Re: [PATCH] mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()

[Zi Yan]

On Thu Jul 9, 2026 at 3:12 PM EDT, Zi Yan wrote:
> In pcpu_create_chunk(), nr_pages is the total contiguous backing
> allocation, i.e., nr_units * pcpu_unit_pages, but pcpu_chunk_populated()
> uses it to set chunk->populated, whose size is pcpu_unit_pages, bitmap.
> Since bit N in chunk->populated means page offset N inside every unit is
> backed. When nr_units > 1, the function writes beyond chunk->populated. Fix
> it by using chunk->nr_pages.
>
> It also fixes the global pcpu_nr_empty_pop_pages accounting, since
> pcpu_balance_free() only iterates up to chunk->nr_pages.
>
> Commit a63d4ac4ab609 ("percpu: make percpu-km set chunk->populated bitmap
> properly") introduced the bitmap overflow issue. Later,
> commit b539b87fed37f ("percpu: implmeent pcpu_nr_empty_pop_pages and
> chunk->nr_populated") added pcpu_nr_empty_pop_pages and caused the
> accounting issue.

A gentle ping on this patch. It would be great to get some feedback.
Thanks.

>
> Fixes: a63d4ac4ab609 ("percpu: make percpu-km set chunk->populated bitmap properly")
> Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
> Closes: https://sashiko.dev/#/patchset/20260703-keep-subpage-private-zero-at-free-v2-0-2970fe777dd6%40nvidia.com?part=1
> Assisted-by: Codex:GPT-5
> Signed-off-by: Zi Yan <ziy@xxxxxxxxxx>
> ---
> To make nr_units > 1 in percpu-km, we need SMP && !MMU && NEED_PER_CPU_KM.
> RISC-V can have SMP && !MMU. SH J2 can have it too. The kconfig analysis is
> done by Codex.
> ---
>  mm/percpu-km.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/mm/percpu-km.c b/mm/percpu-km.c
> index 7ffe84adadb9d..65fd5580e4472 100644
> --- a/mm/percpu-km.c
> +++ b/mm/percpu-km.c
> @@ -75,7 +75,7 @@ static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp)
>  	chunk->base_addr = page_address(pages);
>  
>  	spin_lock_irqsave(&pcpu_lock, flags);
> -	pcpu_chunk_populated(chunk, 0, nr_pages);
> +	pcpu_chunk_populated(chunk, 0, chunk->nr_pages);
>  	spin_unlock_irqrestore(&pcpu_lock, flags);
>  
>  	pcpu_stats_chunk_alloc();
>
> ---
> base-commit: 59e34180e138a293260301c139cf7ee800978533
> change-id: 20260709-fix-pcpu_create_chunk-in-percpu-km-6dfa8f28b175
>
> Best regards,




-- 
Best Regards,
Yan, Zi