From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ed1-f44.google.com (mail-ed1-f44.google.com [209.85.208.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0C64720E6E2 for ; Fri, 17 Jul 2026 17:25:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=209.85.208.44 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784309153; cv=pass; b=ZnqgWUkpTdZ7GNlqNvBPmU41aQfNIbof1FpciEEwGRYtHOlfGc+LEJCe6gQsRi2JJrKcScD+CNHl1wt92vu4YjTuhOz0yabBi6MYfD1vzB6otLZaEm+1xJnJD7AmXm7Ys3/PZycWGPnyqnYDhg6gGGBM27xCucci0bADlLCMEIs= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784309153; c=relaxed/simple; bh=+mB3/kS3AEoNmOgv4H0fRKFRDArvMmd2RS9LkRE6UxI=; h=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=VTSJlSK9UgZA0Ly+towaNqoQRjGbuhnoDdBiPbJWq66lwyllnQH4q3wpFpAtk6zZA7x/DjuaUaNilCraZpkQfWZkABojCqVfbb7eJd+ZU8PqVyVWY6VMwBnWlNJJC2iBSlrKzbVLcDH54VJ3czhlCkd8+9w8rTu23zKruderBQY= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=RyV0YSXZ; arc=pass smtp.client-ip=209.85.208.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="RyV0YSXZ" Received: by mail-ed1-f44.google.com with SMTP id 4fb4d7f45d1cf-69a19eb2e6dso16747a12.1 for ; Fri, 17 Jul 2026 10:25:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1784309150; cv=none; d=google.com; s=arc-20260327; b=CSK0T9Y06VbsjwCDZmieLwl8G0UAg3gT23cxuQkZLDA5ITiXyZUxTc0fnnFaxtm0nZ DLNacuGxZA3iSkUVtFzmhzQwq3JBMrOrMc+/e9wr1y/FyDOCF9plX/mYRv8dABq7z8DI 6JcdhTcE2O2Vrf+jLPK0vMKlBDgCVFuoBjEe6xAjjE3EaUDyP975axaBtEQn2J9bgQEf zNl9+eZ51iwT3et8aZLo4b4ASelEcV+kz6yvaZV+Dk9Q1qG3RVqwFVkcoAnaCuI6n1f8 sWsWq4Fv43Muq0Z83ffX/UAd/KwnGMquc5TWpqYjNFIgGkTjChR5x5n9LK+ce2hr/bVv c4dA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:dkim-signature; bh=vn+vPcBR7yKw800EHGrmkJfxwiILybxPqqHpaIR8qUU=; fh=5oxkRMo6PW6UZ8idWozVIQZRZtPlRHtZy9jKsnpT4+w=; b=d+Gh85FIsYRLcwrmiR38PmXPsgmgvlcRL4W9Y1ENJM/JU2g9mf60aCY0QoGmqEjV74 NfxeFnYjnxtLqyuTV+9m528GOFpSK3x5Hn0VWnDjs1eomiszTtdWHLbcUxT+PrgGXyFw j6uJcuR9nQsLHEC0Mxe8ygfWSoromRcV8cvUw5XlzpUmsgzRvXsoILME3/lgm7mS1kYI nbz4NWirZrRiTxbno+4xwY4sYuVfB31TQ4yGfIVGG77JFEwmnS3n5cKZHwBSoUvHK5St PEK5j8QtBwXGnSXfI9RpEUtdzqDnNzi540d+RgNGftNcCOJl1/Irb2KHd24k/P0jpUSp Hnsw==; darn=vger.kernel.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1784309150; x=1784913950; darn=vger.kernel.org; h=content-transfer-encoding:content-type:cc:to:subject:message-id :date:from:in-reply-to:references:mime-version:from:to:cc:subject :date:message-id:reply-to:content-type; bh=vn+vPcBR7yKw800EHGrmkJfxwiILybxPqqHpaIR8qUU=; b=RyV0YSXZsnZAeZ6fmqFAntRrlX/XGOBFT3rE3aXgmILjBw+UrDHtgf1MdSMA2Zx96D /W75i2vtWs4gQQhA092+bRKAiOl4goD8fGM9o0Pxfi7/LImNd/s2q7gAya3NnRforp5X LPWVq9+p3onNJJghqJaIGJMfDRwG5LxnCIxIEzLiw11igwfJ6MrMoXndfyrWo5fragMY C6m+8J7NRlw//A9j6KQDho7qtxh3UBu0zEuBHigFcLHEQEZIrAFYc6PXLOuq19Rn/PgY 2vI2j5S8XoFRrw52ddY178dQFlQ+jQhncEkhEuk5Tyfw8cQ6m7IpZn3yzvCKBVY1wUi8 DFhQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784309150; x=1784913950; h=content-transfer-encoding:content-type:cc:to:subject:message-id :date:from:in-reply-to:references:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=vn+vPcBR7yKw800EHGrmkJfxwiILybxPqqHpaIR8qUU=; b=SlmDgbnj6waFUrd8EiKpd+Xqd6ydkkEOMpQEukhQbh88z7oyfWBcYlrmBru3FL8SsP Kd3LmQKIpgDljCAXiwh0dkESLiVcmjjbkiqFoYAF3uqB9kxDIFkS60OMr4DPNDePHWf2 rIuYT5uloIDqfNM6XXfqtD31UqZIw+5VCQdjR7Zxie53qW2vHzhooXi9HyZDk4N+gUW0 F1dBjm3kMz5Sfs7Ozo4JINDwmj+qcK5Ck9olYb2kSArMxQY2ntWC0sYUHoiOeBeZKGm8 2iy0s38Rg5Lhhib8XKP92UpJnUKtmQX+Vu26oKhWdMjGuBahCBuJK79w+/xZhSJl0h1W /UPA== X-Forwarded-Encrypted: i=1; AHgh+RpehGBgkKO41h48LSUV/47OaFSHL0FEJ9wiIT22fceEgNurPNJGmKUce6q/axhFVW7umJ7TLrsDU87xJYw=@vger.kernel.org X-Gm-Message-State: AOJu0YyOLQLsrdsn4o26TQWH/mejwXHZIz9OV/7Nc0mf8sQ6es7vDxVk W0mlgGmax1R9fS45qLGBij3qbs8+ff6PVR3l0QwkvapzQbd6xil0vMFNt0A+QhhqFDTRTkZF7H5 XJihOhoUTj3xfyjAXKn60d2KzCMJRILeCIub+Gbtt5TvqhQe+gD36/R1XHKs= X-Gm-Gg: AfdE7cmW3uUCvMtMNd0R1/Bna6TvXGTLDVAY0Ry9df7Hvb6cNan8AX4+DfnRcd0bRoL UuhGcCf2Mdvt0W3knUyXKfHf7+ahLWmHITLR0jRH4xCjJgRGWpO6uwTDCEoCPJ2qfWqvOmrdJsU /1aWKsUXeqgWSPRQAras77d2EQxYU12F3f/VuZUu9Mh4mpj63B51mcEpJ/VMeh4ZY+nY6OlW+hm xlg6csWtII43oHtaxOgucq5wM399tNzEm3Dq9fPL4tNRPH3cx9Vm3U8Puvb X-Received: by 2002:a05:6402:1244:b0:68a:e1ba:9cc0 with SMTP id 4fb4d7f45d1cf-69e89ac9e37mr2887a12.8.1784309149795; Fri, 17 Jul 2026 10:25:49 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 References: <20260717134028.2880508-1-mclapinski@google.com> In-Reply-To: From: =?UTF-8?B?TWljaGHFgiBDxYJhcGnFhHNraQ==?= Date: Fri, 17 Jul 2026 19:25:38 +0200 X-Gm-Features: AUfX_mwtqaEj54b9UO72Tsip-eG3KMthhMEZ491YyqaB1ESSnxwLuQFSVqeb19A Message-ID: Subject: Re: [PATCH v2] kho: align kho_scratch to MAX_ORDER_NR_PAGES pages To: Pasha Tatashin Cc: Mike Rapoport , Pratyush Yadav , Alexander Graf , Evangelos Petrongonas , kexec@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Fri, Jul 17, 2026 at 6:21=E2=80=AFPM Pasha Tatashin wrote: > > On 07-17 15:40, Michal Clapinski wrote: > > While booting with KHO, the following crash was observed: > > > > BUG: unable to handle page fault for address: ff19164fffff8328 > > RIP: 0010:__free_one_page+0x1a1/0x6b0 > > Call Trace: > > > > [] free_one_page+0xaf/0x240 > > [] deferred_free_pages+0xa8/0xd0 > > [] deferred_init_memmap_chunk+0x10f/0x1b0 > > [] padata_mt_helper+0x65/0xa0 > > [] process_scheduled_works+0x202/0x410 > > [] worker_thread+0x1f9/0x2d0 > > [] kthread+0x27d/0x2f0 > > [] ? __pfx_worker_thread+0x10/0x10 > > [] ? __pfx_kthread+0x10/0x10 > > [] ret_from_fork+0x145/0x280 > > [] ? __pfx_kthread+0x10/0x10 > > [] ret_from_fork_asm+0x1a/0x30 > > > > > > deferred_init_memmap_chunk() interleaves initialization of struct pages > > with freeing them. This works fine without KHO because free regions > > will never be neighbors. However, with KHO, free memory will be split > > into (free && scratch) and (free && !scratch), which can be neighbors. > > > > KHO scratch is aligned to CMA_MIN_ALIGNMENT_PAGES pages but buddy looks > > at the neighborhood of MAX_ORDER_NR_PAGES pages. These values are > > configurable but CMA_MIN_ALIGNMENT_PAGES is always less or equal to > > MAX_ORDER_NR_PAGES. In the crashing configuration they were set as > > follows: > > CMA_MIN_ALIGNMENT_PAGES =3D 1 << 9 > > MAX_ORDER_NR_PAGES =3D 1 << 10 > > > > So while freeing one chunk, buddy accessed uninitialized struct pages > > from another chunk, tried to merge the blocks and crashed. > > > > To fix this, let's just align KHO scratch to MAX_ORDER_NR_PAGES pages. > > > > Fixes: c6073743d0c7 ("kho: make preserved pages compatible with deferre= d struct page init") > > Signed-off-by: Michal Clapinski > > --- > > Unfortunately, this is very hard to catch, so I don't have a good > > reproducer. But I run the code with the fix through extensive testing > > and it seems fine. > > I think I've never caught it before because enabling HUGETLB is what > > causes CMA_MIN_ALIGNMENT_PAGES to be 1 << 9, instead of 1 << 10. > > > > If this passes review, please cherry-pick it to 7.2 so we don't release > > a broken kernel. > > A changelog would be super helful here. Sorry, forgot. Changelog: - functionally it's exactly the same - changed SCRATCH_ALIGNMENT_BYTES to be calculated using multiplication instead of binary shift - updated the commit msg as Mike asked - rebased on top of liveupdate/next > Pasha > > > --- > > kernel/liveupdate/kexec_handover.c | 22 ++++++++++++++++------ > > 1 file changed, 16 insertions(+), 6 deletions(-) > > > > diff --git a/kernel/liveupdate/kexec_handover.c b/kernel/liveupdate/kex= ec_handover.c > > index 4834a809985a..175c08a6e41e 100644 > > --- a/kernel/liveupdate/kexec_handover.c > > +++ b/kernel/liveupdate/kexec_handover.c > > @@ -38,6 +38,16 @@ > > #include "../kexec_internal.h" > > #include "kexec_handover_internal.h" > > > > +/* > > + * This is the minimal alignment required by deferred struct page init= . > > + * deferred_init_memmap_chunk frees memory to the buddy allocator, whi= ch looks > > + * at the neighboring pages (up to MAX_PAGE_ORDER) to merge them. > > + * If KHO scratch is not aligned to that value, buddy can access unini= tialized > > + * struct pages, which can cause a crash. > > + */ > > +#define SCRATCH_ALIGNMENT_BYTES (PAGE_SIZE * MAX_ORDER_NR_PAGES) > > +static_assert(SCRATCH_ALIGNMENT_BYTES >=3D CMA_MIN_ALIGNMENT_BYTES); > > + > > /* The magic token for preserved pages */ > > #define KHO_PAGE_MAGIC 0x4b484f50U /* ASCII for 'KHOP' */ > > > > @@ -640,8 +650,8 @@ static void __init scratch_size_update(void) > > * Scratch areas are released as MIGRATE_CMA. Round them up to th= e right > > * size. > > */ > > - scratch_size_lowmem =3D round_up(scratch_size_lowmem, CMA_MIN_ALI= GNMENT_BYTES); > > - scratch_size_global =3D round_up(scratch_size_global, CMA_MIN_ALI= GNMENT_BYTES); > > + scratch_size_lowmem =3D round_up(scratch_size_lowmem, SCRATCH_ALI= GNMENT_BYTES); > > + scratch_size_global =3D round_up(scratch_size_global, SCRATCH_ALI= GNMENT_BYTES); > > } > > > > static phys_addr_t __init scratch_size_node(int nid) > > @@ -656,7 +666,7 @@ static phys_addr_t __init scratch_size_node(int nid= ) > > size =3D scratch_size_pernode; > > } > > > > - return round_up(size, CMA_MIN_ALIGNMENT_BYTES); > > + return round_up(size, SCRATCH_ALIGNMENT_BYTES); > > } > > > > /** > > @@ -692,7 +702,7 @@ static void __init kho_reserve_scratch(void) > > * next kernel > > */ > > size =3D scratch_size_lowmem; > > - addr =3D memblock_phys_alloc_range(size, CMA_MIN_ALIGNMENT_BYTES,= 0, > > + addr =3D memblock_phys_alloc_range(size, SCRATCH_ALIGNMENT_BYTES,= 0, > > ARCH_LOW_ADDRESS_LIMIT); > > if (!addr) { > > pr_err("Failed to reserve lowmem scratch buffer\n"); > > @@ -705,7 +715,7 @@ static void __init kho_reserve_scratch(void) > > > > /* reserve large contiguous area for allocations without nid */ > > size =3D scratch_size_global; > > - addr =3D memblock_phys_alloc(size, CMA_MIN_ALIGNMENT_BYTES); > > + addr =3D memblock_phys_alloc(size, SCRATCH_ALIGNMENT_BYTES); > > if (!addr) { > > pr_err("Failed to reserve global scratch buffer\n"); > > goto err_free_scratch_areas; > > @@ -721,7 +731,7 @@ static void __init kho_reserve_scratch(void) > > */ > > for_each_node_state(nid, N_MEMORY) { > > size =3D scratch_size_node(nid); > > - addr =3D memblock_alloc_range_nid(size, CMA_MIN_ALIGNMENT= _BYTES, > > + addr =3D memblock_alloc_range_nid(size, SCRATCH_ALIGNMENT= _BYTES, > > 0, MEMBLOCK_ALLOC_ACCESSI= BLE, > > nid, true); > > if (!addr) { > > -- > > 2.55.0.229.g6434b31f56-goog > >