Re: [PATCH 1/2] mm/memory_hotplug: fix memory block reference leak on remove

Muchun Song
2026-04-27T08:03:24Z

> On Apr 27, 2026, at 15:49, Oscar Salvador <osalvador@suse.de> wrote:
>
> On Sun, Apr 26, 2026 at 10:44:46PM +0800, Muchun Song wrote:
>> remove_memory_blocks_and_altmaps() looks up each memory block with
>> find_memory_block(), which acquires a reference to the memory block
>> device.
>>
>> That reference is never dropped on this path, resulting in a leaked
>> device reference when removing memory blocks and their altmaps. Drop
>> the reference after retrieving mem->altmap and clearing mem->altmap,
>> before removing the memory block device.
>>
>> Fixes: 6b8f0798b85a ("mm/memory_hotplug: split memmap_on_memory requests across memblocks")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Muchun Song <songmuchun@bytedance.com>
>
> The change looks good but some comments below:
>
> Acked-by: Oscar Salvador <osalvador@suse.de>

Thanks.

>
> The outcome of leaking the reference is that the final call to put_device()
> in device_unregister() leaves the memory block device linked in the
> system under /sys/ ? (besides not deleting the struct I guess)

I think so.

>
>> ---
>> mm/memory_hotplug.c | 1 +
>> 1 file changed, 1 insertion(+)
>>
>> diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
>> index 2a943ec57c85..4426abb05655 100644
>> --- a/mm/memory_hotplug.c
>> +++ b/mm/memory_hotplug.c
>> @@ -1422,6 +1422,7 @@ static void remove_memory_blocks_and_altmaps(u64 start, u64 size)
>>
>> altmap = mem->altmap;
>> mem->altmap = NULL;
>> + put_device(&mem->dev);
>
> 1) Six months from now we might not remember why we need to call
> put_device() here.
>
> I would put a comment like remove_memory_block has:
>
> "/* drop the ref. we got via find_memory_block() */" or something like
> that.

Make sense.

>
> 2) I kind of dislike having an internal put_device() lingering here in
> memory-hotplug code, it feels like it does not really belong here.
> Ideally we should have a high-level function in drivers/base/memory.c
> that calls put_device itself.
> Something like "put_memblock_dev", dunno, names are hard.
>

I share your perspective. The current naming of find_memory_block_by_id
is ambiguous as it fails to signal the internal 'get' operation. To improve
clarity and reduce errors, it should be renamed to memory_block_get_by_id.
Pairing this with a new memory_block_put function to wrap put_device
would ensure a more robust and intuitive API.

Thanks.

>
> --
> Oscar Salvador
> SUSE Labs