Re: [PATCH 20/22] arm64: mm: drop ctor/dtor calls for kernel page tables

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Kernel page tables allocated during memory hotplug leak the NR_PAGETABLE stat and retain the PG_pgtable flag when freed, causing a buddy allocator BUG on reallocation.
--

--- Patch [20]: [PATCH 20/22] arm64: mm: drop ctor/dtor calls for kernel page tables ---
commit eb398eca88012b977463df47eaf81e1fcd66213d
Author: Kevin Brodsky <kevin.brodsky@arm.com>

arm64: mm: drop ctor/dtor calls for kernel page tables
    
This patch removes pagetable constructor and destructor calls for kernel
page tables, under the assumption that they no longer perform necessary work.
It also removes the pgtable level callback arguments from the early
allocation wrappers.

> diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
> index f723bcf68174f..f1400c6f68ba7 100644
> --- a/arch/arm64/mm/mmu.c
> +++ b/arch/arm64/mm/mmu.c

[ ... ]

> @@ -1445,7 +1410,6 @@ static void free_hotplug_page_range(struct page *page, size_t size,
>  
>  static void free_hotplug_pgtable_page(struct page *page)
>  {
> -	pagetable_dtor(page_ptdesc(page));
>  	free_hotplug_page_range(page, PAGE_SIZE, NULL);
>  }

[Severity: High]
Does this cause the buddy allocator to reject the physical page and leak the
NR_PAGETABLE statistic during memory hot-remove?

By dropping the destructor call here, the PG_pgtable flag is no longer
cleared. Since free_hotplug_page_range() eventually calls __free_pages()
directly rather than using pagetable_free(), the required cleanup is entirely
skipped.

If the buddy allocator later reallocates this page, check_new_page_bad()
will detect the leftover PG_pgtable flag, trigger a bad_page() warning,
and permanently leak the page.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260714-remove_pgtable_cdtor-v1-0-44be8a7685d7@arm.com?part=20