FAILED: patch "[PATCH] mm/hugetlb: do not dissolve gigantic pages without runtime" failed to apply to 6.1-stable tree

The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x a363c62a653cc8b3e21da9545fa4e028ef50f9c3
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026092905-greeter-coke-d3db@gregkh' --subject-prefix 'PATCH 6.1.y' 'HEAD^..'

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From a363c62a653cc8b3e21da9545fa4e028ef50f9c3 Mon Sep 17 00:00:00 2001
From: Longlong Xia <[email protected]>
Date: Sun, 23 Aug 2026 12:40:51 +0800
Subject: [PATCH] mm/hugetlb: do not dissolve gigantic pages without runtime
support

dissolve_free_hugetlb_folio() doesn't check hstate_is_gigantic_no_runtime(h) though remove_hugetlb_folio()/ update_and_free_hugetlb_folio() silently bail for such folios, so it frees a still-listed folio and, on vmemmap restore failure, the add_hugetlb_folio() rollback corrupts the free list.

index 4f6f58bf3db6..d28972cd33f5 100644
@@ -1967,6 +1967,15 @@ int dissolve_free_hugetlb_folio(struct folio *folio)
 		struct hstate *h = folio_hstate(folio);
 		bool adjust_surplus = false;
 
+		/*
+		 * remove_hugetlb_folio()/update_and_free_hugetlb_folio() bail
+		 * for gigantic hstates without runtime support, so dissolving one
+		 * here would leave it on the free list and, on vmemmap restore
+		 * failure, the add_hugetlb_folio() rollback corrupts that list.
+		 */
+		if (hstate_is_gigantic_no_runtime(h))
+			goto out;
+
 		if (!available_huge_pages(h))
 			goto out;
 

From: Jinjiang Tu <[email protected]>

[ Upstream commit cb402bbdabcaa5a765068c5b8673bbfc1c264242 ]

In dissolve_free_huge_page(), free huge pages are dissolved without adjusting surplus count. However, free huge pages may be accounted as surplus pages, and will lead to wrong surplus count.

I reproduce this issue on qemu. The steps are:
1) Node1 is memory-less at first. Hot-add memory to node1 by executing the two commands in qemu monitor:
object_add memory-backend-ram,id=mem1,size=1G
device_add pc-dimm,id=dimm1,memdev=mem1,node=1
2) online one memory block of Node1 with：
echo online_movable > /sys/devices/system/node/node1/memoryX/state
3) create 64 huge pages for node1
4) run a program to reserve (don't consume) all the huge pages
5) echo 0 > nr_huge_pages for node1. After this step, free huge pages in Node1 are surplus.
6) create 80 huge pages for node0
7) offline memory of node1, The memory range to offline contains the free surplus huge pages created in step3) ~ step5)
echo offline > /sys/devices/system/node/node1/memoryX/state
8) kill the program in step 4)

The result:
Node0 Node1

total       80        0
free        80        0
surplus     0         61

To fix it, adjust surplus when destroying huge pages if the node has surplus pages in dissolve_free_hugetlb_folio().

The result with this patch:
Node0 Node1

total       80        0
free        80        0
surplus     0         0

Backport adaptation for Linux 6.1:

Keep the existing page-based dissolution and vmemmap-restore control flow. Use the node surplus count to select adjust_surplus, and pass that same value to remove_hugetlb_page() and add_hugetlb_page() so a failed vmemmap restore reverses the surplus-accounting change as well.

Obtain the existing head page through page_folio() and use folio_hstate() to provide the declaration context expected by a363c62a653c ("mm/hugetlb:
do not dissolve gigantic pages without runtime support"). Provide its hstate_is_gigantic_no_runtime predicate as a local macro with the same expression already used by the page helpers. This lets the target apply unchanged without adding functions or importing the wider folio conversion.

Stable-dep-of: a363c62a653c ("mm/hugetlb: do not dissolve gigantic pages without runtime support")

---
 mm/hugetlb.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

index bfcb936084e85..497e975b28254 100644
@@ -47,6 +47,9 @@
 #include "internal.h"
 #include "hugetlb_vmemmap.h"
 
+#define hstate_is_gigantic_no_runtime(h) \
+	(hstate_is_gigantic(h) && !gigantic_page_runtime_supported())
+
 int hugetlb_max_hstate __read_mostly;
 unsigned int default_hstate_idx;
 struct hstate hstates[HUGE_MAX_HSTATE];

@@ -2355,8 +2358,11 @@ int dissolve_free_huge_page(struct page *page)
 	}
 
 	if (!page_count(page)) {
-		struct page *head = compound_head(page);
-		struct hstate *h = page_hstate(head);
+		struct folio *folio = page_folio(page);
+		struct page *head = &folio->page;
+		struct hstate *h = folio_hstate(folio);
+		bool adjust_surplus = false;
+
 		if (!available_huge_pages(h))
 			goto out;
 

@@ -2379,7 +2385,9 @@ int dissolve_free_huge_page(struct page *page)
 			goto retry;
 		}
 
-		remove_hugetlb_page(h, head, false);
+		if (h->surplus_huge_pages_node[page_to_nid(head)])
+			adjust_surplus = true;
+		remove_hugetlb_page(h, head, adjust_surplus);
 		h->max_huge_pages--;
 		spin_unlock_irq(&hugetlb_lock);
 

@@ -2396,7 +2404,7 @@ int dissolve_free_huge_page(struct page *page)
 			update_and_free_page(h, head, false);
 		} else {
 			spin_lock_irq(&hugetlb_lock);
-			add_hugetlb_page(h, head, false);
+			add_hugetlb_page(h, head, adjust_surplus);
 			h->max_huge_pages++;
 			spin_unlock_irq(&hugetlb_lock);
 		}

2.53.0

From: Usama Arif <[email protected]>

[ Upstream commit a743e0af503a633e4ca68a100d9b2a1a071fe8ae ]

This is a common condition used to skip operations that cannot be performed on gigantic pages when runtime support is disabled. This helper is introduced as the condition will exist even more when allowing "overcommit" of gigantic hugepages. No functional change intended with this patch.

Backport adaptation for Linux 6.1:

The preceding surplus-accounting backport already provides hstate_is_gigantic_no_runtime() as a local macro with the identical predicate. Reuse it and omit the upstream inline function definition, whose surrounding hugetlb_free_folio() context is absent in this tree. This avoids importing newer folio/CMA APIs or adding functions.

Retain all five condition replacements in the existing page-based removal, freeing, surplus-return, demotion-setup, and pool-resizing paths. The predicate and short-circuit evaluation remain unchanged, so this is still a non-functional refactoring. The dissolution context prepared by the preceding backport is preserved, allowing a363c62a653c to apply unchanged.

Stable-dep-of: a363c62a653c ("mm/hugetlb: do not dissolve gigantic pages without runtime support")

---
 mm/hugetlb.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

index 497e975b28254..7c7a1faebd047 100644
@@ -1673,7 +1673,7 @@ static void __remove_hugetlb_page(struct hstate *h, struct page *page,
 	VM_BUG_ON_FOLIO(hugetlb_cgroup_from_folio_rsvd(folio), folio);
 
 	lockdep_assert_held(&hugetlb_lock);
-	if (hstate_is_gigantic(h) && !gigantic_page_runtime_supported())
+	if (hstate_is_gigantic_no_runtime(h))
 		return;
 
 	list_del(&page->lru);

@@ -1769,7 +1769,7 @@ static void __update_and_free_page(struct hstate *h, struct page *page)
 	int i;
 	struct page *subpage;
 
-	if (hstate_is_gigantic(h) && !gigantic_page_runtime_supported())
+	if (hstate_is_gigantic_no_runtime(h))
 		return;
 
 	/*

@@ -2691,7 +2691,7 @@ static void return_unused_surplus_pages(struct hstate *h,
 	/* Uncommit the reservation */
 	h->resv_huge_pages -= unused_resv_pages;
 
-	if (hstate_is_gigantic(h) && !gigantic_page_runtime_supported())
+	if (hstate_is_gigantic_no_runtime(h))
 		goto out;
 
 	/*

@@ -3406,7 +3406,7 @@ static void __init hugetlb_init_hstates(void)
 		 * - If CMA allocation is possible, we can not demote
 		 *   HUGETLB_PAGE_ORDER or smaller size pages.
 		 */
-		if (hstate_is_gigantic(h) && !gigantic_page_runtime_supported())
+		if (hstate_is_gigantic_no_runtime(h))
 			continue;
 		if (hugetlb_cma_size && h->order <= HUGETLB_PAGE_ORDER)
 			continue;

@@ -3802,7 +3802,7 @@ static ssize_t __nr_hugepages_store_common(bool obey_mempolicy,
 	int err;
 	nodemask_t nodes_allowed, *n_mask;
 
-	if (hstate_is_gigantic(h) && !gigantic_page_runtime_supported())
+	if (hstate_is_gigantic_no_runtime(h))
 		return -EINVAL;
 
 	if (nid == NUMA_NO_NODE) {

2.53.0

From: Longlong Xia <[email protected]>

[ Upstream commit a363c62a653cc8b3e21da9545fa4e028ef50f9c3 ]

dissolve_free_hugetlb_folio() doesn't check hstate_is_gigantic_no_runtime(h) though remove_hugetlb_folio()/ update_and_free_hugetlb_folio() silently bail for such folios, so it frees a still-listed folio and, on vmemmap restore failure, the add_hugetlb_folio() rollback corrupts the free list.

---
 mm/hugetlb.c | 9 +++++++++
 1 file changed, 9 insertions(+)

index 7c7a1faebd047..879c9663302fb 100644
@@ -2363,6 +2363,15 @@ int dissolve_free_huge_page(struct page *page)
 		struct hstate *h = folio_hstate(folio);
 		bool adjust_surplus = false;
 
+		/*
+		 * remove_hugetlb_folio()/update_and_free_hugetlb_folio() bail
+		 * for gigantic hstates without runtime support, so dissolving one
+		 * here would leave it on the free list and, on vmemmap restore
+		 * failure, the add_hugetlb_folio() rollback corrupts that list.
+		 */
+		if (hstate_is_gigantic_no_runtime(h))
+			goto out;
+
 		if (!available_huge_pages(h))
 			goto out;
 

2.53.0