +compaction. Such pages still go through the standard +MF_MSG_GET_HWPOISON path: ``PG_hwpoison`` is set on them and a +delayed crash on the next access remains possible. Coverage may +grow as the handler gains stronger kernel-ownership signals. + +Recoverable failure paths are also intentionally left out: in-flight +buddy allocations and other transient races with the page allocator +can reach the same diagnostic, and panicking on them would risk +killing the box for a page destined for userspace where the standard +SIGBUS recovery path applies. Pages whose state could not be +classified at all are not covered either, since an unknown state is +not a sound basis for a panic decision. + +For many environments it is preferable to panic immediately with a clean +crash dump that captures the original error context, rather than to +continue and face a random crash later whose cause is difficult to +diagnose. + +Use cases +--------- + +This option is most useful in environments where unattributed crashes +are expensive to debug or where data integrity must take precedence +over availability: + +* Large fleets, where multi-bit ECC errors on kernel pages are observed + regularly and post-mortem analysis of an unrelated downstream crash + (often seconds to minutes after the original error) consumes + significant engineering effort. + +* Systems configured with kdump, where panicking at the moment of the + hardware error produces a vmcore that still contains the faulting + address, the affected page state, and the originating MCE/GHES + record — context that is typically lost by the time a delayed crash + occurs. + +* High-availability clusters that rely on fast, deterministic node + failure for failover, and prefer an immediate panic over silent data + corruption propagating to replicas or persistent storage. + +* Kernel and platform developers reproducing hwpoison issues with + tools such as ``mce-inject`` or error-injection debugfs interfaces, + where panicking on the unrecoverable path makes regressions + immediately visible instead of surfacing as later, unrelated + failures. + += ===================================================================== +0 Try to continue operation (default). +1 Panic immediately. If the ``panic`` sysctl is also non-zero then the + machine will be rebooted. += ===================================================================== + +Example:: + + echo 1 > /proc/sys/vm/panic_on_unrecoverable_memory_failure + + percpu_pagelist_high_fraction ============================= _ Patches currently in -mm which might be from leitao@debian.org are mm-kmemleak-avoid-soft-lockup-when-scanning-task-stacks.patch mm-kmemleak-stop-the-task-stack-scan-early-when-interrupted.patch mm-kmemleak-stop-the-per-cpu-and-struct-page-scans-early-too.patch a.patch selftests-mm-add-hwpoison-panic-destructive-test.patch mm-kmemleak-skip-the-remaining-scan-phases-when-interrupted.patch