[PATCH] mm/cma: fix reserved page leak on activation failure

[PATCH] mm/cma: fix reserved page leak on activation failure

[Muchun Song]

If cma_activate_area() fails after allocating only part of the range
bitmaps, its cleanup path frees the bitmaps for the ranges below
allocrange and then releases reserved pages using the same bound.

That bound is only correct for bitmap freeing. Pages in ranges that did
not reach bitmap allocation are still reserved and should also be
returned to the buddy when CMA_RESERVE_PAGES_ON_ERROR is clear. As a
result, a partial bitmap allocation failure can permanently leak the
reserved pages from the failed range and all later ranges.

Fix this by releasing reserved pages for all ranges. For ranges whose
bitmap allocation succeeded, use the early_pfn[] snapshot saved before
the bitmap pointer overwrote the union field. For later ranges, continue
to use cmr->early_pfn directly.

Fixes: c009da4258f9 ("mm, cma: support multiple contiguous ranges, if requested")
Cc: stable@vger.kernel.org
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
---
 mm/cma.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/mm/cma.c b/mm/cma.c
index c7ca567f4c5c..a30075507d41 100644
--- a/mm/cma.c
+++ b/mm/cma.c
@@ -188,10 +188,13 @@ static void __init cma_activate_area(struct cma *cma)
 
 	/* Expose all pages to the buddy, they are useless for CMA. */
 	if (!test_bit(CMA_RESERVE_PAGES_ON_ERROR, &cma->flags)) {
-		for (r = 0; r < allocrange; r++) {
+		for (r = 0; r < cma->nranges; r++) {
+			unsigned long start_pfn;
+
 			cmr = &cma->ranges[r];
+			start_pfn = r < allocrange ? early_pfn[r] : cmr->early_pfn;
 			end_pfn = cmr->base_pfn + cmr->count;
-			for (pfn = early_pfn[r]; pfn < end_pfn; pfn++)
+			for (pfn = start_pfn; pfn < end_pfn; pfn++)
 				free_reserved_page(pfn_to_page(pfn));
 		}
 	}

base-commit: e98d21c170b01ddef366f023bbfcf6b31509fa83
-- 
2.54.0

Re: [PATCH] mm/cma: fix reserved page leak on activation failure

[Oscar Salvador (SUSE)]

On Fri, May 22, 2026 at 02:26:58PM +0800, Muchun Song wrote:
> If cma_activate_area() fails after allocating only part of the range
> bitmaps, its cleanup path frees the bitmaps for the ranges below
> allocrange and then releases reserved pages using the same bound.
> 
> That bound is only correct for bitmap freeing. Pages in ranges that did
> not reach bitmap allocation are still reserved and should also be
> returned to the buddy when CMA_RESERVE_PAGES_ON_ERROR is clear. As a
> result, a partial bitmap allocation failure can permanently leak the
> reserved pages from the failed range and all later ranges.
> 
> Fix this by releasing reserved pages for all ranges. For ranges whose
> bitmap allocation succeeded, use the early_pfn[] snapshot saved before
> the bitmap pointer overwrote the union field. For later ranges, continue
> to use cmr->early_pfn directly.
> 
> Fixes: c009da4258f9 ("mm, cma: support multiple contiguous ranges, if requested")
> Cc: stable@vger.kernel.org
> Signed-off-by: Muchun Song <songmuchun@bytedance.com>

Reviewed-by: Oscar Salvador (SUSE) <osalvador@kernel.org>


-- 
Oscar Salvador
SUSE Labs

Re: [PATCH] mm/cma: fix reserved page leak on activation failure

[Usama Arif]

On Fri, 22 May 2026 14:26:58 +0800 Muchun Song <songmuchun@bytedance.com> wrote:

> If cma_activate_area() fails after allocating only part of the range
> bitmaps, its cleanup path frees the bitmaps for the ranges below
> allocrange and then releases reserved pages using the same bound.
> 
> That bound is only correct for bitmap freeing. Pages in ranges that did
> not reach bitmap allocation are still reserved and should also be
> returned to the buddy when CMA_RESERVE_PAGES_ON_ERROR is clear. As a
> result, a partial bitmap allocation failure can permanently leak the
> reserved pages from the failed range and all later ranges.
> 
> Fix this by releasing reserved pages for all ranges. For ranges whose
> bitmap allocation succeeded, use the early_pfn[] snapshot saved before
> the bitmap pointer overwrote the union field. For later ranges, continue
> to use cmr->early_pfn directly.
> 
> Fixes: c009da4258f9 ("mm, cma: support multiple contiguous ranges, if requested")
> Cc: stable@vger.kernel.org
> Signed-off-by: Muchun Song <songmuchun@bytedance.com>
> ---
>  mm/cma.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/mm/cma.c b/mm/cma.c
> index c7ca567f4c5c..a30075507d41 100644
> --- a/mm/cma.c
> +++ b/mm/cma.c
> @@ -188,10 +188,13 @@ static void __init cma_activate_area(struct cma *cma)
>  
>  	/* Expose all pages to the buddy, they are useless for CMA. */
>  	if (!test_bit(CMA_RESERVE_PAGES_ON_ERROR, &cma->flags)) {
> -		for (r = 0; r < allocrange; r++) {
> +		for (r = 0; r < cma->nranges; r++) {
> +			unsigned long start_pfn;
> +
>  			cmr = &cma->ranges[r];
> +			start_pfn = r < allocrange ? early_pfn[r] : cmr->early_pfn;

Should this be r <= allocrange?


For the failing range, the loop above did:

		early_pfn[allocrange] = cmr->early_pfn;
		cmr->bitmap = bitmap_zalloc(cma_bitmap_maxno(cma, cmr),
					    GFP_KERNEL);
		if (!cmr->bitmap)
			goto cleanup;


Since cmr->bitmap and cmr->early_pfn share a union, that NULL store
clobbers cmr->early_pfn to 0 for index allocrange.  With r < allocrange
the failing range reads cmr->early_pfn (now 0) and free_reserved_page()
gets called starting from pfn 0

>  			end_pfn = cmr->base_pfn + cmr->count;
> -			for (pfn = early_pfn[r]; pfn < end_pfn; pfn++)
> +			for (pfn = start_pfn; pfn < end_pfn; pfn++)
>  				free_reserved_page(pfn_to_page(pfn));
>  		}
>  	}
> 
> base-commit: e98d21c170b01ddef366f023bbfcf6b31509fa83
> -- 
> 2.54.0
> 
> 

Re: [PATCH] mm/cma: fix reserved page leak on activation failure

[Oscar Salvador (SUSE)]

On Tue, May 26, 2026 at 04:30:03AM -0700, Usama Arif wrote:
> On Fri, 22 May 2026 14:26:58 +0800 Muchun Song <songmuchun@bytedance.com> wrote:
...
> > diff --git a/mm/cma.c b/mm/cma.c
> > index c7ca567f4c5c..a30075507d41 100644
> > --- a/mm/cma.c
> > +++ b/mm/cma.c
> > @@ -188,10 +188,13 @@ static void __init cma_activate_area(struct cma *cma)
> >  
> >  	/* Expose all pages to the buddy, they are useless for CMA. */
> >  	if (!test_bit(CMA_RESERVE_PAGES_ON_ERROR, &cma->flags)) {
> > -		for (r = 0; r < allocrange; r++) {
> > +		for (r = 0; r < cma->nranges; r++) {
> > +			unsigned long start_pfn;
> > +
> >  			cmr = &cma->ranges[r];
> > +			start_pfn = r < allocrange ? early_pfn[r] : cmr->early_pfn;
> 
> Should this be r <= allocrange?

Yes, I think you are right. I missed that.

early_pfn[alloc_range] holds the last assignment, so we should start
from the next one reading cmr->early_pfn.

 

-- 
Oscar Salvador
SUSE Labs

Re: [PATCH] mm/cma: fix reserved page leak on activation failure

[Muchun Song]

> On May 26, 2026, at 19:51, Oscar Salvador (SUSE) <osalvador@kernel.org> wrote:
> 
> On Tue, May 26, 2026 at 04:30:03AM -0700, Usama Arif wrote:
>> On Fri, 22 May 2026 14:26:58 +0800 Muchun Song <songmuchun@bytedance.com> wrote:
> ...
>>> diff --git a/mm/cma.c b/mm/cma.c
>>> index c7ca567f4c5c..a30075507d41 100644
>>> --- a/mm/cma.c
>>> +++ b/mm/cma.c
>>> @@ -188,10 +188,13 @@ static void __init cma_activate_area(struct cma *cma)
>>> 
>>>    /* Expose all pages to the buddy, they are useless for CMA. */
>>>    if (!test_bit(CMA_RESERVE_PAGES_ON_ERROR, &cma->flags)) {
>>> -        for (r = 0; r < allocrange; r++) {
>>> +        for (r = 0; r < cma->nranges; r++) {
>>> +            unsigned long start_pfn;
>>> +
>>>            cmr = &cma->ranges[r];
>>> +            start_pfn = r < allocrange ? early_pfn[r] : cmr->early_pfn;
>> 
>> Should this be r <= allocrange?

Yes. So I sent a v2 to fix it last Saturday.

https://lore.kernel.org/linux-mm/20260523060123.2207992-1-songmuchun@bytedance.com/

Thanks.

> 
> Yes, I think you are right. I missed that.
> 
> early_pfn[alloc_range] holds the last assignment, so we should start
> from the next one reading cmr->early_pfn.
> 
> 
> 
> --
> Oscar Salvador
> SUSE Labs

Re: [PATCH] mm/cma: fix reserved page leak on activation failure

[Usama Arif]

On 26/05/2026 13:44, Muchun Song wrote:
> 
> 
>> On May 26, 2026, at 19:51, Oscar Salvador (SUSE) <osalvador@kernel.org> wrote:
>>
>> On Tue, May 26, 2026 at 04:30:03AM -0700, Usama Arif wrote:
>>> On Fri, 22 May 2026 14:26:58 +0800 Muchun Song <songmuchun@bytedance.com> wrote:
>> ...
>>>> diff --git a/mm/cma.c b/mm/cma.c
>>>> index c7ca567f4c5c..a30075507d41 100644
>>>> --- a/mm/cma.c
>>>> +++ b/mm/cma.c
>>>> @@ -188,10 +188,13 @@ static void __init cma_activate_area(struct cma *cma)
>>>>
>>>>    /* Expose all pages to the buddy, they are useless for CMA. */
>>>>    if (!test_bit(CMA_RESERVE_PAGES_ON_ERROR, &cma->flags)) {
>>>> -        for (r = 0; r < allocrange; r++) {
>>>> +        for (r = 0; r < cma->nranges; r++) {
>>>> +            unsigned long start_pfn;
>>>> +
>>>>            cmr = &cma->ranges[r];
>>>> +            start_pfn = r < allocrange ? early_pfn[r] : cmr->early_pfn;
>>>
>>> Should this be r <= allocrange?
> 
> Yes. So I sent a v2 to fix it last Saturday.
> 
> https://lore.kernel.org/linux-mm/20260523060123.2207992-1-songmuchun@bytedance.com/
> 
> Thanks.

Ah still catching up on the mailing list. Thanks!

> 
>>
>> Yes, I think you are right. I missed that.
>>
>> early_pfn[alloc_range] holds the last assignment, so we should start
>> from the next one reading cmr->early_pfn.
>>
>>
>>
>> --
>> Oscar Salvador
>> SUSE Labs