[PATCH] arm64: mm: Fix pfn_is_map_memory() misreporting mapped memory

[PATCH] arm64: mm: Fix pfn_is_map_memory() misreporting mapped memory

[Vladimir Murzin]

Commit 7ace06a01efa ("arm64: mm: fix accidental linear mapping of
no-map reserved memory") removed sub-page no-map regions from the
linear mapping. However, pfn_is_map_memory() can still report that
such a region is mapped.

For instance, with 64K pages, say we have

normal:        ...–0xa2007fff
no-map: 0xa2008000–0xa200ffff
normal: 0xa2010000–...

The range 0xa2000000–0xa200ffff is not linearly mapped, but
pfn_is_map_memory(__phys_to_pfn(0xa2008000)) aligns the address to
page granularity and passes 0xa2000000 to memblock_is_map_memory().
That address belongs to the preceding normal memblock region, so the
no-map region is ignored and the function returns true.

Fix that by checking if entire page is subset of memory block.

Fixes: 7ace06a01efa ("arm64: mm: fix accidental linear mapping of no-map reserved memory")
Assisted-by: LLM
Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
---
 arch/arm64/mm/init.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
index fbf215ecc7d0..5da80e1e1727 100644
--- a/arch/arm64/mm/init.c
+++ b/arch/arm64/mm/init.c
@@ -172,7 +172,8 @@ int pfn_is_map_memory(unsigned long pfn)
 	if (PHYS_PFN(addr) != pfn)
 		return 0;
 
-	return memblock_is_map_memory(addr);
+	return memblock_is_region_memory(addr, PAGE_SIZE) &&
+		memblock_is_map_memory(addr);
 }
 EXPORT_SYMBOL(pfn_is_map_memory);
 
-- 
2.34.1

Re: [PATCH] arm64: mm: Fix pfn_is_map_memory() misreporting mapped memory

[Will Deacon]

On Tue, Sep 08, 2026 at 05:20:33PM +0100, Vladimir Murzin wrote:
> Commit 7ace06a01efa ("arm64: mm: fix accidental linear mapping of
> no-map reserved memory") removed sub-page no-map regions from the
> linear mapping. However, pfn_is_map_memory() can still report that
> such a region is mapped.
> 
> For instance, with 64K pages, say we have
> 
> normal:        ...–0xa2007fff
> no-map: 0xa2008000–0xa200ffff
> normal: 0xa2010000–...
> 
> The range 0xa2000000–0xa200ffff is not linearly mapped, but
> pfn_is_map_memory(__phys_to_pfn(0xa2008000)) aligns the address to
> page granularity and passes 0xa2000000 to memblock_is_map_memory().
> That address belongs to the preceding normal memblock region, so the
> no-map region is ignored and the function returns true.
> 
> Fix that by checking if entire page is subset of memory block.
> 
> Fixes: 7ace06a01efa ("arm64: mm: fix accidental linear mapping of no-map reserved memory")
> Assisted-by: LLM
> Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
> ---
>  arch/arm64/mm/init.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
> index fbf215ecc7d0..5da80e1e1727 100644
> --- a/arch/arm64/mm/init.c
> +++ b/arch/arm64/mm/init.c
> @@ -172,7 +172,8 @@ int pfn_is_map_memory(unsigned long pfn)
>  	if (PHYS_PFN(addr) != pfn)
>  		return 0;
>  
> -	return memblock_is_map_memory(addr);
> +	return memblock_is_region_memory(addr, PAGE_SIZE) &&
> +		memblock_is_map_memory(addr);
>  }

Yuck, this is really grotty :(

Can we at least predicate the extra memblock_is_region_memory() check on
having a page-size > 4k?

Will

Re: [PATCH] arm64: mm: Fix pfn_is_map_memory() misreporting mapped memory

[Vladimir Murzin]

On 9/9/26 14:31, Will Deacon wrote:
> On Tue, Sep 08, 2026 at 05:20:33PM +0100, Vladimir Murzin wrote:
>> Commit 7ace06a01efa ("arm64: mm: fix accidental linear mapping of
>> no-map reserved memory") removed sub-page no-map regions from the
>> linear mapping. However, pfn_is_map_memory() can still report that
>> such a region is mapped.
>>
>> For instance, with 64K pages, say we have
>>
>> normal:        ...–0xa2007fff
>> no-map: 0xa2008000–0xa200ffff
>> normal: 0xa2010000–...
>>
>> The range 0xa2000000–0xa200ffff is not linearly mapped, but
>> pfn_is_map_memory(__phys_to_pfn(0xa2008000)) aligns the address to
>> page granularity and passes 0xa2000000 to memblock_is_map_memory().
>> That address belongs to the preceding normal memblock region, so the
>> no-map region is ignored and the function returns true.
>>
>> Fix that by checking if entire page is subset of memory block.
>>
>> Fixes: 7ace06a01efa ("arm64: mm: fix accidental linear mapping of no-map reserved memory")
>> Assisted-by: LLM
>> Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
>> ---
>>  arch/arm64/mm/init.c | 3 ++-
>>  1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
>> index fbf215ecc7d0..5da80e1e1727 100644
>> --- a/arch/arm64/mm/init.c
>> +++ b/arch/arm64/mm/init.c
>> @@ -172,7 +172,8 @@ int pfn_is_map_memory(unsigned long pfn)
>>  	if (PHYS_PFN(addr) != pfn)
>>  		return 0;
>>  
>> -	return memblock_is_map_memory(addr);
>> +	return memblock_is_region_memory(addr, PAGE_SIZE) &&
>> +		memblock_is_map_memory(addr);
>>  }
> Yuck, this is really grotty :(
> 
> Can we at least predicate the extra memblock_is_region_memory() check on
> having a page-size > 4k?
> 

The same can happen with 4K page size and subpage no-map and I have not seen
anything prohibiting subpage no-map ...

Cheers
Vladimir

> Will
> 

Re: [PATCH] arm64: mm: Fix pfn_is_map_memory() misreporting mapped memory

[Will Deacon]

On Thu, Sep 10, 2026 at 02:57:25PM +0100, Vladimir Murzin wrote:
> On 9/9/26 14:31, Will Deacon wrote:
> > On Tue, Sep 08, 2026 at 05:20:33PM +0100, Vladimir Murzin wrote:
> >> Commit 7ace06a01efa ("arm64: mm: fix accidental linear mapping of
> >> no-map reserved memory") removed sub-page no-map regions from the
> >> linear mapping. However, pfn_is_map_memory() can still report that
> >> such a region is mapped.
> >>
> >> For instance, with 64K pages, say we have
> >>
> >> normal:        ...–0xa2007fff
> >> no-map: 0xa2008000–0xa200ffff
> >> normal: 0xa2010000–...
> >>
> >> The range 0xa2000000–0xa200ffff is not linearly mapped, but
> >> pfn_is_map_memory(__phys_to_pfn(0xa2008000)) aligns the address to
> >> page granularity and passes 0xa2000000 to memblock_is_map_memory().
> >> That address belongs to the preceding normal memblock region, so the
> >> no-map region is ignored and the function returns true.
> >>
> >> Fix that by checking if entire page is subset of memory block.
> >>
> >> Fixes: 7ace06a01efa ("arm64: mm: fix accidental linear mapping of no-map reserved memory")
> >> Assisted-by: LLM
> >> Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
> >> ---
> >>  arch/arm64/mm/init.c | 3 ++-
> >>  1 file changed, 2 insertions(+), 1 deletion(-)
> >>
> >> diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
> >> index fbf215ecc7d0..5da80e1e1727 100644
> >> --- a/arch/arm64/mm/init.c
> >> +++ b/arch/arm64/mm/init.c
> >> @@ -172,7 +172,8 @@ int pfn_is_map_memory(unsigned long pfn)
> >>  	if (PHYS_PFN(addr) != pfn)
> >>  		return 0;
> >>  
> >> -	return memblock_is_map_memory(addr);
> >> +	return memblock_is_region_memory(addr, PAGE_SIZE) &&
> >> +		memblock_is_map_memory(addr);
> >>  }
> > Yuck, this is really grotty :(
> > 
> > Can we at least predicate the extra memblock_is_region_memory() check on
> > having a page-size > 4k?
> > 
> 
> The same can happen with 4K page size and subpage no-map and I have not seen
> anything prohibiting subpage no-map ...

Ah yes, I made a similar observation during the review of the offending
commit. Oh well. Let's see what others think before we merge this.

Will