From: Tj <tj.iam.tj@proton.me>
To: "David Hildenbrand (Arm)" <david@kernel.org>, akpm@linux-foundation.org
Cc: linux-mm@kvack.org
Subject: Re: BUG: Bad page state in process kworker/u32:1
Date: Wed, 11 Mar 2026 18:27:57 +0000 [thread overview]
Message-ID: <2fc7c354-4e05-49d8-87c4-d80854033759@proton.me> (raw)
In-Reply-To: <9115acdf-edf8-4abf-a59c-8980c1375e67@kernel.org>
That fixed it, thank-you. Lost a week due to this thinking I'd done
something wrong since I'm working on getting kernel working on Samsung
Galaxy Book2 W737 and many bits from device-tree to drivers are problematic.
On 11/03/2026 16:17, David Hildenbrand (Arm) wrote:
> On 3/11/26 17:12, Tj wrote:
>> On arm64, Qualcomm sdm845, an attempt to allocate and release a CMA for
>> DMA fails. It seems to be caused by the recent commit 9bda131c6093e9c4
>> "mm: cma: add cma_alloc_frozen{_compound}()" where cma_alloc() now calls
>> set_page_refcounted() but cma_release() or its callees do not undo it,
>> resulting in:
>>
>> kernel: BUG: Bad page state in process kworker/u32:1 pfn:f4b00
>> kernel: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0
>> pfn:0xf4b00
>> kernel: flags: 0x1ffe00000000000(node=0|zone=0|lastcpupid=0xfff) CMA
>> kernel: raw: 01ffe00000000000 fffffdffc1d2c048 ffff800080353608
>> 0000000000000000
>> kernel: raw: 0000000000000000 0000000000000000 00000001ffffffff
>> 0000000000000000
>> kernel: page dumped because: nonzero _refcount
>>
>> I've enabled pr_debug plus added in my own pr_info()s to track the
>> callers. The following shows, first, my manual dump_stack() in
>> __cma_alloc_frozen() in order to understand the callers, and immediately
>> after the BUG.
> This might be fixed by
>
> commit f4355d6bb39fc8e53d772fa0654c8441b214e349
> Author: Zi Yan <ziy@nvidia.com>
> Date: Tue Feb 24 22:12:31 2026 -0500
>
> mm/cma: move put_page_testzero() out of VM_WARN_ON in cma_release()
>
> When CONFIG_DEBUG_VM is not set, VM_WARN_ON is a NOP. Putting any
> statement with side effect inside it is incorrect. Collect all
> !put_page_testzero() results and check the sum using WARN instead after
> the loop. It restores the same check in free_contig_range() before commit
> e0c1326779cc ("mm: page_alloc: add alloc_contig_frozen_{range,pages}()"),
> the commit prior to the Fixes one.
>
> Link: https://lkml.kernel.org/r/20260225031231.2352011-1-ziy@nvidia.com
>
> Can you double-check?
>
> --
> Cheers,
>
> David
prev parent reply other threads:[~2026-03-11 18:28 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-11 16:12 Tj
2026-03-11 16:17 ` David Hildenbrand (Arm)
2026-03-11 18:27 ` Tj [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2fc7c354-4e05-49d8-87c4-d80854033759@proton.me \
--to=tj.iam.tj@proton.me \
--cc=akpm@linux-foundation.org \
--cc=david@kernel.org \
--cc=linux-mm@kvack.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox