[linus:master] [atomic] 80047d84ee: WARNING:at_include/linux/instrumented.h:#__split_huge_pmd_locked

[linus:master] [atomic] 80047d84ee: WARNING:at_include/linux/instrumented.h:#__split_huge_pmd_locked

[kernel test robot]

Hello,

kernel test robot noticed "WARNING:at_include/linux/instrumented.h:#__split_huge_pmd_locked" on:

commit: 80047d84eed25e9c92cfb9169980a0dfec110246 ("atomic: add alignment check to instrumented atomic operations") https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master

[test failed on linux-next/master 7649ba73f9e7e1e04d0b46213e39c79ae09dd55c]

in testcase: trinity
with following parameters:

	runtime: 300s
	group: group-02
	nr_groups: 5


config: i386-randconfig-1005-20261101
compiler: gcc-14
test machine: qemu-system-i386 -enable-kvm -cpu Icelake-Server-noTSX,enforce,lm=off -smp 4 -m 4G

(please refer to attached dmesg/kmsg for entire log/backtrace)


If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <yi1.lai@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202611022259.def3e086-lkp@intel.com


[   18.704659][ T3738] ------------[ cut here ]------------
[   18.706815][ T3738] WARNING: include/linux/instrumented.h:62 at __split_huge_pmd_locked+0x6d2/0xac0, CPU#0: trinity-c1/3738
[   18.717796][ T3738] Modules linked in:
[   18.719286][ T3738] CPU: 0 UID: 65534 PID: 3738 Comm: trinity-c1 Not tainted 6.19.0-rc6-00100-g80047d84eed2 #1 PREEMPT(lazy)
[   18.723193][ T3738] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   18.726644][ T3738] EIP: __split_huge_pmd_locked (x86/include/asm/pgtable.h:228 (discriminator 1) huge_memory.c:3128 (discriminator 1))
[   18.728717][ T3738] Code: dc 85 d2 75 0c c6 45 c2 00 85 c0 0f 84 ee fe ff ff f6 45 bc 03 0f 85 47 03 00 00 8b 45 bc 80 08 10 c6 45 c2 01 e9 d5 fe ff ff <0f> 0b 0f c7 4d ec 0f 84 34 fd ff ff eb f2 e8 db 58 40 01 85 c0 0f
All code
========
   0:	dc 85 d2 75 0c c6    	faddl  -0x39f38a2e(%rbp)
   6:	45 c2 00 85          	rex.RB ret $0x8500
   a:	c0 0f 84             	rorb   $0x84,(%rdi)
   d:	ee                   	out    %al,(%dx)
   e:	fe                   	(bad)
   f:	ff                   	(bad)
  10:	ff f6                	push   %rsi
  12:	45 bc 03 0f 85 47    	rex.RB mov $0x47850f03,%r12d
  18:	03 00                	add    (%rax),%eax
  1a:	00 8b 45 bc 80 08    	add    %cl,0x880bc45(%rbx)
  20:	10 c6                	adc    %al,%dh
  22:	45 c2 01 e9          	rex.RB ret $0xe901
  26:	d5 fe ff ff          	{rex2 0xfe} ud0 %r23,%r31
  2a:*	0f 0b                	ud2		<-- trapping instruction
  2c:	0f c7 4d ec          	cmpxchg8b -0x14(%rbp)
  30:	0f 84 34 fd ff ff    	je     0xfffffffffffffd6a
  36:	eb f2                	jmp    0x2a
  38:	e8 db 58 40 01       	call   0x1405918
  3d:	85 c0                	test   %eax,%eax
  3f:	0f                   	.byte 0xf

Code starting with the faulting instruction ===========================================
   0:	0f 0b                	ud2
   2:	0f c7 4d ec          	cmpxchg8b -0x14(%rbp)
   6:	0f 84 34 fd ff ff    	je     0xfffffffffffffd40
   c:	eb f2                	jmp    0x0
   e:	e8 db 58 40 01       	call   0x14058ee
  13:	85 c0                	test   %eax,%eax
  15:	0f                   	.byte 0xf
[   18.738340][ T3738] EAX: 00000000 EBX: 04507067 ECX: 00000000 EDX: 00000000
[   18.740746][ T3738] ESI: 00000000 EDI: 04507067 EBP: 44669d30 ESP: 44669cd8
[   18.743073][ T3738] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068 EFLAGS: 00010202
[   18.745603][ T3738] CR0: 80050033 CR2: 00000004 CR3: 042e6000 CR4: 00350ef0
[   18.747953][ T3738] DR0: 3678f000 DR1: 36ba2000 DR2: 00000000 DR3: 00000000
[   18.753554][ T3738] DR6: ffff0ff0 DR7: 00070602
[   18.755107][ T3738] Call Trace:
[   18.756252][ T3738]  ? split_huge_pmd_address (huge_memory.c:3270 huge_memory.c:3284 huge_memory.c:3297)
[   18.758035][ T3738]  ? vma_adjust_trans_huge (huge_memory.c:3309 huge_memory.c:3321)
[   18.759892][ T3738]  ? __split_vma (vma.c:554)
[   18.761489][ T3738]  ? vma_modify (vma.c:596 vma.c:1674)
[   18.762981][ T3738]  ? vma_modify_flags (vma.c:1694)
[   18.764670][ T3738]  ? madvise_vma_behavior (madvise.c:169 madvise.c:1441)
[   18.765920][ T3738]  ? madvise_do_behavior (madvise.c:1721 madvise.c:1937)
[   18.767061][ T3738]  ? do_madvise (madvise.c:2030)
[   18.768042][ T3738]  ? __ia32_sys_madvise (madvise.c:2039 (discriminator 1) madvise.c:2037 (discriminator 1) madvise.c:2037 (discriminator 1))
[   18.769149][ T3738]  ? ia32_sys_call (kbuild/obj/consumer/i386-randconfig-1005-20261101/./arch/x86/include/generated/asm/syscalls_32.h:220)
[   18.770238][ T3738]  ? do_int80_syscall_32 (x86/entry/syscall_32.c:83 x86/entry/syscall_32.c:259)
[   18.771374][ T3738]  ? entry_INT80_32 (x86/entry/entry_32.S:940)
[   18.772429][ T3738] irq event stamp: 781495
[   18.773388][ T3738] hardirqs last  enabled at (781509): __up_console_sem (printk/printk.c:345 (discriminator 1))
[   18.775278][ T3738] hardirqs last disabled at (781522): __up_console_sem (printk/printk.c:343 (discriminator 1))
[   18.777167][ T3738] softirqs last  enabled at (781232): handle_softirqs (softirq.c:468 softirq.c:650)
[   18.779118][ T3738] softirqs last disabled at (781219): __do_softirq (softirq.c:656)
[   18.781012][ T3738] ---[ end trace 0000000000000000 ]---
[  220.112163][    T0] CE: hpet increased min_delta_ns to 5000 nsec
[  220.112245][    T0] CE: hpet increased min_delta_ns to 7500 nsec
[  220.112306][    T0] CE: hpet increased min_delta_ns to 11250 nsec
[  313.879988][  T384] sh: can't kill pid 3613: No such process
[  319.115692][    C0] CE: hpet increased min_delta_ns to 16875 nsec
LKP: ttyS0: 335: LKP: tbox cant kexec and rebooting forcely [  325.428435][  T335] sysrq: Emergency Sync
[  325.430372][   T10] Emergency Sync complete
[  325.431919][  T335] sysrq: Resetting

Kboot worker: lkp-worker71
Elapsed time: 360
Host load: peak load1 279.34, peak cpu pressure 96.63%, qemu waited 0s for a cpu in 360s, container throttled 0s, 6 samples

kvm=(
qemu-system-i386
-enable-kvm
-cpu Icelake-Server-noTSX,enforce,lm=off
-kernel $kernel
-initrd initrd-vm-meta-160.cgz
-m 4096
-smp 4
-device e1000,netdev=net0
-netdev user,id=net0,hostfwd=tcp::32032-:22
-boot order=nc
-no-reboot
-device i6300esb
-device pci-testdev
-watchdog-action debug
-rtc base=localtime
-serial stdio
-display none
-monitor null
)

append=(
ip=::::vm-meta-160::dhcp
root=/dev/ram0
RESULT_ROOT=/result/trinity/group-02-5-300s/vm-icl-i386/yocto-i386-minimal-20190520.cgz/i386-randconfig-1005-20261101/gcc-14/80047d84eed25e9c92cfb9169980a0dfec110246/0
BOOT_IMAGE=/pkg/linux/i386-randconfig-1005-20261101/gcc-14/80047d84eed25e9c92cfb9169980a0dfec110246/vmlinuz-6.19.0-rc6-00100-g80047d84eed2
branch=linux-next/master
job=/job-script
user=lkp
ARCH=i386
kconfig=i386-randconfig-1005-20261101
commit=80047d84eed25e9c92cfb9169980a0dfec110246
mem=4G
intremap=posted_msi
rcuperf.shutdown=0
rcuscale.shutdown=0
refscale.shutdown=0
audit=0
kunit.enable=0
init_on_free=0
max_uptime=3600
result_service=tmpfs
selinux=0
debug
apic=debug
sysrq_always_enabled
rcupdate.rcu_cpu_stall_timeout=100
watchdog_thresh=55
workqueue.watchdog_thresh=140
smp.csd_lock_timeout=100000
sysctl.kernel.hung_task_timeout_secs=140
net.ifnames=0
printk.devkmsg=on
panic=30
softlockup_panic=1
nmi_watchdog=panic
oops=panic
load_ramdisk=2
prompt_ramdisk=0
drbd.minor_count=8
systemd.log_level=err
ignore_loglevel
console=tty0
earlyprintk=ttyS0,115200
console=ttyS0,115200
vga=normal
rw
earlycon=uart8250,io,0x3f8,115200n8
keep_bootcon
)

"${kvm[@]}" -append "${append[*]}"

The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20261102/202611022259.def3e086-lkp@intel.com



--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [linus:master] [atomic] 80047d84ee: WARNING:at_include/linux/instrumented.h:#__split_huge_pmd_locked

[Finn Thain]

On Tue, 3 Nov 2026, kernel test robot wrote:

> 
> kernel test robot noticed "WARNING:at_include/linux/instrumented.h:#__split_huge_pmd_locked" on:
> 
> commit: 80047d84eed25e9c92cfb9169980a0dfec110246 ("atomic: add alignment check to instrumented atomic operations") https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
> 

It appears that a misaligned lock was accessed in 
__split_huge_pmd_locked() back in 6.19.0-rc on i386.

And it appears that bisection landed on commit 80047d84eed2 ("atomic: add 
alignment check to instrumented atomic operations") because that's when 
the check got added to detect such accesses.

If the misaligned atomic operation is somehow normal in this situation (?) 
then I guess it's a false positive from DEBUG_ATOMIC=y.

But if it was unintentional, the next step would probably be to check 
whether the current mainline kernel has the same issue.

I have to confess to a state of ignorance about the mm subsystem so I 
don't know what to conclude here.

Re: [linus:master] [atomic] 80047d84ee: WARNING:at_include/linux/instrumented.h:#__split_huge_pmd_locked

[Arnd Bergmann]

On Tue, Nov 3, 2026, at 01:58, kernel test robot wrote:
> Hello,
>
> kernel test robot noticed 
> "WARNING:at_include/linux/instrumented.h:#__split_huge_pmd_locked" on:
>
> commit: 80047d84eed25e9c92cfb9169980a0dfec110246 ("atomic: add 
> alignment check to instrumented atomic operations") 
> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
>
> [test failed on linux-next/master 7649ba73f9e7e1e04d0b46213e39c79ae09dd55c]
>
> in testcase: trinity
> with following parameters:
>
> 	runtime: 300s
> 	group: group-02
> 	nr_groups: 5
>
>
> config: i386-randconfig-1005-20261101
> compiler: gcc-14
> test machine: qemu-system-i386 -enable-kvm -cpu 
> Icelake-Server-noTSX,enforce,lm=off -smp 4 -m 4G
>
> (please refer to attached dmesg/kmsg for entire log/backtrace)
>
>
> If you fix the issue in a separate patch/commit (i.e. not just a new 
> version of the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <yi1.lai@intel.com>
> | Closes: 
> https://lore.kernel.org/oe-lkp/202611022259.def3e086-lkp@intel.com
>
>
> [   18.704659][ T3738] ------------[ cut here ]------------
> [   18.706815][ T3738] WARNING: include/linux/instrumented.h:62 at 
> __split_huge_pmd_locked+0x6d2/0xac0, CPU#0: trinity-c1/3738
> [   18.717796][ T3738] Modules linked in:
> [   18.719286][ T3738] CPU: 0 UID: 65534 PID: 3738 Comm: trinity-c1 Not 
> tainted 6.19.0-rc6-00100-g80047d84eed2 #1 PREEMPT(lazy)
> [   18.723193][ T3738] Hardware name: QEMU Standard PC (i440FX + PIIX, 
> 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> [   18.726644][ T3738] EIP: __split_huge_pmd_locked 
> (x86/include/asm/pgtable.h:228 (discriminator 1) huge_memory.c:3128 
> (discriminator 1))
> [   18.728717][ T3738] Code: dc 85 d2 75 0c c6 45 c2 00 85 c0 0f 84 ee 
> fe ff ff f6 45 bc 03 0f 85 47 03 00 00 8b 45 bc 80 08 10 c6 45 c2 01 e9 
> d5 fe ff ff <0f> 0b 0f c7 4d ec 0f 84 34 fd ff ff eb f2 e8 db 58 40 01 
> 85 c0 0f
> All code
> ========
>    0:	dc 85 d2 75 0c c6    	faddl  -0x39f38a2e(%rbp)
>    6:	45 c2 00 85          	rex.RB ret $0x8500
>    a:	c0 0f 84             	rorb   $0x84,(%rdi)
>    d:	ee                   	out    %al,(%dx)/out
>    e:	fe                   	(bad)
>    f:	ff                   	(bad)
>   10:	ff f6                	push   %rsi
>   12:	45 bc 03 0f 85 47    	rex.RB mov $0x47850f03,%r12d
>   18:	03 00                	add    (%rax),%eax
>   1a:	00 8b 45 bc 80 08    	add    %cl,0x880bc45(%rbx)
>   20:	10 c6                	adc    %al,%dh
>   22:	45 c2 01 e9          	rex.RB ret $0xe901
>   26:	d5 fe ff ff          	{rex2 0xfe} ud0 %r23,%r31
>   2a:*	0f 0b                	ud2		<-- trapping instruction
>   2c:	0f c7 4d ec          	cmpxchg8b -0x14(%rbp)
>   30:	0f 84 34 fd ff ff    	je     0xfffffffffffffd6a
>   36:	eb f2                	jmp    0x2a
>   38:	e8 db 58 40 01       	call   0x1405918
>   3d:	85 c0                	test   %eax,%eax
>   3f:	0f                   	.byte 0xf

This is apparently how we got here:

static __always_inline void instrument_atomic_check_alignment(const volatile void *v, size_t size)
{
#ifndef __DISABLE_EXPORTS
        WARN_ON_ONCE(IS_ENABLED(CONFIG_DEBUG_ATOMIC) && ((unsigned long)v & (size - 1)));
#endif
}

static __always_inline void instrument_atomic_read_write(const volatile void *v, size_t size)
{
        kasan_check_write(v, size);
        kcsan_check_atomic_read_write(v, size);
        instrument_atomic_check_alignment(v, size);
}

#define try_cmpxchg64(ptr, oldp, ...) \ 
({ \
        typeof(ptr) __ai_ptr = (ptr); \
        typeof(oldp) __ai_oldp = (oldp); \
        kcsan_mb(); \
        instrument_atomic_read_write(__ai_ptr, sizeof(*__ai_ptr)); \
        instrument_read_write(__ai_oldp, sizeof(*__ai_oldp)); \
        raw_try_cmpxchg64(__ai_ptr, __ai_oldp, __VA_ARGS__); \
})

#define pxx_xchg64(_pxx, _ptr, _val) ({                                 \
        _pxx##val_t *_p = (_pxx##val_t *)_ptr;                          \
        _pxx##val_t _o = *_p;                                           \
        do { } while (!try_cmpxchg64(_p, &_o, (_val)));                 \
        native_make_##_pxx(_o);                                         \
})

static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
{
        pxx_xchg64(pmd, pmdp, native_pmd_val(pmd)); 
}

#define set_pmd(pmdp, pmd)              native_set_pmd(pmdp, pmd)

static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
                unsigned long haddr, bool freeze)
{
        pmd_t old_pmd, _pmd;
...
        /*
         * Withdraw the table only after we mark the pmd entry invalid.
         * This's critical for some architectures (Power).
         */
        pgtable = pgtable_trans_huge_withdraw(mm, pmd);
        pmd_populate(mm, &_pmd, pgtable);
...
}

So the cmpxchg8b() happens on local "_pmd" variable, which happens
to be unaligned on the stack in this configuration and could potentially
span a page boundary.

I don't know why if this has to use an atomic pmd_populate() here,
but if this is required, the patch below would ensure that the
cmpxchg8b operates on an aligned word.

       Arnd

diff --git a/arch/x86/include/asm/pgtable-3level_types.h b/arch/x86/include/asm/pgtable-3level_types.h
index 580b09bf6a45..526986ba6b17 100644
--- a/arch/x86/include/asm/pgtable-3level_types.h
+++ b/arch/x86/include/asm/pgtable-3level_types.h
@@ -5,11 +5,11 @@
 #ifndef __ASSEMBLER__
 #include <linux/types.h>
 
-typedef u64	pteval_t;
-typedef u64	pmdval_t;
-typedef u64	pudval_t;
-typedef u64	p4dval_t;
-typedef u64	pgdval_t;
+typedef u64	pteval_t __aligned(8);
+typedef u64	pmdval_t __aligned(8);
+typedef u64	pudval_t __aligned(8);
+typedef u64	p4dval_t __aligned(8);
+typedef u64	pgdval_t __aligned(8);
 typedef u64	pgprotval_t;
 
 typedef union {


        Arnd

Re: [linus:master] [atomic] 80047d84ee: WARNING:at_include/linux/instrumented.h:#__split_huge_pmd_locked

[Peter Zijlstra]

On Tue, Nov 03, 2026 at 08:58:07AM +0800, kernel test robot wrote:
> 
> 
> Hello,
> 
> kernel test robot noticed "WARNING:at_include/linux/instrumented.h:#__split_huge_pmd_locked" on:
> 
> commit: 80047d84eed25e9c92cfb9169980a0dfec110246 ("atomic: add alignment check to instrumented atomic operations") https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
> 
> [test failed on linux-next/master 7649ba73f9e7e1e04d0b46213e39c79ae09dd55c]
> 
> in testcase: trinity
> with following parameters:
> 
> 	runtime: 300s
> 	group: group-02
> 	nr_groups: 5
> 
> 
> config: i386-randconfig-1005-20261101
> compiler: gcc-14
> test machine: qemu-system-i386 -enable-kvm -cpu Icelake-Server-noTSX,enforce,lm=off -smp 4 -m 4G
> 
> (please refer to attached dmesg/kmsg for entire log/backtrace)
> 
> 
> If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <yi1.lai@intel.com>
> | Closes: https://lore.kernel.org/oe-lkp/202611022259.def3e086-lkp@intel.com
> 
> 
> [   18.704659][ T3738] ------------[ cut here ]------------
> [   18.706815][ T3738] WARNING: include/linux/instrumented.h:62 at __split_huge_pmd_locked+0x6d2/0xac0, CPU#0: trinity-c1/3738
> [   18.717796][ T3738] Modules linked in:
> [   18.719286][ T3738] CPU: 0 UID: 65534 PID: 3738 Comm: trinity-c1 Not tainted 6.19.0-rc6-00100-g80047d84eed2 #1 PREEMPT(lazy)
> [   18.723193][ T3738] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> [   18.726644][ T3738] EIP: __split_huge_pmd_locked (x86/include/asm/pgtable.h:228 (discriminator 1) huge_memory.c:3128 (discriminator 1))
> [   18.728717][ T3738] Code: dc 85 d2 75 0c c6 45 c2 00 85 c0 0f 84 ee fe ff ff f6 45 bc 03 0f 85 47 03 00 00 8b 45 bc 80 08 10 c6 45 c2 01 e9 d5 fe ff ff <0f> 0b 0f c7 4d ec 0f 84 34 fd ff ff eb f2 e8 db 58 40 01 85 c0 0f
> All code
> ========
>    0:	dc 85 d2 75 0c c6    	faddl  -0x39f38a2e(%rbp)
>    6:	45 c2 00 85          	rex.RB ret $0x8500
>    a:	c0 0f 84             	rorb   $0x84,(%rdi)
>    d:	ee                   	out    %al,(%dx)
>    e:	fe                   	(bad)
>    f:	ff                   	(bad)
>   10:	ff f6                	push   %rsi
>   12:	45 bc 03 0f 85 47    	rex.RB mov $0x47850f03,%r12d
>   18:	03 00                	add    (%rax),%eax
>   1a:	00 8b 45 bc 80 08    	add    %cl,0x880bc45(%rbx)
>   20:	10 c6                	adc    %al,%dh
>   22:	45 c2 01 e9          	rex.RB ret $0xe901
>   26:	d5 fe ff ff          	{rex2 0xfe} ud0 %r23,%r31
>   2a:*	0f 0b                	ud2		<-- trapping instruction
>   2c:	0f c7 4d ec          	cmpxchg8b -0x14(%rbp)
>   30:	0f 84 34 fd ff ff    	je     0xfffffffffffffd6a
>   36:	eb f2                	jmp    0x2a

AFAICT this is pxx_xchg64() from the PAE code operating on an on-stack
pmd value.

The below 'fixes' it, but the question is of course, WTF are we using an
on-stack pmd value for set_pmd().


---

diff --git a/arch/x86/include/asm/pgtable-3level_types.h b/arch/x86/include/asm/pgtable-3level_types.h
index 580b09bf6a45..b1343a1dc55a 100644
--- a/arch/x86/include/asm/pgtable-3level_types.h
+++ b/arch/x86/include/asm/pgtable-3level_types.h
@@ -5,12 +5,12 @@
 #ifndef __ASSEMBLER__
 #include <linux/types.h>
 
-typedef u64	pteval_t;
-typedef u64	pmdval_t;
-typedef u64	pudval_t;
-typedef u64	p4dval_t;
-typedef u64	pgdval_t;
-typedef u64	pgprotval_t;
+typedef u64 __aligned(8)	pteval_t;
+typedef u64 __aligned(8)	pmdval_t;
+typedef u64 __aligned(8)	pudval_t;
+typedef u64 __aligned(8)	p4dval_t;
+typedef u64 __aligned(8)	pgdval_t;
+typedef u64 __aligned(8)	pgprotval_t;
 
 typedef union {
 	struct {

Re: [linus:master] [atomic] 80047d84ee: WARNING:at_include/linux/instrumented.h:#__split_huge_pmd_locked

[Sasha Levin]

On Tue, Nov 03, 2026 at 01:26:47PM +0100, Peter Zijlstra wrote:
> The below 'fixes' it, but the question is of course, WTF are we using an
> on-stack pmd value for set_pmd().

The split fills in the new PTE table before installing it, and uses a
temporary pmd on the stack so pte_offset_map() can find the table:

	pgtable = pgtable_trans_huge_withdraw(mm, pmd);
	pmd_populate(mm, &_pmd, pgtable);
	pte = pte_offset_map(&_pmd, haddr);

__split_huge_zero_page_pmd() does the same thing.

I tried the typedef change. It works, but gcc ends up realigning the
stack in a lot of pte/pmd code (126 more functions with Arnd's version
in a small config, 204 with yours), including handle_mm_fault(). Just
aligning the two locals seems simpler:

diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index bd44d58e86845..b8faa6df9bb14 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -3132,7 +3132,7 @@ static void __split_huge_zero_page_pmd(struct vm_area_struct *vma,
 {
 	struct mm_struct *mm = vma->vm_mm;
 	pgtable_t pgtable;
-	pmd_t _pmd, old_pmd;
+	pmd_t _pmd __aligned(sizeof(pmd_t)), old_pmd;
 	unsigned long addr;
 	pte_t *pte;
 	int i;
@@ -3180,7 +3180,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
 	struct folio *folio;
 	struct page *page;
 	pgtable_t pgtable;
-	pmd_t old_pmd, _pmd;
+	pmd_t old_pmd, _pmd __aligned(sizeof(pmd_t));
 	bool soft_dirty, uffd_wp = false, young = false, write = false;
 	bool anon_exclusive = false, dirty = false;
 	unsigned long addr;

Tested in qemu, the warning is gone. I can send it properly if this
works for you.

-- 
Thanks,
Sasha

Re: [linus:master] [atomic] 80047d84ee: WARNING:at_include/linux/instrumented.h:#__split_huge_pmd_locked

[Peter Zijlstra]

On Tue, Nov 03, 2026 at 07:35:08AM -0500, Sasha Levin wrote:
> On Tue, Nov 03, 2026 at 01:26:47PM +0100, Peter Zijlstra wrote:
> > The below 'fixes' it, but the question is of course, WTF are we using an
> > on-stack pmd value for set_pmd().
> 
> The split fills in the new PTE table before installing it, and uses a
> temporary pmd on the stack so pte_offset_map() can find the table:
> 
> 	pgtable = pgtable_trans_huge_withdraw(mm, pmd);
> 	pmd_populate(mm, &_pmd, pgtable);
> 	pte = pte_offset_map(&_pmd, haddr);
> 
> __split_huge_zero_page_pmd() does the same thing.
> 
> I tried the typedef change. It works, but gcc ends up realigning the
> stack in a lot of pte/pmd code (126 more functions with Arnd's version
> in a small config, 204 with yours), including handle_mm_fault(). Just
> aligning the two locals seems simpler:

Does that matter though?

> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> index bd44d58e86845..b8faa6df9bb14 100644
> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c
> @@ -3132,7 +3132,7 @@ static void __split_huge_zero_page_pmd(struct vm_area_struct *vma,
>  {
>  	struct mm_struct *mm = vma->vm_mm;
>  	pgtable_t pgtable;
> -	pmd_t _pmd, old_pmd;
> +	pmd_t _pmd __aligned(sizeof(pmd_t)), old_pmd;
>  	unsigned long addr;
>  	pte_t *pte;
>  	int i;
> @@ -3180,7 +3180,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
>  	struct folio *folio;
>  	struct page *page;
>  	pgtable_t pgtable;
> -	pmd_t old_pmd, _pmd;
> +	pmd_t old_pmd, _pmd __aligned(sizeof(pmd_t));
>  	bool soft_dirty, uffd_wp = false, young = false, write = false;
>  	bool anon_exclusive = false, dirty = false;
>  	unsigned long addr;

This will work; but it feels more fragile.

Re: [linus:master] [atomic] 80047d84ee: WARNING:at_include/linux/instrumented.h:#__split_huge_pmd_locked

[Arnd Bergmann]

On Tue, Nov 3, 2026, at 13:35, Sasha Levin wrote:
>
> I tried the typedef change. It works, but gcc ends up realigning the
> stack in a lot of pte/pmd code (126 more functions with Arnd's version
> in a small config, 204 with yours), including handle_mm_fault(). Just
> aligning the two locals seems simpler:

The question is how many of the other functions may be affected by the
same bug. I see a variation of the same code in vmemmap_split_pmd(),
and aligning the types is clearly the safer option here, especially
given that most 32-bit architectures already align u64 all the time
the same way that 64-bit ones do.

     Arnd

Re: [linus:master] [atomic] 80047d84ee: WARNING:at_include/linux/instrumented.h:#__split_huge_pmd_locked

[Arnd Bergmann]

On Tue, Nov 3, 2026, at 14:13, Arnd Bergmann wrote:
> On Tue, Nov 3, 2026, at 13:35, Sasha Levin wrote:
>>
>> I tried the typedef change. It works, but gcc ends up realigning the
>> stack in a lot of pte/pmd code (126 more functions with Arnd's version
>> in a small config, 204 with yours), including handle_mm_fault(). Just
>> aligning the two locals seems simpler:
>
> The question is how many of the other functions may be affected by the
> same bug. I see a variation of the same code in vmemmap_split_pmd(),
> and aligning the types is clearly the safer option here, especially
> given that most 32-bit architectures already align u64 all the time
> the same way that 64-bit ones do.

FWIW, I checked the other architectures that may be affected:

- 32-bit arm has transparent hugepages and a 64-bit pmd_t with lpae,
  but that type has natural alignment, and pmd_populate is a
  simple assignment.

- arc has transparent hugepages and a 32-bit pmd_t but a 64-bit
  pte_t that is not naturally aligned. It probably should be
  aligned, even though I don't see any actual bugs

- sh has a 64-bit pmd_t on sh4a CPUs that is not naturally
  aligned and probably should be, but there are no transparent
  hugepages.

All other 32-bit targets don't use transparent hugepages
or 64-bit pmd_t. 

We probably only need to align p?d_t though, not p?dval_t.
How about the version below?

    Arnd

diff --git a/arch/arc/include/asm/page.h b/arch/arc/include/asm/page.h
index 9720fe6b2c24..af5303459d56 100644
--- a/arch/arc/include/asm/page.h
+++ b/arch/arc/include/asm/page.h
@@ -65,7 +65,7 @@ typedef struct {
 
 typedef struct {
 #ifdef CONFIG_ARC_HAS_PAE40
-	unsigned long long pte;
+	unsigned long long pte __aligned(8);
 #else
 	unsigned long pte;
 #endif
diff --git a/arch/sh/include/asm/pgtable-3level.h b/arch/sh/include/asm/pgtable-3level.h
index d1ce73f3bd85..6d5e2e3248f2 100644
--- a/arch/sh/include/asm/pgtable-3level.h
+++ b/arch/sh/include/asm/pgtable-3level.h
@@ -33,7 +33,7 @@ typedef union {
 		unsigned long pmd_low;
 		unsigned long pmd_high;
 	};
-	unsigned long long pmd;
+	unsigned long long pmd __aligned(8);
 } pmd_t;
 #define pmd_val(x)	((x).pmd)
 #define __pmd(x)	((pmd_t) { .pmd = (x) } )
diff --git a/arch/x86/include/asm/pgtable-3level_types.h b/arch/x86/include/asm/pgtable-3level_types.h
index 580b09bf6a45..061283293341 100644
--- a/arch/x86/include/asm/pgtable-3level_types.h
+++ b/arch/x86/include/asm/pgtable-3level_types.h
@@ -16,14 +16,14 @@ typedef union {
 	struct {
 		unsigned long pte_low, pte_high;
 	};
-	pteval_t pte;
+	pteval_t pte __aligned(8);
 } pte_t;
 
 typedef union {
 	struct {
 		unsigned long pmd_low, pmd_high;
 	};
-	pmdval_t pmd;
+	pmdval_t pmd __aligned(8);
 } pmd_t;
 #endif	/* !__ASSEMBLER__ */
 
diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
index 2ec250ba467e..5c028b3f59c4 100644
--- a/arch/x86/include/asm/pgtable_types.h
+++ b/arch/x86/include/asm/pgtable_types.h
@@ -292,7 +292,7 @@ enum page_cache_mode {
 
 typedef struct pgprot { pgprotval_t pgprot; } pgprot_t;
 
-typedef struct { pgdval_t pgd; } pgd_t;
+typedef struct { pgdval_t pgd __aligned(sizeof(pgdval_t)); } pgd_t;
 
 static inline pgprot_t pgprot_nx(pgprot_t prot)
 {

Re: [linus:master] [atomic] 80047d84ee: WARNING:at_include/linux/instrumented.h:#__split_huge_pmd_locked

[Peter Zijlstra]

On Tue, Nov 03, 2026 at 02:41:32PM +0100, Arnd Bergmann wrote:

> FWIW, I checked the other architectures that may be affected:
> 
> - 32-bit arm has transparent hugepages and a 64-bit pmd_t with lpae,
>   but that type has natural alignment, and pmd_populate is a
>   simple assignment.
> 
> - arc has transparent hugepages and a 32-bit pmd_t but a 64-bit
>   pte_t that is not naturally aligned. It probably should be
>   aligned, even though I don't see any actual bugs
> 
> - sh has a 64-bit pmd_t on sh4a CPUs that is not naturally
>   aligned and probably should be, but there are no transparent
>   hugepages.
> 
> All other 32-bit targets don't use transparent hugepages
> or 64-bit pmd_t. 
> 
> We probably only need to align p?d_t though, not p?dval_t.
> How about the version below?
> 
>     Arnd
> 
> diff --git a/arch/arc/include/asm/page.h b/arch/arc/include/asm/page.h
> index 9720fe6b2c24..af5303459d56 100644
> --- a/arch/arc/include/asm/page.h
> +++ b/arch/arc/include/asm/page.h
> @@ -65,7 +65,7 @@ typedef struct {
>  
>  typedef struct {
>  #ifdef CONFIG_ARC_HAS_PAE40
> -	unsigned long long pte;
> +	unsigned long long pte __aligned(8);
>  #else
>  	unsigned long pte;
>  #endif
> diff --git a/arch/sh/include/asm/pgtable-3level.h b/arch/sh/include/asm/pgtable-3level.h
> index d1ce73f3bd85..6d5e2e3248f2 100644
> --- a/arch/sh/include/asm/pgtable-3level.h
> +++ b/arch/sh/include/asm/pgtable-3level.h
> @@ -33,7 +33,7 @@ typedef union {
>  		unsigned long pmd_low;
>  		unsigned long pmd_high;
>  	};
> -	unsigned long long pmd;
> +	unsigned long long pmd __aligned(8);
>  } pmd_t;
>  #define pmd_val(x)	((x).pmd)
>  #define __pmd(x)	((pmd_t) { .pmd = (x) } )
> diff --git a/arch/x86/include/asm/pgtable-3level_types.h b/arch/x86/include/asm/pgtable-3level_types.h
> index 580b09bf6a45..061283293341 100644
> --- a/arch/x86/include/asm/pgtable-3level_types.h
> +++ b/arch/x86/include/asm/pgtable-3level_types.h
> @@ -16,14 +16,14 @@ typedef union {
>  	struct {
>  		unsigned long pte_low, pte_high;
>  	};
> -	pteval_t pte;
> +	pteval_t pte __aligned(8);
>  } pte_t;
>  
>  typedef union {
>  	struct {
>  		unsigned long pmd_low, pmd_high;
>  	};
> -	pmdval_t pmd;
> +	pmdval_t pmd __aligned(8);
>  } pmd_t;
>  #endif	/* !__ASSEMBLER__ */
>  
> diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
> index 2ec250ba467e..5c028b3f59c4 100644
> --- a/arch/x86/include/asm/pgtable_types.h
> +++ b/arch/x86/include/asm/pgtable_types.h
> @@ -292,7 +292,7 @@ enum page_cache_mode {
>  
>  typedef struct pgprot { pgprotval_t pgprot; } pgprot_t;
>  
> -typedef struct { pgdval_t pgd; } pgd_t;
> +typedef struct { pgdval_t pgd __aligned(sizeof(pgdval_t)); } pgd_t;
>  
>  static inline pgprot_t pgprot_nx(pgprot_t prot)
>  {

This doesn't cover all of p?d_t, does it?

Re: [linus:master] [atomic] 80047d84ee: WARNING:at_include/linux/instrumented.h:#__split_huge_pmd_locked

[Andrew Morton]

On Tue, 3 Nov 2026 13:26:47 +0100 Peter Zijlstra <peterz@infradead.org> wrote:

> AFAICT this is pxx_xchg64() from the PAE code operating on an on-stack
> pmd value.
> 
> The below 'fixes' it, but the question is of course, WTF are we using an
> on-stack pmd value for set_pmd().
> 
> --- a/arch/x86/include/asm/pgtable-3level_types.h
> +++ b/arch/x86/include/asm/pgtable-3level_types.h
> @@ -5,12 +5,12 @@
>  #ifndef __ASSEMBLER__
>  #include <linux/types.h>
>  
> -typedef u64	pteval_t;
> -typedef u64	pmdval_t;
> -typedef u64	pudval_t;
> -typedef u64	p4dval_t;
> -typedef u64	pgdval_t;
> -typedef u64	pgprotval_t;
> +typedef u64 __aligned(8)	pteval_t;
> +typedef u64 __aligned(8)	pmdval_t;
> +typedef u64 __aligned(8)	pudval_t;
> +typedef u64 __aligned(8)	p4dval_t;
> +typedef u64 __aligned(8)	pgdval_t;
> +typedef u64 __aligned(8)	pgprotval_t;
>  

(cc Dave)

fwiw this was discussed a couple of years ago but nothing really came
of it.

https://lore.kernel.org/20240401185451.6897208962d3fc47a12ffb5a@otheo.eu

Re: [linus:master] [atomic] 80047d84ee: WARNING:at_include/linux/instrumented.h:#__split_huge_pmd_locked

[David Hildenbrand (Arm)]

On 11/3/26 16:43, Andrew Morton wrote:
> On Tue, 3 Nov 2026 13:26:47 +0100 Peter Zijlstra <peterz@infradead.org> wrote:
> 
>> AFAICT this is pxx_xchg64() from the PAE code operating on an on-stack
>> pmd value.
>>
>> The below 'fixes' it, but the question is of course, WTF are we using an
>> on-stack pmd value for set_pmd().
>>
>> --- a/arch/x86/include/asm/pgtable-3level_types.h
>> +++ b/arch/x86/include/asm/pgtable-3level_types.h
>> @@ -5,12 +5,12 @@
>>  #ifndef __ASSEMBLER__
>>  #include <linux/types.h>
>>  
>> -typedef u64	pteval_t;
>> -typedef u64	pmdval_t;
>> -typedef u64	pudval_t;
>> -typedef u64	p4dval_t;
>> -typedef u64	pgdval_t;
>> -typedef u64	pgprotval_t;
>> +typedef u64 __aligned(8)	pteval_t;
>> +typedef u64 __aligned(8)	pmdval_t;
>> +typedef u64 __aligned(8)	pudval_t;
>> +typedef u64 __aligned(8)	p4dval_t;
>> +typedef u64 __aligned(8)	pgdval_t;
>> +typedef u64 __aligned(8)	pgprotval_t;
>>  
> 
> (cc Dave)
> 
> fwiw this was discussed a couple of years ago but nothing really came
> of it.
> 
> https://lore.kernel.org/20240401185451.6897208962d3fc47a12ffb5a@otheo.eu

IIUC Usama has some things in the works that will avoid on-stack pmds.

-- 
Cheers,

David

Re: [linus:master] [atomic] 80047d84ee: WARNING:at_include/linux/instrumented.h:#__split_huge_pmd_locked

[Dave Hansen]

On 11/3/26 07:43, Andrew Morton wrote:
>> +typedef u64 __aligned(8)	pteval_t;
>> +typedef u64 __aligned(8)	pmdval_t;
>> +typedef u64 __aligned(8)	pudval_t;
>> +typedef u64 __aligned(8)	p4dval_t;
>> +typedef u64 __aligned(8)	pgdval_t;
>> +typedef u64 __aligned(8)	pgprotval_t;
>>  
> (cc Dave)
> 
> fwiw this was discussed a couple of years ago but nothing really came
> of it.
> 
> https://lore.kernel.org/20240401185451.6897208962d3fc47a12ffb5a@otheo.eu

Heh, same code. Same basic problem. Two different detectors firing.

But I also kinda feel like shooting the messenger on this one. The
warnings are presumably to help us with performance problems. This is
old, legacy code that nobody cares about running fast. So they're not
actually helpful here. I don't think it's the craziest thing, at least
on x86_32, to just turn the warnings off.

Also, if there are plans to get all the pmd_t's off the stack, maybe we
should just manually align them for now. It wouldn't hurt to make the
definitions uglier like:

 #define pxx_xchg64(_pxx, _ptr, _val) ({
   _pxx##val_t *_p = (_pxx##val_t *)_ptr;
-  _pxx##val_t _o = *_p;
+  _pxx##val_t _o __aligned(sizeof(_pxx##val_t)) = *_p;
   do { } while (!try_cmpxchg64(_p, &_o, (_val)));
	native_make_##_pxx(_o);
   })

or

 static int vmemmap_split_pmd(pmd_t *pmd, struct page *head, ...
 {
-        pmd_t __pmd;
+        pmd_t __pmd __aligned(sizeof(pmd_t));

Re: [linus:master] [atomic] 80047d84ee: WARNING:at_include/linux/instrumented.h:#__split_huge_pmd_locked

[Arnd Bergmann]

On Tue, Nov 3, 2026, at 17:29, Dave Hansen wrote:
> On 11/3/26 07:43, Andrew Morton wrote:
>
> Heh, same code. Same basic problem. Two different detectors firing.
>
> But I also kinda feel like shooting the messenger on this one. The
> warnings are presumably to help us with performance problems. This is
> old, legacy code that nobody cares about running fast. So they're not
> actually helpful here. I don't think it's the craziest thing, at least
> on x86_32, to just turn the warnings off.
>
> Also, if there are plans to get all the pmd_t's off the stack, maybe we
> should just manually align them for now. 

I would still prefer to align the types than the objects, if only
for the reason that the interfaces that operate on the type clearly
expect it to be aligned.

> It wouldn't hurt to make the definitions uglier like:
>
>  #define pxx_xchg64(_pxx, _ptr, _val) ({
>    _pxx##val_t *_p = (_pxx##val_t *)_ptr;
> -  _pxx##val_t _o = *_p;
> +  _pxx##val_t _o __aligned(sizeof(_pxx##val_t)) = *_p;
>    do { } while (!try_cmpxchg64(_p, &_o, (_val)));
> 	native_make_##_pxx(_o);
>    })

I initially misread the code the same way. However, the warning
here is about _p being misaligned, not &_o, so Sasha's patch
would be the one that aligns the objects.

      Arnd