From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f169.google.com (mail-pf1-f169.google.com [209.85.210.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0023E2ECE86 for ; Fri, 12 Jun 2026 03:59:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781236758; cv=none; b=XAG1X8bCgyY6htAN5+welIPP1kk1zDiM179J5dBkyNfqKwX47N8od0pO98r/RtAGs8MIiO7NRhqRJwd7cM78/bk5mVz+tAaKiciGydB2yP0QgJ8FBcYswsRKx9l/C8AXSUOVP/e8M9+B7CokZiXB8PHEiZx2I6yIM5IJmcXg2BI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781236758; c=relaxed/simple; bh=B3Jh3j2f5Lb7lD+pLOZUOCcHY1aLgJWNSLpL7f7IkTk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=rYO4+FM8rfJJ1CjHA11EVYcm6YjrIFvEjfUpKtPr5ZTST75kvuzw4FCQXp2ab3uBG5p5RGJ9TgVQO3IgkqBFctLR4tTKygq1Uzet1amPiKROW+q8ZerI1ww/k28604AckoGj3JuAPWQhFb5UyQ8maUJvlrRth2rbfKbOdCIfqEA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=bytedance.com; spf=pass smtp.mailfrom=bytedance.com; dkim=pass (2048-bit key) header.d=bytedance.com header.i=@bytedance.com header.b=NGeEdzbw; arc=none smtp.client-ip=209.85.210.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=bytedance.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bytedance.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bytedance.com header.i=@bytedance.com header.b="NGeEdzbw" Received: by mail-pf1-f169.google.com with SMTP id d2e1a72fcca58-842848fd613so526539b3a.3 for ; Thu, 11 Jun 2026 20:59:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bytedance.com; s=google; t=1781236756; x=1781841556; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=BGnxBE9ZAaNi/tjsaLR7aR0BPLKcOcY8H1vV/Mvx5Rg=; b=NGeEdzbwyAYQzK9qnY2rAS6Zhmej9FIxR2znGmwBMG/uWPznLWPUUyflHVwgf+Sh/H pubdcCgNNLWP7SdYkwkcpUgY+zJ5mrYMFI10OfYxB709263t4Sol6Hhnn90hc8QJXEjx F6199qVrLUL99xpCHvdrbUMxc7flk6KOqZOgc9CO94q0ug8xgtAM1HfH9apLYvOpNU2p L1vI9cNtDWph3K8km/FfgZKBTyS0NNU4qRy1h2bMuFDbmjGVNu44Q/xpoBXEERdfiBJX c7xoNlHaoiBxV058hpIHArQ2CRbUB7vCix8a0RMJElQ1ljarx/RfFB2ECZjwzQqR2pcB RBCA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781236756; x=1781841556; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=BGnxBE9ZAaNi/tjsaLR7aR0BPLKcOcY8H1vV/Mvx5Rg=; b=Xi6I8TEiA2RKCPrxR7OT72Dod3ANazvjT2jp/6yELsJ6rqU3djfgpZQ/9bszXpFla+ h+h3i7DJMFAuNkXbUEwmZ7Ssnf1PFNvsKNW8NxVZQnlfwplMhskVHP1hiYVTirhgT5bp RTkk5nFcVI95zybqcVt4nOQoPyxB+w+1vG//a1WlAvxQOnkd06TlrgReLBodLy2GUURD QB0JeB+b02DVqIei6psf7/cHeauHmRclylQTYrdK9DPdL3UNmkcLAAx7YI9AgZt5CrSf oehCryegof/n/+bJWYlBI7lYNLO2HGHocdb/xk83XBOx1vATniXvIws4fsJQ+nleBchn IQTQ== X-Forwarded-Encrypted: i=1; AFNElJ+0XQzXuhFRYfC+uhQhA/ifDoES8x0fc+1Uuj0ZE3VDv7ZywkqupePt5LWuAnGYpwdXOLPlEwA+SNrr890=@vger.kernel.org X-Gm-Message-State: AOJu0YxHNCmeypreWOpWNCK2pq8UawIppaeClWupJYXbo9Z7YqgIGgzz E2Na6wfCUdJvng+c/EQxErka571LLXrramInn8B8ibGrB1YyYqHBVxeg71digbgw0No= X-Gm-Gg: Acq92OHM5USYyiob16Mab1cHYY/z10mJh+R2tHO2ncet+nkNxLnN2YKALXlLq2nX51V Eywv2uk5T2hyzXc6TKCxF/ddDsVxH71DVTOOI5ccKt1mv/6GdJGiqmjjNly6sZFcf9JH7NXj/2y Hejk6zX/zG3sY/s2aGuHKY0LPgN+ptip4WS7M1A/nz/Mmxiue0rF3YFXJPQ6QVaN7tPi62zxZ1m U4qJ7P6PZLTar0PNEQubIhGaheusX7+wXOlsIZc0csrshcg6x3ImY+OwoRSQ4PGy8kEKnUtpec4 kqI8JbMXA3G6fZJ+U62UdMZ6R2UYnQPaFsVdpjbthSu8SlAPiR/TScM9C3zJcp5AF6z6YQmzCCZ OkAUC2RNzkeX55ntf5m9Lmr/vLFQV7mPTvBDRccveuXAMXuVCPoxENk0thTgrEQdOeNRvGkZV3P MQ92faMyaiigts5tAjDGefePYy+VjtPZbhGkccN23kOJJI5eH75x44ZA== X-Received: by 2002:a05:6a00:2e82:b0:842:48ae:1d56 with SMTP id d2e1a72fcca58-8434d0cdb37mr1033250b3a.35.1781236756174; Thu, 11 Jun 2026 20:59:16 -0700 (PDT) Received: from n232-176-004.byted.org ([36.110.163.99]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-8434ad03fdcsm643352b3a.24.2026.06.11.20.59.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 11 Jun 2026 20:59:15 -0700 (PDT) From: Muchun Song To: Oscar Salvador , David Hildenbrand , Andrew Morton , Madhavan Srinivasan , Michael Ellerman Cc: Muchun Song , Mike Rapoport , Lorenzo Stoakes , "Liam R . Howlett" , Vlastimil Babka , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Nicholas Piggin , Christophe Leroy , Ritesh Harjani , "Aneesh Kumar K . V" , linuxppc-dev@lists.ozlabs.org, Mike Kravetz , Muchun Song Subject: [PATCH v4 01/19] mm/hugetlb: Fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages Date: Fri, 12 Jun 2026 11:58:45 +0800 Message-ID: <20260612035903.2468601-2-songmuchun@bytedance.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260612035903.2468601-1-songmuchun@bytedance.com> References: <20260612035903.2468601-1-songmuchun@bytedance.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Commit 622026e87c40 ("mm/hugetlb: remove fake head pages") switched HVO to reuse per-zone shared tail pages from zone->vmemmap_tails[]. Those shared tail pages were initialized in hugetlb_vmemmap_init(), but bootmem HugeTLB folios are prepared earlier from gather_bootmem_prealloc(). With hugetlb_free_vmemmap=on, prep_and_add_bootmem_folios() can access pageblock flags on bootmem HugeTLB pages whose mirrored tail struct pages already point to the shared tail page. On CONFIG_DEBUG_VM kernels, get_pfnblock_bitmap_bitidx() then dereferences the still-uninitialized shared tail page and can panic during boot. Initialize zone->vmemmap_tails[] from gather_bootmem_prealloc(), before bootmem HugeTLB folios are processed, and drop the later initialization from hugetlb_vmemmap_init(). This bug only affects CONFIG_DEBUG_VM kernels, where the relevant assertion is evaluated. Fixes: 622026e87c40 ("mm/hugetlb: remove fake head pages") Signed-off-by: Muchun Song Acked-by: Oscar Salvador --- mm/hugetlb.c | 25 +++++++++++++++++++++++++ mm/hugetlb_vmemmap.c | 17 ----------------- mm/sparse-vmemmap.c | 2 +- 3 files changed, 26 insertions(+), 18 deletions(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 571212b80835..cd55524c7e30 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -3365,6 +3365,31 @@ static void __init gather_bootmem_prealloc(void) .max_threads = num_node_state(N_MEMORY), .numa_aware = true, }; +#ifdef CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP + struct zone *zone; + + for_each_zone(zone) { + for (int i = 0; i < NR_VMEMMAP_TAILS; i++) { + struct page *tail, *p; + unsigned int order; + + tail = zone->vmemmap_tails[i]; + if (!tail) + continue; + + order = i + VMEMMAP_TAIL_MIN_ORDER; + p = page_to_virt(tail); + /* + * prep_and_add_bootmem_folios() can access pageblock + * flags on bootmem HugeTLB pages, so initialize the + * shared tail struct pages here before bootmem folios + * start using them. + */ + for (int j = 0; j < PAGE_SIZE / sizeof(struct page); j++) + init_compound_tail(p + j, NULL, order, zone); + } + } +#endif padata_do_multithreaded(&job); } diff --git a/mm/hugetlb_vmemmap.c b/mm/hugetlb_vmemmap.c index 133b46dfb09f..c713c0d2593a 100644 --- a/mm/hugetlb_vmemmap.c +++ b/mm/hugetlb_vmemmap.c @@ -870,27 +870,10 @@ static const struct ctl_table hugetlb_vmemmap_sysctls[] = { static int __init hugetlb_vmemmap_init(void) { const struct hstate *h; - struct zone *zone; /* HUGETLB_VMEMMAP_RESERVE_SIZE should cover all used struct pages */ BUILD_BUG_ON(__NR_USED_SUBPAGE > HUGETLB_VMEMMAP_RESERVE_PAGES); - for_each_zone(zone) { - for (int i = 0; i < NR_VMEMMAP_TAILS; i++) { - struct page *tail, *p; - unsigned int order; - - tail = zone->vmemmap_tails[i]; - if (!tail) - continue; - - order = i + VMEMMAP_TAIL_MIN_ORDER; - p = page_to_virt(tail); - for (int j = 0; j < PAGE_SIZE / sizeof(struct page); j++) - init_compound_tail(p + j, NULL, order, zone); - } - } - for_each_hstate(h) { if (hugetlb_vmemmap_optimizable(h)) { register_sysctl_init("vm", hugetlb_vmemmap_sysctls); diff --git a/mm/sparse-vmemmap.c b/mm/sparse-vmemmap.c index 99e2be39671b..bb23fb3077a3 100644 --- a/mm/sparse-vmemmap.c +++ b/mm/sparse-vmemmap.c @@ -342,7 +342,7 @@ static __meminit struct page *vmemmap_get_tail(unsigned int order, struct zone * * * Any initialization done here will be overwritten by memmap_init(). * - * hugetlb_vmemmap_init() will take care of initialization after + * gather_bootmem_prealloc() will take care of initialization after * memmap_init(). */ -- 2.54.0