From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pdx-out-012.esa.us-west-2.outbound.mail-perimeter.amazon.com (pdx-out-012.esa.us-west-2.outbound.mail-perimeter.amazon.com [35.162.73.231]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2E5694B04BE for ; Fri, 7 Aug 2026 03:12:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=35.162.73.231 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786072371; cv=none; b=fTMpYFTxzPJcF3tBCJihoC7wrKhHE7/alLa1bHQCVILpDdXQ+fna0w+uW/caGoeMeoyWRiB+x4xutjMYfz5IjsjRxejCIks/jw/tsXwWLXiMd8u9BXdjrKJbamMK3bqHLAaBxEGgw7lrczR0t+f/LStYMfmXg6YHqkhuJ2ZV0xE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786072371; c=relaxed/simple; bh=r9wkibLp8dPyx9ch4RprJ7hsrEVEORFKUOCnRZxRTa8=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=gaBuhEZe21tBpzIbW4zzrVas85aiIILrA9B8ItxQLmqZnLDRoNW/LZA/YBBf/8DZTQF2yszrHoNFn68RQuMN2QsbVX40Q9HuI6Ey5lyujvX3KSBSvUpBInFDu5iHui2KAk6FkazeXO6L8y14DgCKPbHnpORECZTtri5FFQ2oiDk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amazon.com; spf=pass smtp.mailfrom=amazon.de; dkim=pass (2048-bit key) header.d=amazon.com header.i=@amazon.com header.b=emm2nihU; arc=none smtp.client-ip=35.162.73.231 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amazon.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=amazon.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=amazon.com header.i=@amazon.com header.b="emm2nihU" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazoncorp2; t=1786072370; x=1817608370; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=jbw8Gl9IPPMQwggElOzlBjMu2akYnLey90bjnD9+aL8=; b=emm2nihUKdk+Wntic2FMaJV5QMfrPyuWCDS2saiPVM/qrnDrq7+Y8lzt zWgcNkEOFtYrpw989XJoZICOKlivCiFZA3dCmQyprzWN0Z3aDcbnumDFD 4dEr3uF7z5uFrSWOGxWZsy23Q7A0mYYM/3KqJXCnZTlSjJFqzAodhVDwl MqPmL/57RcGMRX/EeBDgxbqzd3cPfykAQGbBE47doQkNCrLHturs12j35 5To4ODLcX8YyX/bpepXcohW7iRzczHP48+Nz0OR9uu+Lw2pUSLSOfn9HR PK87YtZYyj+ru3ksxo9kknskpVhVh5sWqpdO0pqNzOr8XlBh4nvyh496k g==; X-CSE-ConnectionGUID: JubALCncSg64A77xzgDv/A== X-CSE-MsgGUID: FSk0IWS0RpO9EWG37I8vZA== X-IronPort-AV: E=Sophos;i="6.25,209,1779148800"; d="scan'208";a="25138706" Received: from ip-10-5-6-203.us-west-2.compute.internal (HELO smtpout.naws.us-west-2.prod.farcaster.email.amazon.dev) ([10.5.6.203]) by internal-pdx-out-012.esa.us-west-2.outbound.mail-perimeter.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 07 Aug 2026 03:12:47 +0000 Received: from EX19MTAUWA001.ant.amazon.com [205.251.233.236:25824] by smtpin.naws.us-west-2.prod.farcaster.email.amazon.dev [10.0.25.208:2525] with esmtp (Farcaster) id 0a564dc6-3bcf-4164-863d-313a61187ca7; Fri, 7 Aug 2026 03:12:47 +0000 (UTC) X-Farcaster-Flow-ID: 0a564dc6-3bcf-4164-863d-313a61187ca7 Received: from EX19D001UWA001.ant.amazon.com (10.13.138.214) by EX19MTAUWA001.ant.amazon.com (10.250.64.217) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.2562.45; Fri, 7 Aug 2026 03:12:46 +0000 Received: from ip-10-253-83-51.amazon.com (172.19.99.218) by EX19D001UWA001.ant.amazon.com (10.13.138.214) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.2562.45; Fri, 7 Aug 2026 03:12:45 +0000 From: Alexander Graf To: Andrew Morton , Mike Rapoport CC: David Hildenbrand , Wei Yang , , , Subject: [PATCH v2] mm/mm_init: fix out-of-range first_deferred_pfn Date: Fri, 7 Aug 2026 03:12:43 +0000 Message-ID: <20260807031243.87904-1-graf@amazon.com> X-Mailer: git-send-email 2.47.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: EX19D037UWB001.ant.amazon.com (10.13.138.123) To EX19D001UWA001.ant.amazon.com (10.13.138.214) With CONFIG_DEFERRED_STRUCT_PAGE_INIT enabled, deferred_grow_zone() undefers struct page ranges early in boot to satisfy an allocation. With a large CMA reservation in place, the ranges it finds may not add up to the allocation it was asked for, and we end up undeferring all available RAM and still fall short. That is fine in itself: the function accounts for it and leaves the caller to decide whether it now has enough memory. The function also remembers where undeferring is to continue next, in pgdat->first_deferred_pfn, and it walks in PAGES_PER_SECTION (128M) chunks. If the node's RAM does not end 128M aligned and we undeferred everything, that "next" points past the end of the node's RAM. deferred_init_memmap() later picks up from first_deferred_pfn and hits a BUG_ON(), because it expects a pfn within its node: kernel BUG at mm/mm_init.c:2131! CPU: 3 UID: 0 PID: 36 Comm: pgdatinit0 Not tainted 7.2.0-rc6 #1 RIP: 0010:deferred_init_memmap+0x1b8/0x1c0 RAX: 0000000000236000 R13: 0000000000238000 Call Trace: kthread+0xdf/0x120 ret_from_fork+0x187/0x250 Detect the end of RAM in deferred_grow_zone() instead of assuming that more deferral is always available. When the walk leaves the zone (which is where this node's RAM ends), record ULONG_MAX, the value that tells deferred_init_memmap() the memory map is already initialized. To reproduce with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y and CONFIG_CMA=y: qemu-system-x86_64 -enable-kvm -m 8032M -kernel bzImage \ -append "nokaslr cma=4768M@0x100000000" The above command panics on every boot without this patch and boots reliably with it applied. Fixes: 3acb913c9d5b ("mm/mm_init: use deferred_init_memmap_chunk() in deferred_grow_zone()") Cc: stable@vger.kernel.org Assisted-by: Kiro:claude-opus-5 Signed-off-by: Alexander Graf --- Notes: Changes since v1: changelog rewritten for readability per review feedback. No functional change; the diff is byte-identical to v1. v1: https://lore.kernel.org/linux-mm/20260805224421.15794-1-graf@amazon.com/ Applies unchanged to 6.18.y, 6.19.y, 7.0.y and 7.1.y (checked against v6.18.39, v6.19.14, v7.0.14 and v7.1.4); the deferred_init_memmap_chunk() signature change in cbbbf7795fc3 sits outside the hunk context, so stable needs no separate backport. mm/mm_init.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/mm/mm_init.c b/mm/mm_init.c index 498d62c4ece3..91177be58a00 100644 --- a/mm/mm_init.c +++ b/mm/mm_init.c @@ -2214,10 +2214,13 @@ bool __init deferred_grow_zone(struct zone *zone, unsigned int order) } /* - * There were no pages to initialize and free which means the zone's - * memory map is completely initialized. + * The loop only tests spfn before entering an iteration, so on exit it + * may point up to a section past the end of the zone. When it does, + * the rest of the zone has already been handed to + * deferred_init_memmap_chunk() and nothing is left to initialize. */ - pgdat->first_deferred_pfn = nr_pages ? spfn : ULONG_MAX; + pgdat->first_deferred_pfn = + spfn < zone_end_pfn(zone) ? spfn : ULONG_MAX; pgdat_resize_unlock(pgdat, &flags); base-commit: 0d839570765118029aa8bf4a95444c6a11aacf85 -- 2.47.1