[PATCH v2] drivers/base/memory: set mem->altmap after successful device registration

[PATCH v2] drivers/base/memory: set mem->altmap after successful device registration

[Georgi Djakov]

If __add_memory_block() fails at xa_store() (under memory pressure
for example), device_unregister() is called, which eventually
triggers memory_block_release() with mem->altmap still set, causing
a WARN_ON(mem->altmap). This was triggered by modifying virtio-mem
driver.

Fix this by delaying the assignment of mem->altmap until after
__add_memory_block() has succeeded.

Fixes: 1a8c64e11043 ("mm/memory_hotplug: embed vmem_altmap details in memory block")
Signed-off-by: Georgi Djakov <georgi.djakov@oss.qualcomm.com>
---

v1: https://patch.msgid.link/20260513130900.2204499-1-georgi.djakov@oss.qualcomm.com

 drivers/base/memory.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index 11d57cfa8d72..78e9600e6d45 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -807,7 +807,6 @@ static int add_memory_block(unsigned long block_id, int nid, unsigned long state
 	mem->start_section_nr = block_id * sections_per_block;
 	mem->state = state;
 	mem->nid = nid;
-	mem->altmap = altmap;
 	INIT_LIST_HEAD(&mem->group_next);
 
 #ifndef CONFIG_NUMA
@@ -825,6 +824,8 @@ static int add_memory_block(unsigned long block_id, int nid, unsigned long state
 	if (ret)
 		return ret;
 
+	mem->altmap = altmap;
+
 	if (group) {
 		mem->group = group;
 		list_add(&mem->group_next, &group->memory_blocks);

Re: [PATCH v2] drivers/base/memory: set mem->altmap after successful device registration

[Richard Cheng]

On Thu, May 14, 2026 at 02:26:57AM +0800, Georgi Djakov wrote:
> If __add_memory_block() fails at xa_store() (under memory pressure
> for example), device_unregister() is called, which eventually
> triggers memory_block_release() with mem->altmap still set, causing
> a WARN_ON(mem->altmap). This was triggered by modifying virtio-mem
> driver.
>

I see you mentioned about some out of tree virtio_mem patches that
can trigger the bug, mind to paste the tree link here ?
Just curious.

Best regards,
Richard Cheng.
 
> Fix this by delaying the assignment of mem->altmap until after
> __add_memory_block() has succeeded.
> 
> Fixes: 1a8c64e11043 ("mm/memory_hotplug: embed vmem_altmap details in memory block")
> Signed-off-by: Georgi Djakov <georgi.djakov@oss.qualcomm.com>
> ---
> 
> v1: https://patch.msgid.link/20260513130900.2204499-1-georgi.djakov@oss.qualcomm.com
> 
>  drivers/base/memory.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/base/memory.c b/drivers/base/memory.c
> index 11d57cfa8d72..78e9600e6d45 100644
> --- a/drivers/base/memory.c
> +++ b/drivers/base/memory.c
> @@ -807,7 +807,6 @@ static int add_memory_block(unsigned long block_id, int nid, unsigned long state
>  	mem->start_section_nr = block_id * sections_per_block;
>  	mem->state = state;
>  	mem->nid = nid;
> -	mem->altmap = altmap;
>  	INIT_LIST_HEAD(&mem->group_next);
>  
>  #ifndef CONFIG_NUMA
> @@ -825,6 +824,8 @@ static int add_memory_block(unsigned long block_id, int nid, unsigned long state
>  	if (ret)
>  		return ret;
>  
> +	mem->altmap = altmap;
> +
>  	if (group) {
>  		mem->group = group;
>  		list_add(&mem->group_next, &group->memory_blocks);
> 

Re: [PATCH v2] drivers/base/memory: set mem->altmap after successful device registration

[Oscar Salvador (SUSE)]

On Thu, May 14, 2026 at 02:26:57AM -0700, Georgi Djakov wrote:
> If __add_memory_block() fails at xa_store() (under memory pressure
> for example), device_unregister() is called, which eventually
> triggers memory_block_release() with mem->altmap still set, causing
> a WARN_ON(mem->altmap). This was triggered by modifying virtio-mem
> driver.
> 
> Fix this by delaying the assignment of mem->altmap until after
> __add_memory_block() has succeeded.
> 
> Fixes: 1a8c64e11043 ("mm/memory_hotplug: embed vmem_altmap details in memory block")
> Signed-off-by: Georgi Djakov <georgi.djakov@oss.qualcomm.com>

Acked-by: Oscar Salvador (SUSE) <osalvador@kernel.org>



-- 
Oscar Salvador
SUSE Labs

Re: [PATCH v2] drivers/base/memory: set mem->altmap after successful device registration

[Andrew Morton]

On Thu, 14 May 2026 02:26:57 -0700 Georgi Djakov <georgi.djakov@oss.qualcomm.com> wrote:

> If __add_memory_block() fails at xa_store() (under memory pressure
> for example), device_unregister() is called, which eventually
> triggers memory_block_release() with mem->altmap still set, causing
> a WARN_ON(mem->altmap).

That isn't good.

> This was triggered by modifying virtio-mem
> driver.
> 
> Fix this by delaying the assignment of mem->altmap until after
> __add_memory_block() has succeeded.
> 
> Fixes: 1a8c64e11043 ("mm/memory_hotplug: embed vmem_altmap details in memory block")

Patch is nice and simple so I'll add a cc:stable to this, even though
the issue seems rather minor.

btw, AI review had no issue with your change but might have found a bug
in create_altmaps_and_memory_blocks():

	https://sashiko.dev/#/patchset/20260514092657.3057141-1-georgi.djakov@oss.qualcomm.com

Re: [PATCH v2] drivers/base/memory: set mem->altmap after successful device registration

[Georgi Djakov]

On 5/19/26 11:25 PM, Andrew Morton wrote:
> On Thu, 14 May 2026 02:26:57 -0700 Georgi Djakov <georgi.djakov@oss.qualcomm.com> wrote:
> 
>> If __add_memory_block() fails at xa_store() (under memory pressure
>> for example), device_unregister() is called, which eventually
>> triggers memory_block_release() with mem->altmap still set, causing
>> a WARN_ON(mem->altmap).
> 
> That isn't good.
> 
>> This was triggered by modifying virtio-mem
>> driver.
>>
>> Fix this by delaying the assignment of mem->altmap until after
>> __add_memory_block() has succeeded.
>>
>> Fixes: 1a8c64e11043 ("mm/memory_hotplug: embed vmem_altmap details in memory block")
> 
> Patch is nice and simple so I'll add a cc:stable to this, even though
> the issue seems rather minor.
> 
> btw, AI review had no issue with your change but might have found a bug
> in create_altmaps_and_memory_blocks():
> 
> 	https://sashiko.dev/#/patchset/20260514092657.3057141-1-georgi.djakov@oss.qualcomm.com

Yes, i have hit exactly this bug actually (shortly after this WARN_ON, we crash)
and was going to send a fix, but noticed that someone already did:
https://lore.kernel.org/lkml/20260428081855.1249045-3-songmuchun@bytedance.com/

I can respond with my RB on that one if you haven't applied it yet.

BR,
Georgi

Re: [PATCH v2] drivers/base/memory: set mem->altmap after successful device registration

[Andrew Morton]

On Tue, 19 May 2026 23:57:52 +0300 Georgi Djakov <djakov@kernel.org> wrote:

> On 5/19/26 11:25 PM, Andrew Morton wrote:
> > On Thu, 14 May 2026 02:26:57 -0700 Georgi Djakov <georgi.djakov@oss.qualcomm.com> wrote:
> > 
> >> If __add_memory_block() fails at xa_store() (under memory pressure
> >> for example), device_unregister() is called, which eventually
> >> triggers memory_block_release() with mem->altmap still set, causing
> >> a WARN_ON(mem->altmap).
> > 
> > That isn't good.
> > 
> >> This was triggered by modifying virtio-mem
> >> driver.
> >>
> >> Fix this by delaying the assignment of mem->altmap until after
> >> __add_memory_block() has succeeded.
> >>
> >> Fixes: 1a8c64e11043 ("mm/memory_hotplug: embed vmem_altmap details in memory block")
> > 
> > Patch is nice and simple so I'll add a cc:stable to this, even though
> > the issue seems rather minor.
> > 
> > btw, AI review had no issue with your change but might have found a bug
> > in create_altmaps_and_memory_blocks():
> > 
> > 	https://sashiko.dev/#/patchset/20260514092657.3057141-1-georgi.djakov@oss.qualcomm.com
> 
> Yes, i have hit exactly this bug actually (shortly after this WARN_ON, we crash)
> and was going to send a fix, but noticed that someone already did:
> https://lore.kernel.org/lkml/20260428081855.1249045-3-songmuchun@bytedance.com/
> 
> I can respond with my RB on that one if you haven't applied it yet.

I have indeed applied it, but a R-b isn't a problem and would be
welcomed.  One of the many reasons why I retain patches in quilt form
for a few weeks before gitifying them.