mm: Regression with v7.0-rc1 on RISC-V

[Kefeng Wang]

On 2026/2/24 16:37, Ron Economos wrote:
> I'm getting a BUG dump during shutdown with Linux v7.0-rc1 on RISC-V.
> 
> [  OK  ] Reached target shutdown.target - System Shutdown.
> [  OK  ] Reached target final.target - Late Shutdown Services.
> [  OK  ] Finished systemd-reboot.service - System Reboot.
> [  OK  ] Reached target reboot.target - System Reboot.
> [  173.985249] BUG: Bad page state in process shutdown  pfn:f8850
> [  173.985311] page: refcount:1 mapcount:0 mapping:0000000000000000 
> index:0x0 pfn:0xf8850
> [  173.985336] flags: 0xffff80000000000(node=0|zone=0| 
> lastcpupid=0x1ffff) CMA
> [  173.985365] raw: 0ffff80000000000 ffffffc501e21448 ffffffc600f2ae88 
> 0000000000000000
> [  173.985386] raw: 0000000000000000 0000000000000000 00000001ffffffff 
> 0000000000000000
> [  173.985403] page dumped because: nonzero _refcount


The refcount set to 1 when cma_alloc() by set_page_refcounted(), and it
will be dec to 0 in cma_release() by put_page_testzero(), there may be a 
problem somewhere else?

Could you enable CONFIG_DEBUG_VM and CONFIG_DEBUG_PAGE_REF, and try to 
track down page reference manipulation by tracepoint? or for CMA-related
pages, introduce explicit printk both increments and decrements of the 
page reference count to identify the root cause of the issue.