From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9DCDC368276 for ; Sun, 26 Apr 2026 14:45:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777214724; cv=none; b=FJ4QC0oIevzZbYrN0kQE6z5fHqSmhy411c7SHLW8IYf1GK4O5zHCZZ08Vv2vOOMNLMt9HNXvOGMPk2xMHKLx+H95KDm9bUhSfa6AR2Vnk17uJ9Q3QSPwunlkM3cv0RrgzBaCWTY6+gk8aeZeiIlEuN9jzQQah41CDTuEJCcDIgI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777214724; c=relaxed/simple; bh=7YaBT6iNVRZFSk14jBUoMTS77VVYE51p/LoYdbnTAqA=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=LDfYGxHr7LfDJvo0MSD5Epx1i6/UIz1rgtPTbEZABQze507FDVbMeTX0tDj0BZIiP0SEuKWPrg2lD1CKc6WiiMCz88ZNfHLKbLv2ptvppu0JK3Z/UKK6uNuxk8tLzsKZmhokwmNnw+5WtPwgRgkASMDVdIO88iEOfHL4UPVKBoc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=bytedance.com; spf=pass smtp.mailfrom=bytedance.com; dkim=pass (2048-bit key) header.d=bytedance.com header.i=@bytedance.com header.b=GH9QmemW; arc=none smtp.client-ip=209.85.216.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=bytedance.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bytedance.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bytedance.com header.i=@bytedance.com header.b="GH9QmemW" Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-35da8d037a5so4427363a91.0 for ; Sun, 26 Apr 2026 07:45:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bytedance.com; s=google; t=1777214719; x=1777819519; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=mYEWwYPnxNhfjfvrN9NBByfvj86/jsr9iqTYqVjgdNU=; b=GH9QmemWAO9ojjYIbbd1iH538EruKq2wI1OUxm1dKsRhiyxk/fLxgHlYEne+8ot/wg 48evAYTITwF8ITQ+NVqt3HtgOiVGqArjuATqTQvioK58yeRfHeECak0NmOOPNa5i+jnI 9BzBcV8VgctM/Q3MJ1Rtgyd6FpcTjrFuBrc19rvp13T8pWzDffEYBjWyysazNadIWzeb n4GGdPsFM8cvsG0J+3cNqmDZWhubeWhgTOkHyJw6piDUDoeKSxCHFuA1WNHnSy9Bo0OD jrpTNaekELKoOYUIRd+l+7ZrDiMwmOmKp6NPXvf0GjSB8c684h8PztLjL3yghoz5mpCz sN4w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777214719; x=1777819519; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=mYEWwYPnxNhfjfvrN9NBByfvj86/jsr9iqTYqVjgdNU=; b=WLsf5K5FaQ1t/Lud0do5PGCbT+abCcGvXRoq4q71pEVmRdWybH1jyiNJsN/1lJNr+p iAzRtljVVNjtEcpcrQrmFoMHCcBKgsVJyApQCP7ASMI940lvqNoDvLlyDjjDFzqUffpu KIcNl74GCIniiKlq2j+1iyf8I7EMyXYgamUSSQ9JKcmHE8BO9Qe4MAvK/yD4YqeQ/WxB sZ9p8x7enyo1WmtBXN6JQJUzBL/AjuTj4Oo8E1CaOYIKDgUTomG18p7vU+utOz3GgmRu R3f5FYyTRAxLE4gcANIgGmvMnXBuePy8qhU8RwGoGrMev6fyiRZ+gKQBVLXVGPSoghKa 1Ujw== X-Forwarded-Encrypted: i=1; AFNElJ+IR7O/RHNDNQZ/1Gim1qifMwgY8uqRm43IIJTZya/sNNCi9Ae9blnFZKClm+EtALOBsazd2uBh9XJVVDE=@vger.kernel.org X-Gm-Message-State: AOJu0Yw0UCFnR17qqwvfr8IyX1WOWJNsOyN/U89SZiMw4ZHvWTUBDuTB xhICh+l9kDVXlPoTF+Uy3FA/IZXSEh8GM27IoBByE9Nm0sDInyOqFQwF/2rvbVi4RXStea+cuVD lB1Jy X-Gm-Gg: AeBDiesP5UJMXfsK4aP8FMzUiy5vf5cuqM3ccYpWdC59YtFtMRNLfMncVvWnTW8SpfF Sp+byvTsJG2gd5P6CckoASqshZZpgJml63OZsCdZ0+sIc+adkGLnhbnDYDOqhKogfPTiKdkTkKW mhHKu1pIji7lPFWCARbQpJPUaTp8UXB3L6GfBgxk6Ze5vhzsVg5mA0UFJGeQ6z2ev1sUNpolCKZ fvZQ8mc3B8g71PJgeTFiWoO9+oyeRu68pXkUfb/KLhrXqaprpauZE6GNAVKe4hVNIR9o8rVrbN/ uEbdp30Xx1IIyqJBtIblufs9lK9gGAX5oZopd3nqQjlqY4yMIPXB/pKKG/haTylBWNPWRzqurKw tAkHIAgCHRbMJ0thEKMmYBeFAjEUUWamKrr+Rx7e6DQKEof9Ig25Bm/+9S4exrSbG+M7eR01e3/ 9C028jh89s2lEb6SbDt0OWpBSRAJOa X-Received: by 2002:a17:90a:f94f:b0:35f:c5cd:cc5 with SMTP id 98e67ed59e1d1-36140498686mr40821690a91.24.1777214718891; Sun, 26 Apr 2026 07:45:18 -0700 (PDT) Received: from n232-176-004.byted.org ([240e:83:200::349]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c797703059fsm22340550a12.24.2026.04.26.07.45.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 26 Apr 2026 07:45:18 -0700 (PDT) From: Muchun Song To: David Hildenbrand , Oscar Salvador , Andrew Morton , Greg Kroah-Hartman , "Rafael J. Wysocki" , Danilo Krummrich Cc: muchun.song@linux.dev, Ying Huang , Dan Williams , Vishal Verma , Miaohe Lin , Naoya Horiguchi , linux-mm@kvack.org, linux-cxl@vger.kernel.org, driver-core@lists.linux.dev, linux-kernel@vger.kernel.org, Muchun Song , stable@vger.kernel.org Subject: [PATCH 2/2] drivers/base/memory: fix memory block reference leak in poison accounting Date: Sun, 26 Apr 2026 22:44:47 +0800 Message-Id: <20260426144447.817722-2-songmuchun@bytedance.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20260426144447.817722-1-songmuchun@bytedance.com> References: <20260426144447.817722-1-songmuchun@bytedance.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit memblk_nr_poison_inc() and memblk_nr_poison_sub() look up a memory block via find_memory_block_by_id(), which acquires a reference to the memory block device. Both helpers use the returned memory block without dropping that reference, leaking the device reference on each successful lookup. Drop the reference after updating nr_hwpoison. Fixes: 5033091de814 ("mm/hwpoison: introduce per-memory_block hwpoison counter") Cc: stable@vger.kernel.org Signed-off-by: Muchun Song --- drivers/base/memory.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/base/memory.c b/drivers/base/memory.c index f806a683b767..6981b55d582a 100644 --- a/drivers/base/memory.c +++ b/drivers/base/memory.c @@ -1230,8 +1230,10 @@ void memblk_nr_poison_inc(unsigned long pfn) const unsigned long block_id = pfn_to_block_id(pfn); struct memory_block *mem = find_memory_block_by_id(block_id); - if (mem) + if (mem) { atomic_long_inc(&mem->nr_hwpoison); + put_device(&mem->dev); + } } void memblk_nr_poison_sub(unsigned long pfn, long i) @@ -1239,8 +1241,10 @@ void memblk_nr_poison_sub(unsigned long pfn, long i) const unsigned long block_id = pfn_to_block_id(pfn); struct memory_block *mem = find_memory_block_by_id(block_id); - if (mem) + if (mem) { atomic_long_sub(i, &mem->nr_hwpoison); + put_device(&mem->dev); + } } static unsigned long memblk_nr_poison(struct memory_block *mem) -- 2.20.1