[PATCH] mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()

[PATCH] mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()

[Zi Yan]

In pcpu_create_chunk(), nr_pages is the total contiguous backing
allocation, i.e., nr_units * pcpu_unit_pages, but pcpu_chunk_populated()
uses it to set chunk->populated, whose size is pcpu_unit_pages, bitmap.
Since bit N in chunk->populated means page offset N inside every unit is
backed. When nr_units > 1, the function writes beyond chunk->populated. Fix
it by using chunk->nr_pages.

It also fixes the global pcpu_nr_empty_pop_pages accounting, since
pcpu_balance_free() only iterates up to chunk->nr_pages.

Commit a63d4ac4ab609 ("percpu: make percpu-km set chunk->populated bitmap
properly") introduced the bitmap overflow issue. Later,
commit b539b87fed37f ("percpu: implmeent pcpu_nr_empty_pop_pages and
chunk->nr_populated") added pcpu_nr_empty_pop_pages and caused the
accounting issue.

Fixes: a63d4ac4ab609 ("percpu: make percpu-km set chunk->populated bitmap properly")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260703-keep-subpage-private-zero-at-free-v2-0-2970fe777dd6%40nvidia.com?part=1
Assisted-by: Codex:GPT-5
Signed-off-by: Zi Yan <ziy@nvidia.com>
---
To make nr_units > 1 in percpu-km, we need SMP && !MMU && NEED_PER_CPU_KM.
RISC-V can have SMP && !MMU. SH J2 can have it too. The kconfig analysis is
done by Codex.
---
 mm/percpu-km.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/percpu-km.c b/mm/percpu-km.c
index 7ffe84adadb9d..65fd5580e4472 100644
--- a/mm/percpu-km.c
+++ b/mm/percpu-km.c
@@ -75,7 +75,7 @@ static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp)
 	chunk->base_addr = page_address(pages);
 
 	spin_lock_irqsave(&pcpu_lock, flags);
-	pcpu_chunk_populated(chunk, 0, nr_pages);
+	pcpu_chunk_populated(chunk, 0, chunk->nr_pages);
 	spin_unlock_irqrestore(&pcpu_lock, flags);
 
 	pcpu_stats_chunk_alloc();

---
base-commit: 59e34180e138a293260301c139cf7ee800978533
change-id: 20260709-fix-pcpu_create_chunk-in-percpu-km-6dfa8f28b175

Best regards,
-- 
Yan, Zi

Re: [PATCH] mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()

[Zi Yan]

On Thu Jul 9, 2026 at 3:12 PM EDT, Zi Yan wrote:
> In pcpu_create_chunk(), nr_pages is the total contiguous backing
> allocation, i.e., nr_units * pcpu_unit_pages, but pcpu_chunk_populated()
> uses it to set chunk->populated, whose size is pcpu_unit_pages, bitmap.
> Since bit N in chunk->populated means page offset N inside every unit is
> backed. When nr_units > 1, the function writes beyond chunk->populated. Fix
> it by using chunk->nr_pages.
>
> It also fixes the global pcpu_nr_empty_pop_pages accounting, since
> pcpu_balance_free() only iterates up to chunk->nr_pages.
>
> Commit a63d4ac4ab609 ("percpu: make percpu-km set chunk->populated bitmap
> properly") introduced the bitmap overflow issue. Later,
> commit b539b87fed37f ("percpu: implmeent pcpu_nr_empty_pop_pages and
> chunk->nr_populated") added pcpu_nr_empty_pop_pages and caused the
> accounting issue.

A gentle ping on this patch. It would be great to get some feedback.
Thanks.

>
> Fixes: a63d4ac4ab609 ("percpu: make percpu-km set chunk->populated bitmap properly")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/patchset/20260703-keep-subpage-private-zero-at-free-v2-0-2970fe777dd6%40nvidia.com?part=1
> Assisted-by: Codex:GPT-5
> Signed-off-by: Zi Yan <ziy@nvidia.com>
> ---
> To make nr_units > 1 in percpu-km, we need SMP && !MMU && NEED_PER_CPU_KM.
> RISC-V can have SMP && !MMU. SH J2 can have it too. The kconfig analysis is
> done by Codex.
> ---
>  mm/percpu-km.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/mm/percpu-km.c b/mm/percpu-km.c
> index 7ffe84adadb9d..65fd5580e4472 100644
> --- a/mm/percpu-km.c
> +++ b/mm/percpu-km.c
> @@ -75,7 +75,7 @@ static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp)
>  	chunk->base_addr = page_address(pages);
>  
>  	spin_lock_irqsave(&pcpu_lock, flags);
> -	pcpu_chunk_populated(chunk, 0, nr_pages);
> +	pcpu_chunk_populated(chunk, 0, chunk->nr_pages);
>  	spin_unlock_irqrestore(&pcpu_lock, flags);
>  
>  	pcpu_stats_chunk_alloc();
>
> ---
> base-commit: 59e34180e138a293260301c139cf7ee800978533
> change-id: 20260709-fix-pcpu_create_chunk-in-percpu-km-6dfa8f28b175
>
> Best regards,




-- 
Best Regards,
Yan, Zi

Re: [PATCH] mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()

[Dennis Zhou]

Hi Zi,

On Mon, Jul 20, 2026 at 03:20:31PM -0400, Zi Yan wrote:
> On Thu Jul 9, 2026 at 3:12 PM EDT, Zi Yan wrote:
> > In pcpu_create_chunk(), nr_pages is the total contiguous backing
> > allocation, i.e., nr_units * pcpu_unit_pages, but pcpu_chunk_populated()
> > uses it to set chunk->populated, whose size is pcpu_unit_pages, bitmap.
> > Since bit N in chunk->populated means page offset N inside every unit is
> > backed. When nr_units > 1, the function writes beyond chunk->populated. Fix
> > it by using chunk->nr_pages.
> >
> > It also fixes the global pcpu_nr_empty_pop_pages accounting, since
> > pcpu_balance_free() only iterates up to chunk->nr_pages.
> >
> > Commit a63d4ac4ab609 ("percpu: make percpu-km set chunk->populated bitmap
> > properly") introduced the bitmap overflow issue. Later,
> > commit b539b87fed37f ("percpu: implmeent pcpu_nr_empty_pop_pages and
> > chunk->nr_populated") added pcpu_nr_empty_pop_pages and caused the
> > accounting issue.
> 
> A gentle ping on this patch. It would be great to get some feedback.
> Thanks.
> 

Sorry, this is right and I missed it years ago.

Acked-by: Dennis Zhou <dennis@kernel.org>

Thanks,
Dennis