[PATCH v4] sched/isolation: Defer freeing of cpumask memblock memory to initcall

[PATCH v4] sched/isolation: Defer freeing of cpumask memblock memory to initcall

[Waiman Long]

When testing a linux-next kernel with commit 59bd1d914bb5 ("memblock:
warn when freeing reserved memory before memory map is initialized"),
the following warning was hit when there was a "nohz_full" kernel boot
parameter.

  Cannot free reserved memory because of deferred initialization of the memory map
  WARNING: mm/memblock.c:904 at __free_reserved_area+0xde/0xf0, CPU#0: swapper/0/0
    :
  Call Trace:
   <TASK>
   memblock_phys_free+0xcb/0x100
   housekeeping_init+0x14c/0x170
   start_kernel+0x207/0x450
   x86_64_start_reservations+0x24/0x30
   x86_64_start_kernel+0xda/0xe0
   common_startup_64+0x13e/0x141
   </TASK>

IOW, we shouldn't free memblock allocated memory so early
in the boot process when memory map isn't fully initialized in
deferred_init_memmap().

Fix it by saving the housekeeping cpumask memblock memory to be
freed into a llist free list in housekeeping_init() and add a new
housekeeping_late_init() helper to defer the actual freeing of memblock
memory to when initcall's are being processed. The cpumask memblock
memory is treated as a llist_node with the size of a "long" type which
is also smallest cpumask size that can be allocated.

The non-atomic version of the llist APIs are used as there is no
contention.

This commit depends on the presence of commit 7c2eee9c1367 ("memblock:
don't touch memblock arrays when memblock_free() is called late")
to prevent a KASAN UAF bug report [1].

 [1] https://lore.kernel.org/lkml/20260505051821.1107133-1-longman@redhat.com/

Fixes: 27c3a5967f05 ("sched/isolation: Convert housekeeping cpumasks to rcu pointers")
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Reviewed-by: Phil Auld <pauld@redhat.com>
Signed-off-by: Waiman Long <longman@redhat.com>
---
 kernel/sched/isolation.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

 [v4] Collect tags and update commit log

diff --git a/kernel/sched/isolation.c b/kernel/sched/isolation.c
index ef152d401fe2..156025ef81b7 100644
--- a/kernel/sched/isolation.c
+++ b/kernel/sched/isolation.c
@@ -8,6 +8,7 @@
  *
  */
 #include <linux/sched/isolation.h>
+#include <linux/llist.h>
 #include <linux/pci.h>
 #include "sched.h"
 
@@ -27,6 +28,7 @@ struct housekeeping {
 };
 
 static struct housekeeping housekeeping;
+static __initdata LLIST_HEAD(memblock_freelist);
 
 bool housekeeping_enabled(enum hk_type type)
 {
@@ -189,10 +191,22 @@ void __init housekeeping_init(void)
 		WARN_ON_ONCE(cpumask_empty(omask));
 		cpumask_copy(nmask, omask);
 		RCU_INIT_POINTER(housekeeping.cpumasks[type], nmask);
-		memblock_free(omask, cpumask_size());
+		__llist_add((struct llist_node *)omask, &memblock_freelist);
 	}
 }
 
+static int __init housekeeping_late_init(void)
+{
+	struct llist_node *llnode, *pos, *t;
+
+	/* Free allocated memblock memory, if any */
+	llnode = __llist_del_all(&memblock_freelist);
+	llist_for_each_safe(pos, t, llnode)
+		memblock_free(pos, cpumask_size());
+	return 0;
+}
+pure_initcall(housekeeping_late_init);
+
 static void __init housekeeping_setup_type(enum hk_type type,
 					   cpumask_var_t housekeeping_staging)
 {
-- 
2.54.0

Re: [PATCH v4] sched/isolation: Defer freeing of cpumask memblock memory to initcall

[Waiman Long]

On 7/1/26 3:58 PM, Waiman Long wrote:
> When testing a linux-next kernel with commit 59bd1d914bb5 ("memblock:
> warn when freeing reserved memory before memory map is initialized"),
> the following warning was hit when there was a "nohz_full" kernel boot
> parameter.
>
>    Cannot free reserved memory because of deferred initialization of the memory map
>    WARNING: mm/memblock.c:904 at __free_reserved_area+0xde/0xf0, CPU#0: swapper/0/0
>      :
>    Call Trace:
>     <TASK>
>     memblock_phys_free+0xcb/0x100
>     housekeeping_init+0x14c/0x170
>     start_kernel+0x207/0x450
>     x86_64_start_reservations+0x24/0x30
>     x86_64_start_kernel+0xda/0xe0
>     common_startup_64+0x13e/0x141
>     </TASK>
>
> IOW, we shouldn't free memblock allocated memory so early
> in the boot process when memory map isn't fully initialized in
> deferred_init_memmap().
>
> Fix it by saving the housekeeping cpumask memblock memory to be
> freed into a llist free list in housekeeping_init() and add a new
> housekeeping_late_init() helper to defer the actual freeing of memblock
> memory to when initcall's are being processed. The cpumask memblock
> memory is treated as a llist_node with the size of a "long" type which
> is also smallest cpumask size that can be allocated.
>
> The non-atomic version of the llist APIs are used as there is no
> contention.
>
> This commit depends on the presence of commit 7c2eee9c1367 ("memblock:
> don't touch memblock arrays when memblock_free() is called late")
> to prevent a KASAN UAF bug report [1].
>
>   [1] https://lore.kernel.org/lkml/20260505051821.1107133-1-longman@redhat.com/
>
> Fixes: 27c3a5967f05 ("sched/isolation: Convert housekeeping cpumasks to rcu pointers")
> Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
> Reviewed-by: Phil Auld <pauld@redhat.com>
> Signed-off-by: Waiman Long <longman@redhat.com>

Peter,

Are you OK with this patch as I would like to get it merged into v7.3 if 
possible?

Cheers,
Longman

> ---
>   kernel/sched/isolation.c | 16 +++++++++++++++-
>   1 file changed, 15 insertions(+), 1 deletion(-)
>
>   [v4] Collect tags and update commit log
>
> diff --git a/kernel/sched/isolation.c b/kernel/sched/isolation.c
> index ef152d401fe2..156025ef81b7 100644
> --- a/kernel/sched/isolation.c
> +++ b/kernel/sched/isolation.c
> @@ -8,6 +8,7 @@
>    *
>    */
>   #include <linux/sched/isolation.h>
> +#include <linux/llist.h>
>   #include <linux/pci.h>
>   #include "sched.h"
>   
> @@ -27,6 +28,7 @@ struct housekeeping {
>   };
>   
>   static struct housekeeping housekeeping;
> +static __initdata LLIST_HEAD(memblock_freelist);
>   
>   bool housekeeping_enabled(enum hk_type type)
>   {
> @@ -189,10 +191,22 @@ void __init housekeeping_init(void)
>   		WARN_ON_ONCE(cpumask_empty(omask));
>   		cpumask_copy(nmask, omask);
>   		RCU_INIT_POINTER(housekeeping.cpumasks[type], nmask);
> -		memblock_free(omask, cpumask_size());
> +		__llist_add((struct llist_node *)omask, &memblock_freelist);
>   	}
>   }
>   
> +static int __init housekeeping_late_init(void)
> +{
> +	struct llist_node *llnode, *pos, *t;
> +
> +	/* Free allocated memblock memory, if any */
> +	llnode = __llist_del_all(&memblock_freelist);
> +	llist_for_each_safe(pos, t, llnode)
> +		memblock_free(pos, cpumask_size());
> +	return 0;
> +}
> +pure_initcall(housekeeping_late_init);
> +
>   static void __init housekeeping_setup_type(enum hk_type type,
>   					   cpumask_var_t housekeeping_staging)
>   {

Re: [PATCH v4] sched/isolation: Defer freeing of cpumask memblock memory to initcall

[Waiman Long]

On 7/1/26 3:58 PM, Waiman Long wrote:
> When testing a linux-next kernel with commit 59bd1d914bb5 ("memblock:
> warn when freeing reserved memory before memory map is initialized"),
> the following warning was hit when there was a "nohz_full" kernel boot
> parameter.
>
>    Cannot free reserved memory because of deferred initialization of the memory map
>    WARNING: mm/memblock.c:904 at __free_reserved_area+0xde/0xf0, CPU#0: swapper/0/0
>      :
>    Call Trace:
>     <TASK>
>     memblock_phys_free+0xcb/0x100
>     housekeeping_init+0x14c/0x170
>     start_kernel+0x207/0x450
>     x86_64_start_reservations+0x24/0x30
>     x86_64_start_kernel+0xda/0xe0
>     common_startup_64+0x13e/0x141
>     </TASK>
>
> IOW, we shouldn't free memblock allocated memory so early
> in the boot process when memory map isn't fully initialized in
> deferred_init_memmap().
>
> Fix it by saving the housekeeping cpumask memblock memory to be
> freed into a llist free list in housekeeping_init() and add a new
> housekeeping_late_init() helper to defer the actual freeing of memblock
> memory to when initcall's are being processed. The cpumask memblock
> memory is treated as a llist_node with the size of a "long" type which
> is also smallest cpumask size that can be allocated.
>
> The non-atomic version of the llist APIs are used as there is no
> contention.
>
> This commit depends on the presence of commit 7c2eee9c1367 ("memblock:
> don't touch memblock arrays when memblock_free() is called late")
> to prevent a KASAN UAF bug report [1].
>
>   [1] https://lore.kernel.org/lkml/20260505051821.1107133-1-longman@redhat.com/
>
> Fixes: 27c3a5967f05 ("sched/isolation: Convert housekeeping cpumasks to rcu pointers")
> Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
> Reviewed-by: Phil Auld <pauld@redhat.com>
> Signed-off-by: Waiman Long <longman@redhat.com>
> ---
>   kernel/sched/isolation.c | 16 +++++++++++++++-
>   1 file changed, 15 insertions(+), 1 deletion(-)
>
>   [v4] Collect tags and update commit log
>
> diff --git a/kernel/sched/isolation.c b/kernel/sched/isolation.c
> index ef152d401fe2..156025ef81b7 100644
> --- a/kernel/sched/isolation.c
> +++ b/kernel/sched/isolation.c
> @@ -8,6 +8,7 @@
>    *
>    */
>   #include <linux/sched/isolation.h>
> +#include <linux/llist.h>
>   #include <linux/pci.h>
>   #include "sched.h"
>   
> @@ -27,6 +28,7 @@ struct housekeeping {
>   };
>   
>   static struct housekeeping housekeeping;
> +static __initdata LLIST_HEAD(memblock_freelist);
>   
>   bool housekeeping_enabled(enum hk_type type)
>   {
> @@ -189,10 +191,22 @@ void __init housekeeping_init(void)
>   		WARN_ON_ONCE(cpumask_empty(omask));
>   		cpumask_copy(nmask, omask);
>   		RCU_INIT_POINTER(housekeeping.cpumasks[type], nmask);
> -		memblock_free(omask, cpumask_size());
> +		__llist_add((struct llist_node *)omask, &memblock_freelist);
>   	}
>   }
>   
> +static int __init housekeeping_late_init(void)
> +{
> +	struct llist_node *llnode, *pos, *t;
> +
> +	/* Free allocated memblock memory, if any */
> +	llnode = __llist_del_all(&memblock_freelist);
> +	llist_for_each_safe(pos, t, llnode)
> +		memblock_free(pos, cpumask_size());
> +	return 0;
> +}
> +pure_initcall(housekeeping_late_init);
> +
>   static void __init housekeeping_setup_type(enum hk_type type,
>   					   cpumask_var_t housekeeping_staging)
>   {

Ping!

Is this patch in a state that is merge-able?

Cheers,
Longman

Re: [PATCH v4] sched/isolation: Defer freeing of cpumask memblock memory to initcall

[Waiman Long]

On 7/29/26 1:51 PM, Waiman Long wrote:
> On 7/1/26 3:58 PM, Waiman Long wrote:
>> When testing a linux-next kernel with commit 59bd1d914bb5 ("memblock:
>> warn when freeing reserved memory before memory map is initialized"),
>> the following warning was hit when there was a "nohz_full" kernel boot
>> parameter.
>>
>>    Cannot free reserved memory because of deferred initialization of 
>> the memory map
>>    WARNING: mm/memblock.c:904 at __free_reserved_area+0xde/0xf0, 
>> CPU#0: swapper/0/0
>>      :
>>    Call Trace:
>>     <TASK>
>>     memblock_phys_free+0xcb/0x100
>>     housekeeping_init+0x14c/0x170
>>     start_kernel+0x207/0x450
>>     x86_64_start_reservations+0x24/0x30
>>     x86_64_start_kernel+0xda/0xe0
>>     common_startup_64+0x13e/0x141
>>     </TASK>
>>
>> IOW, we shouldn't free memblock allocated memory so early
>> in the boot process when memory map isn't fully initialized in
>> deferred_init_memmap().
>>
>> Fix it by saving the housekeeping cpumask memblock memory to be
>> freed into a llist free list in housekeeping_init() and add a new
>> housekeeping_late_init() helper to defer the actual freeing of memblock
>> memory to when initcall's are being processed. The cpumask memblock
>> memory is treated as a llist_node with the size of a "long" type which
>> is also smallest cpumask size that can be allocated.
>>
>> The non-atomic version of the llist APIs are used as there is no
>> contention.
>>
>> This commit depends on the presence of commit 7c2eee9c1367 ("memblock:
>> don't touch memblock arrays when memblock_free() is called late")
>> to prevent a KASAN UAF bug report [1].
>>
>>   [1] 
>> https://lore.kernel.org/lkml/20260505051821.1107133-1-longman@redhat.com/
>>
>> Fixes: 27c3a5967f05 ("sched/isolation: Convert housekeeping cpumasks 
>> to rcu pointers")
>> Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
>> Reviewed-by: Phil Auld <pauld@redhat.com>
>> Signed-off-by: Waiman Long <longman@redhat.com>
>> ---
>>   kernel/sched/isolation.c | 16 +++++++++++++++-
>>   1 file changed, 15 insertions(+), 1 deletion(-)
>>
>>   [v4] Collect tags and update commit log
>>
>> diff --git a/kernel/sched/isolation.c b/kernel/sched/isolation.c
>> index ef152d401fe2..156025ef81b7 100644
>> --- a/kernel/sched/isolation.c
>> +++ b/kernel/sched/isolation.c
>> @@ -8,6 +8,7 @@
>>    *
>>    */
>>   #include <linux/sched/isolation.h>
>> +#include <linux/llist.h>
>>   #include <linux/pci.h>
>>   #include "sched.h"
>>   @@ -27,6 +28,7 @@ struct housekeeping {
>>   };
>>     static struct housekeeping housekeeping;
>> +static __initdata LLIST_HEAD(memblock_freelist);
>>     bool housekeeping_enabled(enum hk_type type)
>>   {
>> @@ -189,10 +191,22 @@ void __init housekeeping_init(void)
>>           WARN_ON_ONCE(cpumask_empty(omask));
>>           cpumask_copy(nmask, omask);
>>           RCU_INIT_POINTER(housekeeping.cpumasks[type], nmask);
>> -        memblock_free(omask, cpumask_size());
>> +        __llist_add((struct llist_node *)omask, &memblock_freelist);
>>       }
>>   }
>>   +static int __init housekeeping_late_init(void)
>> +{
>> +    struct llist_node *llnode, *pos, *t;
>> +
>> +    /* Free allocated memblock memory, if any */
>> +    llnode = __llist_del_all(&memblock_freelist);
>> +    llist_for_each_safe(pos, t, llnode)
>> +        memblock_free(pos, cpumask_size());
>> +    return 0;
>> +}
>> +pure_initcall(housekeeping_late_init);
>> +
>>   static void __init housekeeping_setup_type(enum hk_type type,
>>                          cpumask_var_t housekeeping_staging)
>>   {
>
> Ping!
>
> Is this patch in a state that is merge-able? 

Any feedback?

Thanks,
Longman

[tip: sched/core] sched/isolation: Defer freeing of cpumask memblock memory to initcall

[tip-bot2 for Waiman Long]

The following commit has been merged into the sched/core branch of tip:

Commit-ID:     2b58c749b8c5244e259a0230bc57b10b010dc545
Gitweb:        https://git.kernel.org/tip/2b58c749b8c5244e259a0230bc57b10b010dc545
Author:        Waiman Long <longman@redhat.com>
AuthorDate:    Wed, 01 Jul 2026 15:58:10 -04:00
Committer:     Peter Zijlstra <peterz@infradead.org>
CommitterDate: Thu, 13 Aug 2026 12:37:03 +02:00

sched/isolation: Defer freeing of cpumask memblock memory to initcall

When testing a linux-next kernel with commit 59bd1d914bb5 ("memblock:
warn when freeing reserved memory before memory map is initialized"),
the following warning was hit when there was a "nohz_full" kernel boot
parameter.

  Cannot free reserved memory because of deferred initialization of the memory map
  WARNING: mm/memblock.c:904 at __free_reserved_area+0xde/0xf0, CPU#0: swapper/0/0
    :
  Call Trace:
   <TASK>
   memblock_phys_free+0xcb/0x100
   housekeeping_init+0x14c/0x170
   start_kernel+0x207/0x450
   x86_64_start_reservations+0x24/0x30
   x86_64_start_kernel+0xda/0xe0
   common_startup_64+0x13e/0x141
   </TASK>

IOW, we shouldn't free memblock allocated memory so early
in the boot process when memory map isn't fully initialized in
deferred_init_memmap().

Fix it by saving the housekeeping cpumask memblock memory to be
freed into a llist free list in housekeeping_init() and add a new
housekeeping_late_init() helper to defer the actual freeing of memblock
memory to when initcall's are being processed. The cpumask memblock
memory is treated as a llist_node with the size of a "long" type which
is also smallest cpumask size that can be allocated.

The non-atomic version of the llist APIs are used as there is no
contention.

This commit depends on the presence of commit 7c2eee9c1367 ("memblock:
don't touch memblock arrays when memblock_free() is called late")
to prevent a KASAN UAF bug report [1].

 [1] https://lore.kernel.org/lkml/20260505051821.1107133-1-longman@redhat.com/

Fixes: 27c3a5967f05 ("sched/isolation: Convert housekeeping cpumasks to rcu pointers")
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Reviewed-by: Phil Auld <pauld@redhat.com>
Link: https://patch.msgid.link/20260701195810.477326-1-longman@redhat.com
---
 kernel/sched/isolation.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/kernel/sched/isolation.c b/kernel/sched/isolation.c
index ef152d4..156025e 100644
--- a/kernel/sched/isolation.c
+++ b/kernel/sched/isolation.c
@@ -8,6 +8,7 @@
  *
  */
 #include <linux/sched/isolation.h>
+#include <linux/llist.h>
 #include <linux/pci.h>
 #include "sched.h"
 
@@ -27,6 +28,7 @@ struct housekeeping {
 };
 
 static struct housekeeping housekeeping;
+static __initdata LLIST_HEAD(memblock_freelist);
 
 bool housekeeping_enabled(enum hk_type type)
 {
@@ -189,10 +191,22 @@ void __init housekeeping_init(void)
 		WARN_ON_ONCE(cpumask_empty(omask));
 		cpumask_copy(nmask, omask);
 		RCU_INIT_POINTER(housekeeping.cpumasks[type], nmask);
-		memblock_free(omask, cpumask_size());
+		__llist_add((struct llist_node *)omask, &memblock_freelist);
 	}
 }
 
+static int __init housekeeping_late_init(void)
+{
+	struct llist_node *llnode, *pos, *t;
+
+	/* Free allocated memblock memory, if any */
+	llnode = __llist_del_all(&memblock_freelist);
+	llist_for_each_safe(pos, t, llnode)
+		memblock_free(pos, cpumask_size());
+	return 0;
+}
+pure_initcall(housekeeping_late_init);
+
 static void __init housekeeping_setup_type(enum hk_type type,
 					   cpumask_var_t housekeeping_staging)
 {