From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f174.google.com (mail-pg1-f174.google.com [209.85.215.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CE51D3D3481 for ; Tue, 28 Apr 2026 08:19:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.174 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777364356; cv=none; b=D4aCIipJaL+JGDQWEpJppyNX2f+3gz/nhRZUcOBB6qIH6Pn/nC90/fjUCu/4y0jMRdEFWWlfJiei32zRSahmq3ka6srJe3RiHWv4m5m2zUF2FVjXOvAyu+xAHKWHwwJVasgZK6rT5hKtQNzMD76rOx+H2oSYGUdiQjCPxnWlTGk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777364356; c=relaxed/simple; bh=T4yKhyHGB1poxPphLLlyVRDB+bCKixNLLBGYdEPxJas=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=RneErVeLDTdPiFVDrjdnAVM/bCN2cdIM0/QPLjhoiUSBL+WzshZ4c05AfFXDNoqwore1/wynmsNCe0rMVgGijpOkXJx2ACu/J2QdR+I4JgofKswH69fYAmpmG0yXGoT3mAlXqrmTQENQmbaHnGnltBEJpUBB4ph4YX6uDhPRupQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=bytedance.com; spf=pass smtp.mailfrom=bytedance.com; dkim=pass (2048-bit key) header.d=bytedance.com header.i=@bytedance.com header.b=bnbZl8YO; arc=none smtp.client-ip=209.85.215.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=bytedance.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bytedance.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bytedance.com header.i=@bytedance.com header.b="bnbZl8YO" Received: by mail-pg1-f174.google.com with SMTP id 41be03b00d2f7-c76c60c7502so4398030a12.0 for ; Tue, 28 Apr 2026 01:19:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bytedance.com; s=google; t=1777364354; x=1777969154; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=HM345nkBQh5gaxmYsV6Qr69X0RaLtEwieY1kCbsL1/U=; b=bnbZl8YOqfGj4yJfTP1VKSpo3Bb1/YLehDdTWm89VE8SAisnzo2OAtnVpDOsWfCUsa R0XUYMjnPSPcNUfrHT1iE4N/TLlYoSoBArRBTgMCM8a3EU4xlk2wizncVp02N9QbYUGG xIpqxNPrwodmjI8CxSSzgKZ8B68HCCRgzpRxvjYNWGXSP9MfV9/Hlg0xrNmwms8HH1Tb FViZ5/MyJglwS1wkvqO0d4VdFsTNpOCKLWBDV38DSlnVktBVfi/5rboj5wJkJ8tfjifT jV6+vI/1OUcOqHK+lIlDJfBI2DQQMfmdQLnOYVvjyMiBmzsXuIAGJG0Y5DfTTaEe+MbK Tj/A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777364354; x=1777969154; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=HM345nkBQh5gaxmYsV6Qr69X0RaLtEwieY1kCbsL1/U=; b=Axapj6XlBlZoa5wxD/Jjow/l4k/aL/Ejc8Zqa/3l5EFNKBWfIuhbGZlJgrId7MsB0N +cq3mi5PvjN7K2Ir7tKjVdJcEzbq0fDdZMsXogqGv1MHYaefbdEw2T3eccpmv5RSIWuB B2gqiudFej8SzUQio3sJlY2FnOWrEdY5HukcreS8Zy45AxPv1zkTYiEqgxiTiszE1Mzd 3rJLuZ87uRRlY3Ufra7aTbpeDVnaSuJ1IXb8DQ1K2X3+IAKrurXzJsxuuJqLGeb/ygIH 5JotWdLpgqlLv00hCm2tYHq7W0WGE73J5q1ibgbCXG6aB73B3nd0Hg0nzXpnfXWbFRsA CEPg== X-Forwarded-Encrypted: i=1; AFNElJ98XcdQXky3+Onkb0mhOj9rBTEpPWsoyuJOn3eLc8qqbLTo1lyM9mFpsz7/rdZRY/N16Sa1vQdWRH13DAc=@vger.kernel.org X-Gm-Message-State: AOJu0YyBOxXLDf892uUpELMcqxHB+fibf6yOyya6id9A4oShIR2/0N0L 6Tij4arrtojhimEFg7Rn2N8LwBN03hdyO0JoNxaMHYMRRvsUAgWBKu0nmwi9WLnXPMA= X-Gm-Gg: AeBDies2jF+LoWSUZnne4zmtFI+AOLSulbOuoTGRYgmTDnLJtE0jB7RlbpVELG9zaQ/ HtV7HgssLYIfGV5aqxyYU4JsYageIrTyK6LwjNUF/SnJ1wFB1BjwD6ITAXcNMgO3KlUN6OuH4qO +7igiIYQYtjFmDaGGZcj0z0qPWVofA3BLtenFS/Dw6dh1+6wFgK2uRJ59gu7PZv4/RJSaXtQ1NC AiKpwHpwHLN2vXfc1pNg6mXc5p5tkyNCkNzuWFo1QiS4IgCIiZaDCH7J301ZRDWItBtV3NmuzZb SfTBrKiicURx6w85yPuQ13YfcooY5VICcf7Zb5FNzrYLEblbCMQDPhjp1iz9eIACAuobcdgnVzQ uQY4v/B+rkQGkgxg8bDOdWuZWVyy7vrn4IRqqOFxkCM8m7rra0cJI6Q1DtMTL30cH0UPE4JkmoI 4PLIx7TNqAjyE4AP/dpp7qoyIDegtQk3ILlk1u5jTuQbTPPu07s0/Jl8g= X-Received: by 2002:a17:90b:5804:b0:35f:b230:5889 with SMTP id 98e67ed59e1d1-36491ccd608mr1594024a91.6.1777364354086; Tue, 28 Apr 2026 01:19:14 -0700 (PDT) Received: from n232-176-004.byted.org ([36.110.163.101]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3649003650esm2181356a91.8.2026.04.28.01.19.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 28 Apr 2026 01:19:13 -0700 (PDT) From: Muchun Song To: Andrew Morton , David Hildenbrand , Muchun Song , Oscar Salvador , Michael Ellerman , Madhavan Srinivasan Cc: Lorenzo Stoakes , "Liam R . Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Nicholas Piggin , Christophe Leroy , aneesh.kumar@linux.ibm.com, joao.m.martins@oracle.com, linux-mm@kvack.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, Muchun Song , stable@vger.kernel.org Subject: [PATCH v8 2/6] mm/memory_hotplug: Fix incorrect altmap passing in error path Date: Tue, 28 Apr 2026 16:18:51 +0800 Message-Id: <20260428081855.1249045-3-songmuchun@bytedance.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20260428081855.1249045-1-songmuchun@bytedance.com> References: <20260428081855.1249045-1-songmuchun@bytedance.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit In create_altmaps_and_memory_blocks(), when arch_add_memory() succeeds with memmap_on_memory enabled, the vmemmap pages are allocated from params.altmap. If create_memory_block_devices() subsequently fails, the error path calls arch_remove_memory() with a NULL altmap instead of params.altmap. This is a bug that could lead to memory corruption. Since altmap is NULL, vmemmap_free() falls back to freeing the vmemmap pages into the system buddy allocator via free_pages() instead of the altmap. arch_remove_memory() then immediately destroys the physical linear mapping for this memory. This injects unowned pages into the buddy allocator, causing machine checks or memory corruption if the system later attempts to allocate and use those freed pages. Fix this by passing params.altmap to arch_remove_memory() in the error path. Fixes: 6b8f0798b85a ("mm/memory_hotplug: split memmap_on_memory requests across memblocks") Cc: stable@vger.kernel.org Signed-off-by: Muchun Song Acked-by: David Hildenbrand (Arm) --- mm/memory_hotplug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c index 4426abb05655..e3352284f635 100644 --- a/mm/memory_hotplug.c +++ b/mm/memory_hotplug.c @@ -1469,7 +1469,7 @@ static int create_altmaps_and_memory_blocks(int nid, struct memory_group *group, ret = create_memory_block_devices(cur_start, memblock_size, nid, params.altmap, group); if (ret) { - arch_remove_memory(cur_start, memblock_size, NULL); + arch_remove_memory(cur_start, memblock_size, params.altmap); kfree(params.altmap); goto out; } -- 2.20.1