Re: [PATCH] x86/mm: Tear down the direct map when memory hot add fails

[Lance Yang <lance.yang@linux.dev>]

On 2026/11/9 17:34, David Hildenbrand (Arm) wrote:
> On 11/8/26 04:00, Chris Down wrote:
>> arch_add_memory() sets up the direct map before calling add_pages().
>> If add_pages() fails, the range stays mapped and any page tables
>> allocated for it are leaked. A later hot add can reuse the stale
>> mapping.
>>
>> Remove the direct mapping on failure.
>>
>> Fixes: 45e0b78b0532 ("[PATCH] hot-add-mem x86_64: use CONFIG_MEMORY_HOTPLUG_RESERVE")
>> Signed-off-by: Chris Down <chris@chrisdown.name>
>> ---
>>   arch/x86/mm/init_64.c | 10 +++++++++-
>>   1 file changed, 9 insertions(+), 1 deletion(-)
>>
>> diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
>> index 8b6d86fb5a42..846cb34b38dd 100644
>> --- a/arch/x86/mm/init_64.c
>> +++ b/arch/x86/mm/init_64.c
>> @@ -989,15 +989,23 @@ int add_pages(int nid, unsigned long start_pfn, unsigned long nr_pages,
>>   	return ret;
>>   }
>>   
>> +static void __meminit kernel_physical_mapping_remove(unsigned long start,
>> +						     unsigned long end);
>> +
>>   int arch_add_memory(int nid, u64 start, u64 size,
>>   		    struct mhp_params *params)
>>   {
>>   	unsigned long start_pfn = start >> PAGE_SHIFT;
>>   	unsigned long nr_pages = size >> PAGE_SHIFT;
>> +	int ret;
>>   
>>   	init_memory_mapping(start, start + size, params->pgprot);
>>   
>> -	return add_pages(nid, start_pfn, nr_pages, params);
>> +	ret = add_pages(nid, start_pfn, nr_pages, params);
>> +	if (ret)
>> +		kernel_physical_mapping_remove(start, start + size);
>> +
>> +	return ret;
>>   }
>>   
>>   static void __meminit free_pagetable(struct page *page)
>>
>> base-commit: fa4ad798f6f681031775266044ba1b0cf3c670bd
> 
> I thought we fixed that already, but I remembered
> 
> https://lore.kernel.org/all/20260930160432.5564-1-lance.yang@linux.dev/

Ouch ... I missed the direct map cleanup in that fix ...

Reviewed-by: Lance Yang <lance.yang@linux.dev>