commit 4eeec8c89a0c ("mm: move hugetlb specific things in folio to page[3]")
shifted hugetlb specific stuff, and now mapping overlaps _hugetlb_cgroup field.

Upon restoring the vmemmap for HVO, only the first two tail pages are reset, and
this causes the check in free_tail_page_prepare() to fail as it finds
an unexpected mapping value in some tails.

Increment the number of pages to be reset to 4 (head + 3 tail pages)

Fixes: 4eeec8c89a0c ("mm: move hugetlb specific things in folio to page[3]")
Suggested-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Oscar Salvador <osalvador@suse.de>
---
 mm/hugetlb_vmemmap.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/mm/hugetlb_vmemmap.c b/mm/hugetlb_vmemmap.c
index 9a99dfa3c495..27245e86df25 100644
--- a/mm/hugetlb_vmemmap.c
+++ b/mm/hugetlb_vmemmap.c
@@ -238,11 +238,11 @@ static void vmemmap_remap_pte(pte_t *pte, unsigned long addr,
  * struct page, the special metadata (e.g. page->flags or page->mapping)
  * cannot copy to the tail struct page structs. The invalid value will be
  * checked in the free_tail_page_prepare(). In order to avoid the message
- * of "corrupted mapping in tail page". We need to reset at least 3 (one
- * head struct page struct and two tail struct page structs) struct page
+ * of "corrupted mapping in tail page". We need to reset at least 4 (one
+ * head struct page struct and three tail struct page structs) struct page
  * structs.
  */
-#define NR_RESET_STRUCT_PAGE		3
+#define NR_RESET_STRUCT_PAGE		4
 
 static inline void reset_struct_pages(struct page *start)
 {
-- 
2.49.0

> On Apr 15, 2025, at 19:18, Oscar Salvador <osalvador@suse.de> wrote:
> 
> commit 4eeec8c89a0c ("mm: move hugetlb specific things in folio to page[3]")
> shifted hugetlb specific stuff, and now mapping overlaps _hugetlb_cgroup field.
> 
> Upon restoring the vmemmap for HVO, only the first two tail pages are reset, and
> this causes the check in free_tail_page_prepare() to fail as it finds
> an unexpected mapping value in some tails.
> 
> Increment the number of pages to be reset to 4 (head + 3 tail pages)
> 
> Fixes: 4eeec8c89a0c ("mm: move hugetlb specific things in folio to page[3]")
> Suggested-by: David Hildenbrand <david@redhat.com>
> Signed-off-by: Oscar Salvador <osalvador@suse.de>

Reviewed-by: Muchun Song <muchun.song@linux.dev>

Thanks.

On 15.04.25 13:18, Oscar Salvador wrote:
> commit 4eeec8c89a0c ("mm: move hugetlb specific things in folio to page[3]")
> shifted hugetlb specific stuff, and now mapping overlaps _hugetlb_cgroup field.
> 
> Upon restoring the vmemmap for HVO, only the first two tail pages are reset, and
> this causes the check in free_tail_page_prepare() to fail as it finds
> an unexpected mapping value in some tails.
> 
> Increment the number of pages to be reset to 4 (head + 3 tail pages)
> 
> Fixes: 4eeec8c89a0c ("mm: move hugetlb specific things in folio to page[3]")
> Suggested-by: David Hildenbrand <david@redhat.com>
> Signed-off-by: Oscar Salvador <osalvador@suse.de>
> ---
>   mm/hugetlb_vmemmap.c | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/mm/hugetlb_vmemmap.c b/mm/hugetlb_vmemmap.c
> index 9a99dfa3c495..27245e86df25 100644
> --- a/mm/hugetlb_vmemmap.c
> +++ b/mm/hugetlb_vmemmap.c
> @@ -238,11 +238,11 @@ static void vmemmap_remap_pte(pte_t *pte, unsigned long addr,
>    * struct page, the special metadata (e.g. page->flags or page->mapping)
>    * cannot copy to the tail struct page structs. The invalid value will be
>    * checked in the free_tail_page_prepare(). In order to avoid the message
> - * of "corrupted mapping in tail page". We need to reset at least 3 (one
> - * head struct page struct and two tail struct page structs) struct page
> + * of "corrupted mapping in tail page". We need to reset at least 4 (one
> + * head struct page struct and three tail struct page structs) struct page
>    * structs.
>    */
> -#define NR_RESET_STRUCT_PAGE		3
> +#define NR_RESET_STRUCT_PAGE		4
>   
>   static inline void reset_struct_pages(struct page *start)
>   {

Thanks!

Reviewed-by: David Hildenbrand <david@redhat.com>


-- 
Cheers,

David / dhildenb