Subject: BUG: mm: VM_BUG_ON_PAGE in post_alloc_hook() via __ClearPagePrezeroed() on compound pages

From: Breno Leitao <[email-masked]>
Date: Thu, 4 Jun 2026 03:59:06 -0700

Hi Michael,

Booting next-20260603 (a225caacc365) on arm64 with CONFIG_DEBUG_VM=y
panics in start_kernel() during kmem_cache_init():

  page dumped because: VM_BUG_ON_PAGE(1 && PageCompound(page))
  kernel BUG at ./include/linux/page-flags.h:682!
  Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP
  CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.1.0-rc6-next-20260603
  Hardware name: linux,dummy-virt (DT)
  pc : post_alloc_hook+0x224/0x2b8
  Call trace:
   post_alloc_hook+0x224/0x2b8 (P)
   get_page_from_freelist+0x18a4/0x1b18
   __alloc_frozen_pages_noprof+0x1b0/0x2068
   __alloc_pages_mpol+0x130/0x2d0
   alloc_frozen_pages_noprof+0x64/0xe8
   alloc_slab_page+0x88/0x140
   new_slab+0x11c/0x680
   ___slab_alloc+0x18c/0x7f0
   __kmalloc_noprof+0x534/0x938
   do_kmem_cache_create+0x724/0x890
   create_boot_cache+0xc8/0x148
   create_kmalloc_cache+0x5c/0xc8
   new_kmalloc_cache+0x274/0x438
   create_kmalloc_caches+0x2c/0x88
   kmem_cache_init+0x228/0x2e0
   mm_core_init+0x74/0xa0
   start_kernel+0x1cc/0x4d0

Bisected (by inspection) to:

  504f40f6bda6 ("mm: page_reporting: skip redundant zeroing of host-zeroed
                 reported pages")

Reproducer:
  - linux-next 20260603, arm64 defconfig + DEBUG_VM=y (any debug-heavy
    config will do; mine also has PROVE_LOCKING/DEBUG_LOCK_ALLOC, but
    those are not required to trip the BUG once an order>0 __GFP_COMP
    allocation hits prep_new_page).
  - Boot under qemu-system-aarch64 -M virt with earlycon enabled.

I've tested something like the following and  I was able to boot the host:

  --- a/include/linux/page-flags.h
  +++ b/include/linux/page-flags.h
  @@ -679,7 +679,7 @@ FOLIO_FLAG_FALSE(idle)
    * PagePrezeroed() tracks pages known to be zero.  The allocator
    * uses this to skip redundant zeroing in post_alloc_hook().
    */
  -__PAGEFLAG(Prezeroed, prezeroed, PF_NO_COMPOUND)
  +__PAGEFLAG(Prezeroed, prezeroed, PF_ANY)

With that change the lockdep+DEBUG_VM kernel boots all the way through
SMP init and hands off to PID 1 on arm64.

Happy to test a follow-up patch if you'd prefer a different shape.

Thanks,
--breno