From nobody Sun Jun 7 02:07:40 2026 Received: from stravinsky.debian.org (stravinsky.debian.org [82.195.75.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 11106481FCE; Wed, 13 May 2026 15:39:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=82.195.75.108 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778686796; cv=none; b=dl2oGNnrb5tRZ+EuF+KGgvFTySKGOTg9f7oTS7rf0BRh5TyfvfpLvj0r/0B8AyCClqPR90oWjZnL/2haE8N6ky+LzmtxW4WE9/ht8l1mn0ZgQGes3nl5grN1dqkjl/NSYS4QVSC8/XxowhFTuN0/NP6nUnW6OsVhABSxnAG1TPE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778686796; c=relaxed/simple; bh=YmqAu0MKBmjqTPY6Xp2AGwlYrj86HgU7CFNy45dVm1c=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=mLXct5jWlKx79hhzjxnaad49M2bnbFHKWHT5TlXjOb1LAoZRPX3LihgClkr9sTxcTfnUeNP+RBOisyCTBIn+kN8a4Z+dJJephgU8K/WdCMbznbF2XRgAHp3D7zasw9dAWmZvhoAQEUZPL8MVIdNGnvHMMJUTvCl4UuWc3OyuYeM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=debian.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b=C5kavAJm; arc=none smtp.client-ip=82.195.75.108 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=debian.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b="C5kavAJm" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Cc:To:In-Reply-To:References: Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date: From:Reply-To:Content-ID:Content-Description; bh=0VwvF1KgbgTaLhH80dAvDE3biS5CMTVSVvUy9k323TY=; b=C5kavAJmTRWLHmHzyxTmOyzeRl Mu52fHbNn/G+fEXkrw3hiKPilsD8htg2JoySqpmLBduOs+nocpw2b8LkpalYG2anjI3cGaXaYdwzx tQcYX6WrYqFNwAuoMdljS9acv+yYKCTCu27Puir849T2C/oQfodj+LSptbrnZKY1hcPLCXZL7pYsf AHU1jap2iBoBmh/oj5zvK89b2UKq5Yhs/H6+9gH0CU5bOzEIcrvtQ+mi73gH4DZizL9pRG7bjQJSR 8VMIzjrPgevFU6uqK50LI+TNyOHULSr9MLIO6CsoaAAdMNCflUgci5IaC5i+e7B6UH3/8PhTS1ZAO 2xgZOGOw==; Received: from authenticated user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from ) id 1wNBgd-003GTl-1Y; Wed, 13 May 2026 15:39:51 +0000 From: Breno Leitao Date: Wed, 13 May 2026 08:39:32 -0700 Subject: [PATCH v7 1/6] mm/memory-failure: drop dead error_states[] entry for reserved pages Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260513-ecc_panic-v7-1-be2e578e61da@debian.org> References: <20260513-ecc_panic-v7-0-be2e578e61da@debian.org> In-Reply-To: <20260513-ecc_panic-v7-0-be2e578e61da@debian.org> To: Miaohe Lin , Andrew Morton , David Hildenbrand , Lorenzo Stoakes , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Shuah Khan , Naoya Horiguchi , Steven Rostedt , Masami Hiramatsu , Mathieu Desnoyers , Jonathan Corbet , Shuah Khan , "Liam R. Howlett" , "Liam R. Howlett" Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-kselftest@vger.kernel.org, Breno Leitao , linux-trace-kernel@vger.kernel.org, kernel-team@meta.com X-Mailer: b4 0.16-dev-d5d98 X-Developer-Signature: v=1; a=openpgp-sha256; l=2996; i=leitao@debian.org; h=from:subject:message-id; bh=YmqAu0MKBmjqTPY6Xp2AGwlYrj86HgU7CFNy45dVm1c=; b=owEBbQKS/ZANAwAIATWjk5/8eHdtAcsmYgBqBJs6ke4HsS3R5O/j/KZISqMDE5tmdj17JHj2r gYZdMUqt5WJAjMEAAEIAB0WIQSshTmm6PRnAspKQ5s1o5Of/Hh3bQUCagSbOgAKCRA1o5Of/Hh3 bTghD/90CfcSo04fggOfDUaE1JFJXqEA/MFDTRoBPWRGgXosrYL07rW5qF0YPnv7+VS6Lw8SL3W eDc6QdNVpIThXaZ7mkA90LioCvk3FpsSg4mSv29bAockiYO4UnvicP499yMUKbvwD8MuXoqnCBo UA7E04FJKDmbVxhjI9sEwpXKRSlGiasqyFEODsK3aHf9a37apm1kpVO0cihxy9AKbeVHMbFDjhl kk04DtPsPGQ+yxNQFLGskcYdrsAiSFyWMCautYu6QVWGeVxpSnz/I0Zj/a2n7tEAQuGMW3iNKKo XXiaqDfiOQCnlRK9JFzIFmlGMbHNsrBjX42q1MCtdKMzWhAsFow7LpA9U69iMDmGjSTvAhUswHK 1H4gCFCrXmEt+nJYLYLdx5dtzXGbiI9eTyO0iL08veDqgwg7mY5u8XBEdeQS4bgRmI4+y2+DCpi 06m0BYrhJJZu9cC0fPJXeWdyMRIZat9lXQYpc1x0o6NzJMHN1QeDDErQaoYgVw3N4qT4Q1d4512 KqFTdWrUhunznnlJy3E8l7+jP1RoI6YIZweDcmOc7QSSl03QeLohU4wJQVirWnUCTwgx+YTgsLJ UG8McwNHWspfdKqqaCBdoaKorLST1bFrvc96W1YQhqtmD52sRVbi1ZpyeMDH0bByuyTvLgpQgdL YwRIMi2HHPGHISQ== X-Developer-Key: i=leitao@debian.org; a=openpgp; fpr=AC8539A6E8F46702CA4A439B35A3939FFC78776D X-Debian-User: leitao The first entry of error_states[], { reserved, reserved, MF_MSG_KERNEL, me_kernel }, is unreachable. identify_page_state() has two callers, and neither one can dispatch a PG_reserved page to me_kernel(): * memory_failure() reaches identify_page_state() only after get_hwpoison_page() returned 1. get_any_page() reaches that return only via __get_hwpoison_page(), which gates the refcount on HWPoisonHandlable(). HWPoisonHandlable() rejects PG_reserved pages, so they fail with -EBUSY/-EIO long before identify_page_state() runs. * try_memory_failure_hugetlb() reaches identify_page_state() on the MF_HUGETLB_IN_USED branch, but the page is necessarily a hugetlb folio there. The first table entry that matches a hugetlb folio is { head, head, MF_MSG_HUGE, me_huge_page }, so they dispatch to me_huge_page() before the (now-removed) reserved entry would have matched, regardless of whether PG_reserved happens to be set on the head page. me_kernel() never executes and the entry exists only to be matched against by code that cannot see it. Drop the entry, the me_kernel() helper, and the now-unused "reserved" macro. Leave the MF_MSG_KERNEL enum value in place: it remains part of the tracepoint and pr_err() string tables, and follow-on work to classify unrecoverable kernel pages can reuse it without churning the user-visible enum. No functional change. Suggested-by: David Hildenbrand Signed-off-by: Breno Leitao Acked-by: David Hildenbrand (Arm) Acked-by: Miaohe Lin Reviewed-by: Lance Yang --- mm/memory-failure.c | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 866c4428ac7ef..49bcfbd04d213 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -992,17 +992,6 @@ static bool has_extra_refcount(struct page_state *ps, = struct page *p, return false; } =20 -/* - * Error hit kernel page. - * Do nothing, try to be lucky and not touch this instead. For a few cases= we - * could be more sophisticated. - */ -static int me_kernel(struct page_state *ps, struct page *p) -{ - unlock_page(p); - return MF_IGNORED; -} - /* * Page in unknown state. Do nothing. * This is a catch-all in case we fail to make sense of the page state. @@ -1211,10 +1200,8 @@ static int me_huge_page(struct page_state *ps, struc= t page *p) #define mlock (1UL << PG_mlocked) #define lru (1UL << PG_lru) #define head (1UL << PG_head) -#define reserved (1UL << PG_reserved) =20 static struct page_state error_states[] =3D { - { reserved, reserved, MF_MSG_KERNEL, me_kernel }, /* * free pages are specially detected outside this table: * PG_buddy pages only make a small fraction of all free pages. @@ -1246,7 +1233,6 @@ static struct page_state error_states[] =3D { #undef mlock #undef lru #undef head -#undef reserved =20 static void update_per_node_mf_stats(unsigned long pfn, enum mf_result result) --=20 2.53.0-Meta From nobody Sun Jun 7 02:07:40 2026 Received: from stravinsky.debian.org (stravinsky.debian.org [82.195.75.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5EA0B496910; Wed, 13 May 2026 15:39:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=82.195.75.108 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778686800; cv=none; b=V8yM3S4KwS/eVL3zbo+cZSVJg1FtjBTOPZTO1LzF/kLIweAbR7DanE2TCWYNat6Y+Rg3dFhJQHGxHzi9RiziMsoyCM0t7uAIGBaLJnr2fbt835IAIUh+PgYsC6B+LLK77mxbApXO7bKuJZ80FC/nYiiCEsfEy7PnXdcnVF36wqE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778686800; c=relaxed/simple; bh=3P+pE8uCw6JuISeQtNGrLkc7kUF6mG0rlNthqhsuxWU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=X8WRly+lhUiFaRKr88Az0dwj7w9njwG2Tvq1zCL86iX9ssFnA4dRC3WN08KH+k3whzK0VKxJYhxqkWJtQXXAs4xlvx1LEGSHanEmOR08dIoSpggAkvSCDtZT9ewHgdV9OaYJRNlyYL17UZx947B3+pFr1lufE8TVcJFf8oJju34= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=debian.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b=OPx+DcsU; arc=none smtp.client-ip=82.195.75.108 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=debian.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b="OPx+DcsU" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Cc:To:In-Reply-To:References: Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date: From:Reply-To:Content-ID:Content-Description; bh=StiN5p0Brhv25pUjIdeBXehIgHFb5wfCLHnn/Bhsiis=; b=OPx+DcsUN8QXuh9kSsho836vJu PJ0OQRzequxyIGQGLvHtPxj8AzF84nGA4PfixPMKdrKO71q8GouHLPgnF1N4i4gjNWkLzlZ7oi+Nn gljKFypHreeHz1Rc1af6WWIpsTXQZuyW4kTszpuPEBqafZ/WvKvp/ykishxR4pqobjbZZXAEVvi2v oopwBZxISQCsBlAzGu2sidpPf/PT+AiZxa34q+/v27M5sSAQlbf3V7oiiD+j+YJWIKJu/wlBHq1yt 4TqbC1RT/paQAVxqJBIbDVhj3TZ0sF9+WAJmexDJbgJ0aD7EZ1n0H106AQQW0DD1jWyL8AgNVxgOa kTQuLgDA==; Received: from authenticated user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from ) id 1wNBgj-003GTo-00; Wed, 13 May 2026 15:39:57 +0000 From: Breno Leitao Date: Wed, 13 May 2026 08:39:33 -0700 Subject: [PATCH v7 2/6] mm/memory-failure: surface unhandlable kernel pages as -ENOTRECOVERABLE Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260513-ecc_panic-v7-2-be2e578e61da@debian.org> References: <20260513-ecc_panic-v7-0-be2e578e61da@debian.org> In-Reply-To: <20260513-ecc_panic-v7-0-be2e578e61da@debian.org> To: Miaohe Lin , Andrew Morton , David Hildenbrand , Lorenzo Stoakes , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Shuah Khan , Naoya Horiguchi , Steven Rostedt , Masami Hiramatsu , Mathieu Desnoyers , Jonathan Corbet , Shuah Khan , "Liam R. Howlett" , "Liam R. Howlett" Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-kselftest@vger.kernel.org, Breno Leitao , linux-trace-kernel@vger.kernel.org, kernel-team@meta.com X-Mailer: b4 0.16-dev-d5d98 X-Developer-Signature: v=1; a=openpgp-sha256; l=3720; i=leitao@debian.org; h=from:subject:message-id; bh=3P+pE8uCw6JuISeQtNGrLkc7kUF6mG0rlNthqhsuxWU=; b=owEBbQKS/ZANAwAIATWjk5/8eHdtAcsmYgBqBJs7FZyPHKtHBgrc6Kh7qjDO22e9jyTS0C1Oo fxzWFGsNwuJAjMEAAEIAB0WIQSshTmm6PRnAspKQ5s1o5Of/Hh3bQUCagSbOwAKCRA1o5Of/Hh3 bUQ4EACL88FtBnv/N9NnyVYqO3xg8YkV51eu3EAQKYU2lox77uiixwNBehQ6MzuVHphMsNUOGKB qq/qMYY0K/Vhp5mjOjJQw0N+0PeIW+rwnDasJNDr9uvEJJb4S7r0gzdaYJgQ0Hs0DY3MvlQPozN 6FQvQFsbyZWqNqneq0o3bi05fc99tzM5YnVseLw6IANqXdPkhhTYOhnZKDvFPho8wVIUk7C0tT0 lxyZD8UvCHQjE4441G1m33+FiJvyPCX/bdBeS6Bm5C7q0JN+es5iIbYrCKLGTVV+wbIy67hRvBB TCFw0cDspBJchhLujcQfPnR0a/8CKM3xFDmr6wAgxxB1IMZ1iT1ShsR5X3MaX1hp1rR28JJlgjy om6YT1dMmkaekVkKnFOtKACEbQfTjryndH1Spxc9fi3Wn5VfJAncFT8W44r9BQoLW9I8JoMvpDf ZPyMEuNn6yHFF1vla5ViykB98hR4rVCFUnu3uBUBRj+4d02R6w6pUQVukUKXEGpXviov/htT8sd Gk4KcUn2yVeDU3gDnq23qXGosaroL7sjVE12IJll4ZdM+mSgHVQdk8nX3TKdAbcn6c6WMsja2Hd enRfz/XtyBj4KmS+J/dw/wWtksFZtEF56BpdYWcB6f3DktbvbE7ApVA5YGIO9BK9+GMpsqcMgIA 3ta1D3r9PRzJdMg== X-Developer-Key: i=leitao@debian.org; a=openpgp; fpr=AC8539A6E8F46702CA4A439B35A3939FFC78776D X-Debian-User: leitao get_any_page() collapses three different failure modes into a single -EIO return: * the put_page race in the !count_increased path; * the HWPoisonHandlable() rejection that bounces out of __get_hwpoison_page() with -EBUSY and exhausts shake_page() retries; * the HWPoisonHandlable() rejection that goes through the count_increased / put_page / shake_page retry loop. The first is transient (the page is racing with the allocator). The second can be either transient (a userspace folio briefly off LRU during migration/compaction) or stable (slab/vmalloc/page-table/ kernel-stack pages). The third describes a stable kernel-owned page that the count_increased=3Dtrue caller already held a reference on. Distinguish them on the return path: keep -EIO for both the put_page race and the -EBUSY-after-retries branch (shake_page() cannot drag a folio back from active migration, so we cannot prove the page is permanently kernel-owned from there), keep -EBUSY for the allocation race (unchanged), and return -ENOTRECOVERABLE only from the count_increased-true HWPoisonHandlable() rejection that exhausts its retries -- the caller's reference is structural evidence that the page is owned by the kernel. Extend the unhandlable-page pr_err() to fire for either errno and update the get_hwpoison_page() kerneldoc. memory_failure() still folds every negative return into MF_MSG_GET_HWPOISON via its existing "else if (res < 0)" branch, so this patch is a no-op for users of memory_failure() and only changes the errno that soft_offline_page() can propagate to its callers. A follow-up wires the new return code through memory_failure() and reports MF_MSG_KERNEL for the unrecoverable cases. Suggested-by: David Hildenbrand Signed-off-by: Breno Leitao --- mm/memory-failure.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 49bcfbd04d213..bae883df3ccb2 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -1408,6 +1408,15 @@ static int get_any_page(struct page *p, unsigned lon= g flags) shake_page(p); goto try_again; } + /* + * Return -EIO rather than -ENOTRECOVERABLE: this + * branch is also reached for pages that are merely + * off-LRU transiently (e.g. a folio in the middle + * of migration or compaction), which shake_page() + * cannot drag back. The caller cannot prove the + * page is permanently kernel-owned from here, so + * keep it on the recoverable errno. + */ ret =3D -EIO; goto out; } @@ -1427,10 +1436,10 @@ static int get_any_page(struct page *p, unsigned lo= ng flags) goto try_again; } put_page(p); - ret =3D -EIO; + ret =3D -ENOTRECOVERABLE; } out: - if (ret =3D=3D -EIO) + if (ret =3D=3D -EIO || ret =3D=3D -ENOTRECOVERABLE) pr_err("%#lx: unhandlable page.\n", page_to_pfn(p)); =20 return ret; @@ -1487,7 +1496,10 @@ static int __get_unpoison_page(struct page *page) * -EIO for pages on which we can not handle memory errors, * -EBUSY when get_hwpoison_page() has raced with page lifecycle * operations like allocation and free, - * -EHWPOISON when the page is hwpoisoned and taken off from buddy. + * -EHWPOISON when the page is hwpoisoned and taken off from buddy, + * -ENOTRECOVERABLE for stable kernel-owned pages the handler + * cannot recover (PG_reserved, slab, vmalloc, page tables, + * kernel stacks, and similar non-LRU/non-buddy pages). */ static int get_hwpoison_page(struct page *p, unsigned long flags) { --=20 2.53.0-Meta From nobody Sun Jun 7 02:07:40 2026 Received: from stravinsky.debian.org (stravinsky.debian.org [82.195.75.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 430214921BE; Wed, 13 May 2026 15:40:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=82.195.75.108 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778686806; cv=none; b=c1rnz+KbEQxbocEhLifVzEsneZwdxRG7w4jCEFAvrmfE4sN2IMCdnet6XSZjHajBsrU83tJw4q2TJJNvRhfPP+T1+NDJDuSDrWzCkXvETX8cN5ThhQ8+3APgsyvTef93kDZSm92m/9XK0o6RzwsSu5qAV0taCQzpUHWlGxuWSg8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778686806; c=relaxed/simple; bh=aUpEGreCiiwo7XiCDP3nHwzdk2ozZEEtKzqxsRLQzJQ=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=g8d/NCwm83ujquy4+pTXjIiC0zBo+ufKFkz0r+HstjnkbetWioJQx8/wXzBmxSg+FYVVCCieh3gZ6FJtY6/ILPRSPprLI2PjdQfWJ0WlNL+r18VvH9m5eUxWs5myS13idNk6xiGD9eb2UOUR7kfP9lwXXBARIR1mXip2WFWwU1c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=debian.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b=cWvoBNcC; arc=none smtp.client-ip=82.195.75.108 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=debian.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b="cWvoBNcC" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Cc:To:In-Reply-To:References: Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date: From:Reply-To:Content-ID:Content-Description; bh=/6+k4U3CigWMPa6eRngECurunw+EDs/D/cMRSqJBO8A=; b=cWvoBNcCwzDa9aLv5h70R/mcbs PIWp5U14kA+Xrw+I4if9aIU6wpGyKgfEhW5Y8Z7W/D5YckhnxvCaaQShK/YvNegvCluvX6yQLR/I7 /PCeMjL+eIqsrTyTCpunIZzfvQtNLT50jVVytGljcbyenKQRWoOA6ARdWKsCtWR7EsNikscFT1oT8 Q31u/fP8EP3hLxhQCYHXWAmhAO3eL+gVi2aXdqB5Xx5LDLsT3nRNcZEJwbs7ClJEu+tlMSUpvft9g JwNERdRpSxbdaRYyLwJ2BLhoxkooUqmwnulAufiPZuJYLkL6Jbm2hBYUKd4Gb2wTf6HyGICLxQRt9 d3wcpdlg==; Received: from authenticated user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from ) id 1wNBgo-003GU6-26; Wed, 13 May 2026 15:40:02 +0000 From: Breno Leitao Date: Wed, 13 May 2026 08:39:34 -0700 Subject: [PATCH v7 3/6] mm/memory-failure: report MF_MSG_KERNEL for unrecoverable kernel pages Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260513-ecc_panic-v7-3-be2e578e61da@debian.org> References: <20260513-ecc_panic-v7-0-be2e578e61da@debian.org> In-Reply-To: <20260513-ecc_panic-v7-0-be2e578e61da@debian.org> To: Miaohe Lin , Andrew Morton , David Hildenbrand , Lorenzo Stoakes , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Shuah Khan , Naoya Horiguchi , Steven Rostedt , Masami Hiramatsu , Mathieu Desnoyers , Jonathan Corbet , Shuah Khan , "Liam R. Howlett" , "Liam R. Howlett" Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-kselftest@vger.kernel.org, Breno Leitao , linux-trace-kernel@vger.kernel.org, kernel-team@meta.com X-Mailer: b4 0.16-dev-d5d98 X-Developer-Signature: v=1; a=openpgp-sha256; l=2392; i=leitao@debian.org; h=from:subject:message-id; bh=aUpEGreCiiwo7XiCDP3nHwzdk2ozZEEtKzqxsRLQzJQ=; b=owEBbQKS/ZANAwAIATWjk5/8eHdtAcsmYgBqBJs7vngK9RETyLDF63o1EnEfYGgE9nv+9reDZ QJAssZ8oZqJAjMEAAEIAB0WIQSshTmm6PRnAspKQ5s1o5Of/Hh3bQUCagSbOwAKCRA1o5Of/Hh3 bVBOD/42fbJ1SIKiXMo7f8f99fs30cZrVejZGjSwvrCi8ZkL5L+6m3DTmQ9ebEeTvLyJl4tugs9 nlyHwMuz2XZTExQHD/s96rlCtCq1qZuOTdiwBJMFxuWzXLcjFsIV1Pk5p7Ug0gZazN5eDuxRMxG 4shDiaETS5V3LOP6yuIBje+R60oa0u4UZ7BpFNswvrtQ06gQr+iiH8mH/FoqCJcauhUfCg44MEU 3aVobIQLqrcxhagv+UPkqlQ0y/pjxnq8MKzwg0lLdhJ5asf1Zy0f67ryt79v1O+NtZtV7RVdA8z pOkfJGHV/nD1WCSuy0iZHfgBsanH2szAR1791eyvG4czAd3bMen/vUDb00M/wmz2ppZu6fFqsVP TrP35jSeXKDgHqw41fkSddZ9V3MGXLcRpzrh+58jy6izLx1oFURAV6J7Ff2n20bMyTiIKcbP3kC uDmTAz9qcMgUzEKJe5YzkbvDwmtcw3B9hYbMKO/mdY49Bx62MuQTppPW+vo0IYHfaJElcvhvZ3H BLsLQSX03QA+kZyrb7NTYUctOHoTx3s3vRugPznfFbGM/74kjm1SfEBY9QNyAUJtckjPOvp6JLS dGe30VDx4YhSX7UDwzSpVH2eNfHaDpHe5Jsfsv5Szg2+g/v4X6bkY7lShw0liPepWBqZEAuKP3d MNdScg4izAJjT8w== X-Developer-Key: i=leitao@debian.org; a=openpgp; fpr=AC8539A6E8F46702CA4A439B35A3939FFC78776D X-Debian-User: leitao The previous patch teaches get_any_page() to return -ENOTRECOVERABLE for stable unhandlable kernel pages (PG_reserved, slab, vmalloc, page tables, kernel stacks, ...). memory_failure() still folds every negative return into MF_MSG_GET_HWPOISON, so callers that want to react to the unrecoverable cases (a panic option, smarter logging) cannot tell them apart from transient page-allocator races. Turn the post-call branch into a switch over the get_hwpoison_page() return code: map -ENOTRECOVERABLE to MF_MSG_KERNEL and any other negative return to MF_MSG_GET_HWPOISON. case 0 keeps the existing free-buddy / kernel-high-order handling and case 1 falls through to the rest of memory_failure() unchanged. The MF_MSG_KERNEL label and tracepoint string are kept as "reserved kernel page" to avoid breaking userspace tools that match on those literals; the enum value still adequately tags the failure even though it now also covers slab, vmalloc, page tables and kernel stack pages. Suggested-by: David Hildenbrand Signed-off-by: Breno Leitao --- mm/memory-failure.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index bae883df3ccb2..4b3a5d4190a07 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -2410,7 +2410,8 @@ int memory_failure(unsigned long pfn, int flags) * that may make page_ref_freeze()/page_ref_unfreeze() mismatch. */ res =3D get_hwpoison_page(p, flags); - if (!res) { + switch (res) { + case 0: if (is_free_buddy_page(p)) { if (take_page_off_buddy(p)) { page_ref_inc(p); @@ -2429,7 +2430,19 @@ int memory_failure(unsigned long pfn, int flags) res =3D action_result(pfn, MF_MSG_KERNEL_HIGH_ORDER, MF_IGNORED); } goto unlock_mutex; - } else if (res < 0) { + case 1: + /* Got a refcount on a handlable page. */ + break; + case -ENOTRECOVERABLE: + /* + * Stable unhandlable kernel-owned page (PG_reserved, + * slab, vmalloc, page tables, kernel stacks, ...). + * No recovery possible. + */ + res =3D action_result(pfn, MF_MSG_KERNEL, MF_IGNORED); + goto unlock_mutex; + default: + /* Transient lifecycle race with the page allocator. */ res =3D action_result(pfn, MF_MSG_GET_HWPOISON, MF_IGNORED); goto unlock_mutex; } --=20 2.53.0-Meta From nobody Sun Jun 7 02:07:40 2026 Received: from stravinsky.debian.org (stravinsky.debian.org [82.195.75.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5585A4963C0; Wed, 13 May 2026 15:40:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=82.195.75.108 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778686811; cv=none; b=SQ7YmmvcnFCi0IBlMqRiZ8hCRLLANRY//B4cgb0xzIe9O1EQ899e0/IhZ2yRxa9QlnmDpJTnJTLlVjqSdL9hnFF3NLW5xmK1B1QvreTjpWlyve96fPRuW9+P+7zVv2EGAafMZ3VwEF5FeYQFvfycbAchk8OJeisZbc8DthEQw/Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778686811; c=relaxed/simple; bh=0MzegEQa6mNO2V3I1Z6SLe0wht+O4Co94Tkz7tlZ2NE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=S1y76ZhMipeJtW1uzurPzls9W9yJfzPgSdUANrDe5b94L42uteLlhAFjN0gjZN4o8jcuUVXjoXuGes6dAN1u6JwT5iVkDsRu1dkGRnj50X55l4fNl57WZGejm8Uk3QuvEbRAOwSnVKE55Y/LEhGtbgYnNruECdC50yYPoI8Y1yc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=debian.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b=aQ4Cvp/Y; arc=none smtp.client-ip=82.195.75.108 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=debian.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b="aQ4Cvp/Y" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Cc:To:In-Reply-To:References: Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date: From:Reply-To:Content-ID:Content-Description; bh=/Vsk6nSS0BOaYjUJQEKvY7BmM0q9+NfGVkftVEcz+BE=; b=aQ4Cvp/YxlgHKNRQHETVoEJvhL BMOkYClOlNIXJJRjlJ/F694viN0dxD3UgGvcP/rUjQjRRAGEFx7f6WEJFClSwHGZQWr3tB64zZSIi +3wpLPwhupyY+By42bkZlqEmH21ZW6Q6G0kbyhMIFWEVCcBmHMpPw5VEVQfC9IAx6CcyGz2iNDcBz pWW63czKtD8eGFLVdo+q3o7QTEMfxBvt8K/awG7Ng+fNmLcFVHFfWAprYZLSe44nmIMShQFgUAbXD 0RoOaTSddktyYl+t6txa+T3AMLC2fKhJGWLK5ZSD5EKdiL804qR3JnM0EDBOWKu41PQO66J9dvmUt mAjMaP4Q==; Received: from authenticated user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from ) id 1wNBgu-003GUf-0L; Wed, 13 May 2026 15:40:08 +0000 From: Breno Leitao Date: Wed, 13 May 2026 08:39:35 -0700 Subject: [PATCH v7 4/6] mm/memory-failure: short-circuit PG_reserved before get_hwpoison_page() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260513-ecc_panic-v7-4-be2e578e61da@debian.org> References: <20260513-ecc_panic-v7-0-be2e578e61da@debian.org> In-Reply-To: <20260513-ecc_panic-v7-0-be2e578e61da@debian.org> To: Miaohe Lin , Andrew Morton , David Hildenbrand , Lorenzo Stoakes , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Shuah Khan , Naoya Horiguchi , Steven Rostedt , Masami Hiramatsu , Mathieu Desnoyers , Jonathan Corbet , Shuah Khan , "Liam R. Howlett" , "Liam R. Howlett" Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-kselftest@vger.kernel.org, Breno Leitao , linux-trace-kernel@vger.kernel.org, kernel-team@meta.com, Lance Yang X-Mailer: b4 0.16-dev-d5d98 X-Developer-Signature: v=1; a=openpgp-sha256; l=1758; i=leitao@debian.org; h=from:subject:message-id; bh=0MzegEQa6mNO2V3I1Z6SLe0wht+O4Co94Tkz7tlZ2NE=; b=owEBbQKS/ZANAwAIATWjk5/8eHdtAcsmYgBqBJs7KSP0K2Cs2gg9fb0ISbMpl7DyiUxMygPBA KXOdR++hVmJAjMEAAEIAB0WIQSshTmm6PRnAspKQ5s1o5Of/Hh3bQUCagSbOwAKCRA1o5Of/Hh3 bc9DD/4nNbluygUYNKOBrciOIa+JY5x3LkUt0UJqRQmgFYINakvCeFSRKWudJYoU8Zj2LDinbwL CIDqZeXUALFdVp7mQ9RJyXFKw02qJK2xZM2ZHLvUkoapQwDs2tcY39eXOUgkYSlo5a5S7t5MrQI pbSmGUTZLICxbUc0tMXa4Jp+XPL6shtQ8cNJTZLtH57HZ7p/mrJHXCiFem3GB6KcvYxCGDESgxM Socfz7gkdIavesqzPQGxaYcPSllviC1KznNMf/yTK6BsKqFES1SN9riGEtwEvLrjnfi3kHcZvvp l/5p+ZahKyv6Hp2KoQsmEggQTcHSzDLQlOHvk2W+RkST7IUND1kgaCsbOjAZcblJsT9aoc5VYaK HXMwfaQrDTXYc8uxKpU94CteM5W3jD1dWG8fUIb4NNSX3m+q35IpAcy6V2KDef+aoJgk9nXCQjU rkWvD9Ls9D9soYjUJKDI08lhzIJQxegyZpysuHli9Whygy5mOfUFGMNMiPNF+Kejry7c68XtvQz 31fpDl2XC65FlyUA/lWBc8hhyX8T3SzlbgImHhRd3n5yTj+XsiX4uvb6yQaLbEiEr/BX4tttEDx I3rHgjFk6P7FskMuBEaNMof/si/JbrmpAG9Jt6BaxgMvEui3KCUpsVAc2N2IIqAECL7Ixo6wOMl hsX4XCagr7RsqNg== X-Developer-Key: i=leitao@debian.org; a=openpgp; fpr=AC8539A6E8F46702CA4A439B35A3939FFC78776D X-Debian-User: leitao The previous patch already classifies PG_reserved pages as MF_MSG_KERNEL through the long path: get_hwpoison_page() calls __get_hwpoison_page() which fails HWPoisonHandlable(), get_any_page() exhausts its shake_page() retry budget, and the resulting -ENOTRECOVERABLE is mapped to MF_MSG_KERNEL by the switch. The outcome is correct but the work in between is wasted: shake_page() cannot turn a reserved page into a handlable one. Detect PG_reserved up front in memory_failure() and report MF_MSG_KERNEL directly. put_ref_page() releases the caller's reference when MF_COUNT_INCREASED is set, which is important on the MADV_HWPOISON path where get_user_pages_fast() holds a reference across the call. Suggested-by: Lance Yang Signed-off-by: Breno Leitao --- mm/memory-failure.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 4b3a5d4190a07..8ba3df21d1270 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -2398,6 +2398,19 @@ int memory_failure(unsigned long pfn, int flags) goto unlock_mutex; } =20 + /* + * PG_reserved pages are kernel-owned (memblock reservations, + * driver reservations, ...) and cannot be recovered. Skip the + * get_hwpoison_page() lifecycle dance and report MF_MSG_KERNEL + * straight away; HWPoisonHandlable() would just keep rejecting + * the page through the retry budget anyway. + */ + if (PageReserved(p)) { + put_ref_page(pfn, flags); + res =3D action_result(pfn, MF_MSG_KERNEL, MF_IGNORED); + goto unlock_mutex; + } + /* * We need/can do nothing about count=3D0 pages. * 1) it's a free page, and therefore in safe hand: --=20 2.53.0-Meta From nobody Sun Jun 7 02:07:40 2026 Received: from stravinsky.debian.org (stravinsky.debian.org [82.195.75.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E0D004963C8; Wed, 13 May 2026 15:40:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=82.195.75.108 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778686817; cv=none; b=L4GCNTb8sG4yvst+aMrxigloGUrME9ge/S/m5s22QyoI3/OSyDHoInCMAp7PQELnRC6KtW6uTNHaoT5sJtjAhVv7Zae0r7G+qGW4pg0abxLJldcwhrYPeVzQ7y7LDmQximLIgfK+YMURd/noDu64K2v0OCzMm1YVHSfnazMZMN4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778686817; c=relaxed/simple; bh=EISKEKQL/arGKTsQc3TDmWSm6ryILYJXr+CWei0yzkc=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=RuBu91R+hnRSvCK+NHw5VWnCZsRo1b+BTL1206ZpG1yR0p7EDiUpNc813Xpv6wqu6Gyhe2TmYjq31aXHmnKr2WO7shcRamUEwhuWyymGvsubUhBAVSSpH66UgIt6en4CYQJctqcI8XXhXsgytGvP49Hn/xmXX3ZFwUZMNCm3WQM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=debian.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b=O9sZlQ9a; arc=none smtp.client-ip=82.195.75.108 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=debian.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b="O9sZlQ9a" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Cc:To:In-Reply-To:References: Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date: From:Reply-To:Content-ID:Content-Description; bh=yo5moT3K4RpqkylqFLjVVxqWs465kOdC70qipcIzXnI=; b=O9sZlQ9azTvfUm7b8bKLLMNJWT xk1F/+Lmxx2BqwHsozEVS96HqrduyL17Uaai1UOk4H2V9MmxwAkFJTC0Mz/FI+tGBM3MIDVI0WmGb /HW7YvBGL9aJS88lQkGtIsQr8hX8EXeZBFXn9C7KwBs8UW41ze5xW0i0paVYjWJ85QbpY0T+57qal vTbp88TEqw1n7rlRAs35e2evM+AXjKgK/7vAfVFO1Q0+EHQi5vUKgLqkub5GSB0KMn8Ih45g6aFh6 feGxEfD2Gx8wPFDza7tn1xHKfzhSomL+nKnRpSZnsrzxbWErnUXxkEIlUZqMQI7KsRXN5zUfYkLsP fCu3P4aw==; Received: from authenticated user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from ) id 1wNBgz-003GV1-1x; Wed, 13 May 2026 15:40:13 +0000 From: Breno Leitao Date: Wed, 13 May 2026 08:39:36 -0700 Subject: [PATCH v7 5/6] mm/memory-failure: add panic option for unrecoverable pages Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260513-ecc_panic-v7-5-be2e578e61da@debian.org> References: <20260513-ecc_panic-v7-0-be2e578e61da@debian.org> In-Reply-To: <20260513-ecc_panic-v7-0-be2e578e61da@debian.org> To: Miaohe Lin , Andrew Morton , David Hildenbrand , Lorenzo Stoakes , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Shuah Khan , Naoya Horiguchi , Steven Rostedt , Masami Hiramatsu , Mathieu Desnoyers , Jonathan Corbet , Shuah Khan , "Liam R. Howlett" , "Liam R. Howlett" Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-kselftest@vger.kernel.org, Breno Leitao , linux-trace-kernel@vger.kernel.org, kernel-team@meta.com X-Mailer: b4 0.16-dev-d5d98 X-Developer-Signature: v=1; a=openpgp-sha256; l=3146; i=leitao@debian.org; h=from:subject:message-id; bh=EISKEKQL/arGKTsQc3TDmWSm6ryILYJXr+CWei0yzkc=; b=owEBbQKS/ZANAwAIATWjk5/8eHdtAcsmYgBqBJs7DfvuLYry1wILZQ0ew8fmFkKspjfR7M6EI jqtdKJQIZ+JAjMEAAEIAB0WIQSshTmm6PRnAspKQ5s1o5Of/Hh3bQUCagSbOwAKCRA1o5Of/Hh3 beuHEACt6DukNUmgQVKYBNq+OfLW5GsCTVzJZnCXllda8MwjZRrSLfiM2ceU7E5Mon0UvWO9Qmr txFKpjc5EZmbrVDHNJ6OATvGhLuL7RnQc2EhYkVoaTKiOINEe7E/6WZJqBOc+S2BWYwa4CCaR1V sR47IhcuaHdxi0T2HUmcEmHCEjBzqzWpy0YdaRhlwYAcl2iRVMe+SDhYY9TABAVSmYKwyL002M3 ZQUYyXo95+N7OYPBX1mlUPaHKX0yQMZSjvKREORFQDHcUaCHu0g+845EQhyerWrvUq3fEBTSd7c pfrPHIfI0npXFap+hDPen+onIrFuOAm6KXLCl4Bxn1KB5vQu5FSZdpDl1DW+ZorDfnzH7612FwM Ur33PyyT555mrCufgXPts1qLwMCRzkFouy2aDzvgA+TvfOxjQF12a7A59aifLA8nsGVXXWeJKMo wjh8l6CF23SvzXSGN99elGaKYNbmF9JfdaeTJaLI9lZGoGs2NTogZ6mSblYNlVv1P8YBOLaGrsq 7JG8jt3Tcds4DxFtyy4Ns7pWoIdz7oWH2bEtudH5hzC+qBVq4nDqeARq5kZKvhFuSZ7NDTgSLqC jUcxkOWE9n/UM6cxToWU+bHm1gDKUTnZ0OXb/YkYo/GaZDhuI8aApkpMMSd5F4gJJCBR0gtUtJS X7MNRlTPzEbVhmw== X-Developer-Key: i=leitao@debian.org; a=openpgp; fpr=AC8539A6E8F46702CA4A439B35A3939FFC78776D X-Debian-User: leitao Add a sysctl panic_on_unrecoverable_memory_failure that triggers a kernel panic when memory_failure() encounters pages that cannot be recovered. This provides a clean crash with useful debug information rather than allowing silent data corruption or a delayed crash at an unrelated code path. Panic eligibility is intentionally narrow: only MF_MSG_KERNEL with result =3D=3D MF_IGNORED panics. After the previous patch, MF_MSG_KERNEL covers PG_reserved pages and the kernel-owned pages promoted from get_hwpoison_page() via -ENOTRECOVERABLE (slab, vmalloc, page tables, kernel stacks, ...). All other action types are excluded: - MF_MSG_GET_HWPOISON and MF_MSG_KERNEL_HIGH_ORDER can be reached by transient refcount races with the page allocator (an in-flight buddy allocation has refcount 0 and is no longer on the buddy free list, briefly), and panicking on them would risk killing the box for what is actually a recoverable userspace page. - MF_MSG_UNKNOWN means identify_page_state() could not classify the page; that is precisely the wrong basis for a panic decision. Signed-off-by: Breno Leitao --- mm/memory-failure.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/mm/memory-failure.c b/mm/memory-failure.c index 8ba3df21d1270..cb2965c0ec0b4 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -74,6 +74,8 @@ static int sysctl_memory_failure_recovery __read_mostly = =3D 1; =20 static int sysctl_enable_soft_offline __read_mostly =3D 1; =20 +static int sysctl_panic_on_unrecoverable_mf __read_mostly; + atomic_long_t num_poisoned_pages __read_mostly =3D ATOMIC_LONG_INIT(0); =20 static bool hw_memory_failure __read_mostly =3D false; @@ -155,6 +157,15 @@ static const struct ctl_table memory_failure_table[] = =3D { .proc_handler =3D proc_dointvec_minmax, .extra1 =3D SYSCTL_ZERO, .extra2 =3D SYSCTL_ONE, + }, + { + .procname =3D "panic_on_unrecoverable_memory_failure", + .data =3D &sysctl_panic_on_unrecoverable_mf, + .maxlen =3D sizeof(sysctl_panic_on_unrecoverable_mf), + .mode =3D 0644, + .proc_handler =3D proc_dointvec_minmax, + .extra1 =3D SYSCTL_ZERO, + .extra2 =3D SYSCTL_ONE, } }; =20 @@ -1267,6 +1278,15 @@ static void update_per_node_mf_stats(unsigned long p= fn, ++mf_stats->total; } =20 +static bool panic_on_unrecoverable_mf(enum mf_action_page_type type, + enum mf_result result) +{ + if (!sysctl_panic_on_unrecoverable_mf || result !=3D MF_IGNORED) + return false; + + return type =3D=3D MF_MSG_KERNEL; +} + /* * "Dirty/Clean" indication is not 100% accurate due to the possibility of * setting PG_dirty outside page lock. See also comment above set_page_dir= ty(). @@ -1284,6 +1304,9 @@ static int action_result(unsigned long pfn, enum mf_a= ction_page_type type, pr_err("%#lx: recovery action for %s: %s\n", pfn, action_page_types[type], action_name[result]); =20 + if (panic_on_unrecoverable_mf(type, result)) + panic("Memory failure: %#lx: unrecoverable page", pfn); + return (result =3D=3D MF_RECOVERED || result =3D=3D MF_DELAYED) ? 0 : -EB= USY; } =20 --=20 2.53.0-Meta From nobody Sun Jun 7 02:07:40 2026 Received: from stravinsky.debian.org (stravinsky.debian.org [82.195.75.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BC2474963C8; Wed, 13 May 2026 15:40:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=82.195.75.108 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778686823; cv=none; b=o75z0J1EaK/PPPL8J3U+keDfgpa48CMgHB1OIVelDGOac+XdBsfK/tl1q2KCGlS3PstcEg4ZNVVkOp6ncCzP5Pt2r4V3xIcsOZT9rKV6a5qxoWy8GZvi8q0JYWGByqeeXnLdfWBPO+pVADh1QxTm3iRQ6zH7L/tDp6VdC9y4pD4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778686823; c=relaxed/simple; bh=ncCft6wLVNRyu8CqP+C5ij+1shPAevwH/Ny4XjCyHOI=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=j477I3dV+OYZutQK6tCIZcSUygNNRMO+lqQm1xNf9p0SqWMVffn5tIfBe0sEypTYh1rPoyTjn6GYUrsUVbgLbmPiVGpn/s24k5iQ3AloHLqPprGW7//S4O/2xKPDbuLZIpU46q55vMWz07bYsPcs6+881sdXzs5HVn2PYD2uPzg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=debian.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b=MUz/a7yD; arc=none smtp.client-ip=82.195.75.108 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=debian.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b="MUz/a7yD" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Cc:To:In-Reply-To:References: Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date: From:Reply-To:Content-ID:Content-Description; bh=ps5zJ4kvCPWwzd5UeBW/t615zOIlJIp4XGX6hA3qpRU=; b=MUz/a7yDPF3GUlgcn3qxI3gfXO vu0GqHwaV/Mb1bW82IvzWEIXuz1AjC5Kf2hZQhhXHM7cK/WFxIui/Cd+LceT7+B4TWxlF/y5O2o5V Ynyr/q5CC229E0JpqG/ofuV5CPL8tKnbhLV2UojmrnwyGZx02U7HgRK0SZ/4U98R3CXLsTObxtF4Q 8gPvehCcyeFI3RKI/DNCXG0nWLf2F803eE4PF4ug8dR562+Lae3fObfrgDoKgeS865C3f7su0x3tF DcDiLzTDw+HtJoxbAfkmpsusVnu8fI4Q/dYZoRN+va/uuESIhOwGl2i00Uv6IslMYqXmaHSgP6ynC jDONS5zA==; Received: from authenticated user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from ) id 1wNBh5-003GVI-14; Wed, 13 May 2026 15:40:19 +0000 From: Breno Leitao Date: Wed, 13 May 2026 08:39:37 -0700 Subject: [PATCH v7 6/6] Documentation: document panic_on_unrecoverable_memory_failure sysctl Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260513-ecc_panic-v7-6-be2e578e61da@debian.org> References: <20260513-ecc_panic-v7-0-be2e578e61da@debian.org> In-Reply-To: <20260513-ecc_panic-v7-0-be2e578e61da@debian.org> To: Miaohe Lin , Andrew Morton , David Hildenbrand , Lorenzo Stoakes , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Shuah Khan , Naoya Horiguchi , Steven Rostedt , Masami Hiramatsu , Mathieu Desnoyers , Jonathan Corbet , Shuah Khan , "Liam R. Howlett" , "Liam R. Howlett" Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-kselftest@vger.kernel.org, Breno Leitao , linux-trace-kernel@vger.kernel.org, kernel-team@meta.com X-Mailer: b4 0.16-dev-d5d98 X-Developer-Signature: v=1; a=openpgp-sha256; l=4856; i=leitao@debian.org; h=from:subject:message-id; bh=ncCft6wLVNRyu8CqP+C5ij+1shPAevwH/Ny4XjCyHOI=; b=owEBbQKS/ZANAwAIATWjk5/8eHdtAcsmYgBqBJs7zoPgDDOGBYZIRWE5RwFBx84GbKDJ1RbfP mV5jtA91a2JAjMEAAEIAB0WIQSshTmm6PRnAspKQ5s1o5Of/Hh3bQUCagSbOwAKCRA1o5Of/Hh3 bZu2D/4gM6SMB3HsM1fzjJLPFg/Qj+o9TLUGhGX0U4PAr4DLJAFnRYhnbWfSnD6iqxo/aGpRGyp A4uC+3akefYTn2jttKvwNwQTz3K/dMC2u/ygdomRYAEJCzqah7oozi71XW7BJxV7GEzGuyggiDR nY1mzqHCNUC1/iWJB9Ptq5b+6tbCikpyCb5F9wQbk3B4tN9/g47cKcav0BJDax+dn15Pujh4laM y98k0W0fSNwDrJQySnNMOYZy0vraHPxo/gUc2EPLzOSEI8+RWGd3yuAmG4eK8PZrVG3Le/4e6to LzEAxARG4wZz1tvDYTNJegKeLJa8JYZPpHOgRE3WfYEreS76cQ2/4yujfr28kHniGRtDp+dU5O0 NHSJZTDB8MdO9wLjHpCmaanq0Sv+PCdxDX9llfKF57/gWSRPnRtJ/gmJaXNxdjjJjr77McAlIeI kW24yoCcw5pm7OTWQzM/Lh8UiJxWB8vI3ypt3TauIsmdojyATYMo7aUVL/GRSCQRFKxDZ2zy6Dz kRBbVBUj2QzfbkRmglwtI5hM4fxGA5JFyw+1+NGNI5e0MUJ+KIncw+XWiSiqMq1M2hNO+Vtxa2d l/gZCO7rSf4VOlydR7YnJkksXXBbj5lgIH68gjUg2h9McfRt8NUgNEHJT/Yn6cW4ncP+pC6u5DW pRlZ6VXaiL1vUrA== X-Developer-Key: i=leitao@debian.org; a=openpgp; fpr=AC8539A6E8F46702CA4A439B35A3939FFC78776D X-Debian-User: leitao Add documentation for the new vm.panic_on_unrecoverable_memory_failure sysctl, describing which failures trigger a panic (kernel-owned pages the handler cannot recover) and which are intentionally left out (transient allocator races and unclassified pages). Signed-off-by: Breno Leitao --- Documentation/admin-guide/sysctl/vm.rst | 80 +++++++++++++++++++++++++++++= ++++ 1 file changed, 80 insertions(+) diff --git a/Documentation/admin-guide/sysctl/vm.rst b/Documentation/admin-= guide/sysctl/vm.rst index 97e12359775c9..452c2ab25b35e 100644 --- a/Documentation/admin-guide/sysctl/vm.rst +++ b/Documentation/admin-guide/sysctl/vm.rst @@ -67,6 +67,7 @@ Currently, these files are in /proc/sys/vm: - page-cluster - page_lock_unfairness - panic_on_oom +- panic_on_unrecoverable_memory_failure - percpu_pagelist_high_fraction - stat_interval - stat_refresh @@ -925,6 +926,85 @@ panic_on_oom=3D2+kdump gives you very strong tool to i= nvestigate why oom happens. You can get snapshot. =20 =20 +panic_on_unrecoverable_memory_failure +=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D + +When a hardware memory error (e.g. multi-bit ECC) hits a kernel page +that cannot be recovered by the memory failure handler, the default +behaviour is to ignore the error and continue operation. This is +dangerous because the corrupted data remains accessible to the kernel, +risking silent data corruption or a delayed crash when the poisoned +memory is next accessed. + +When enabled, this sysctl triggers a panic on memory failure events +hitting reserved (``PageReserved``) memory: firmware reservations, +the kernel image, vDSO, the zero page, and similar memblock-reserved +regions. These are owned by the kernel, are not managed by the page +allocator, and cannot be recovered by the memory failure handler. + +Other unrecoverable kernel-owned populations (slab, vmalloc, page +tables, kernel stacks, ...) are not currently covered by this +sysctl. The handler cannot reliably distinguish them from a +userspace folio temporarily off the LRU during migration or +compaction, and the cost of a false-positive panic on a recoverable +userspace page is too high. Such pages still go through the +standard MF_MSG_GET_HWPOISON path: ``PG_hwpoison`` is set on them +and a delayed crash on the next access remains possible. Coverage +may grow in the future as the handler gains stronger +kernel-ownership signals. + +Recoverable failure paths are also intentionally left out: in-flight +buddy allocations and other transient races with the page allocator +can reach the same diagnostic, and panicking on them would risk +killing the box for a page destined for userspace where the standard +SIGBUS recovery path applies. Pages whose state could not be +classified at all are not covered either, since an unknown state is +not a sound basis for a panic decision. + +For many environments it is preferable to panic immediately with a clean +crash dump that captures the original error context, rather than to +continue and face a random crash later whose cause is difficult to +diagnose. + +Use cases +--------- + +This option is most useful in environments where unattributed crashes +are expensive to debug or where data integrity must take precedence +over availability: + +* Large fleets, where multi-bit ECC errors on kernel pages are observed + regularly and post-mortem analysis of an unrelated downstream crash + (often seconds to minutes after the original error) consumes + significant engineering effort. + +* Systems configured with kdump, where panicking at the moment of the + hardware error produces a vmcore that still contains the faulting + address, the affected page state, and the originating MCE/GHES + record =E2=80=94 context that is typically lost by the time a delayed cr= ash + occurs. + +* High-availability clusters that rely on fast, deterministic node + failure for failover, and prefer an immediate panic over silent data + corruption propagating to replicas or persistent storage. + +* Kernel and platform developers reproducing hwpoison issues with + tools such as ``mce-inject`` or error-injection debugfs interfaces, + where panicking on the unrecoverable path makes regressions + immediately visible instead of surfacing as later, unrelated + failures. + +=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D +0 Try to continue operation (default). +1 Panic immediately. If the ``panic`` sysctl is also non-zero then the + machine will be rebooted. +=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D + +Example:: + + echo 1 > /proc/sys/vm/panic_on_unrecoverable_memory_failure + + percpu_pagelist_high_fraction =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D =20 --=20 2.53.0-Meta