[PATCH v2] mm/page_alloc: mark pages freed by __free_pages_core() as not tagged

[PATCH v2] mm/page_alloc: mark pages freed by __free_pages_core() as not tagged

[Zenghui Yu]

From: "Zenghui Yu (Huawei)" <zenghui.yu@linux.dev>

Onlining hotplugged memory (e.g., a dev_dax device bound to kmem) with
CONFIG_MEM_ALLOC_PROFILING_DEBUG triggers:

  alloc_tag was not set
  WARNING: ./include/linux/alloc_tag.h:166 at __pgalloc_tag_sub+0x1fc/0x254
  Call trace:
   __pgalloc_tag_sub+0x1fc/0x254 (P)
   __free_pages_ok+0x14c/0x6ac
   __free_pages_core+0xa8/0x188
   generic_online_page+0x14/0x20
   online_pages+0x220/0x3b0
   memory_subsys_online+0xfc/0x198
   device_online+0x58/0xe0
   state_store+0xf0/0xf8

Pages entering the buddy through __free_pages_core() have never been
allocated, so their allocation tag references are NULL.  The free path,
__free_pages_prepare() -> pgalloc_tag_sub(), expects a valid tag or a
CODETAG_EMPTY mark and warns otherwise.  Paths feeding never-allocated
pages into the buddy are therefore expected to mark them with
clear_page_tag_ref() first, like init_cma_reserved_pageblock() and
free_reserved_pages() do; of __free_pages_core()'s callers only
memblock_free_pages() clears the tag ref itself, and the hotplug
onlining path was missed.

Since all __free_pages_core() callers free never-allocated pages, mark the
head page as not tagged in __free_pages_core() itself instead of relying on
each caller, and drop the now-redundant clearing from
memblock_free_pages().

Signed-off-by: Zenghui Yu (Huawei) <zenghui.yu@linux.dev>
---

* From v1 [1]:
  - Clear the tag ref once on the head page in __free_pages_core() for both
    meminit contexts, instead of once per page in the MEMINIT_HOTPLUG loop
    (Sashiko)

[1] https://lore.kernel.org/20261020161053.59879-1-zenghui.yu@linux.dev

 mm/mm_init.c    | 2 --
 mm/page_alloc.c | 3 +++
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/mm/mm_init.c b/mm/mm_init.c
index 01fb46be3d25..92e4a78207ca 100644
--- a/mm/mm_init.c
+++ b/mm/mm_init.c
@@ -2475,8 +2475,6 @@ void __init memblock_free_pages(unsigned long pfn, unsigned int order)
 		return;
 	}
 
-	/* pages were reserved and not allocated */
-	clear_page_tag_ref(page);
 	__free_pages_core(page, order, MEMINIT_EARLY);
 }
 
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index e71e514ea18d..0396c50b96f0 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1617,6 +1617,9 @@ void __meminit __free_pages_core(struct page *page, unsigned int order,
 		atomic_long_add(nr_pages, &page_zone(page)->managed_pages);
 	}
 
+	/* pages were never allocated */
+	clear_page_tag_ref(page);
+
 	if (page_contains_unaccepted(page, order)) {
 		if (order == MAX_PAGE_ORDER && __free_unaccepted(page))
 			return;
-- 
2.56.0

Re: [PATCH v2] mm/page_alloc: mark pages freed by __free_pages_core() as not tagged

[Johannes Weiner]

On Thu, Oct 22, 2026 at 08:27:52PM +0800, Zenghui Yu wrote:
> From: "Zenghui Yu (Huawei)" <zenghui.yu@linux.dev>
> 
> Onlining hotplugged memory (e.g., a dev_dax device bound to kmem) with
> CONFIG_MEM_ALLOC_PROFILING_DEBUG triggers:
> 
>   alloc_tag was not set
>   WARNING: ./include/linux/alloc_tag.h:166 at __pgalloc_tag_sub+0x1fc/0x254
>   Call trace:
>    __pgalloc_tag_sub+0x1fc/0x254 (P)
>    __free_pages_ok+0x14c/0x6ac
>    __free_pages_core+0xa8/0x188
>    generic_online_page+0x14/0x20
>    online_pages+0x220/0x3b0
>    memory_subsys_online+0xfc/0x198
>    device_online+0x58/0xe0
>    state_store+0xf0/0xf8
> 
> Pages entering the buddy through __free_pages_core() have never been
> allocated, so their allocation tag references are NULL.  The free path,
> __free_pages_prepare() -> pgalloc_tag_sub(), expects a valid tag or a
> CODETAG_EMPTY mark and warns otherwise.  Paths feeding never-allocated
> pages into the buddy are therefore expected to mark them with
> clear_page_tag_ref() first, like init_cma_reserved_pageblock() and
> free_reserved_pages() do; of __free_pages_core()'s callers only
> memblock_free_pages() clears the tag ref itself, and the hotplug
> onlining path was missed.
> 
> Since all __free_pages_core() callers free never-allocated pages, mark the
> head page as not tagged in __free_pages_core() itself instead of relying on
> each caller, and drop the now-redundant clearing from
> memblock_free_pages().
> 
> Signed-off-by: Zenghui Yu (Huawei) <zenghui.yu@linux.dev>

Reviewed-by: Johannes Weiner <hannes@cmpxchg.org>