Re: [PATCH 6.18.y 2/2] kho: free phys_bits bitmaps using free_page() in __kho_abort()

[Mike Rapoport <rppt@kernel.org>]

On Thu, Oct 15, 2026 at 02:45:29PM +0000, Federico Parola wrote:
> Commit fa759cd75bce ("kho: allocate metadata directly from the buddy
> allocator") switched the allocation of preserved memory bitmaps to
> get_zeroed_page(), but __kho_abort() still releases them with kfree().
> kfree() on a buddy page that is not a large kmalloc allocation hits the
> WARN_ON_ONCE() in free_large_kmalloc() and returns without freeing it,
> so every aborted finalization leaks all bitmap pages.
> 
> Free the bitmaps with free_page() instead.
> 
> This is a stable-only patch. Upstream fixed it as a side effect of
> commit 99cd2ffac697 ("kho: don't unpreserve memory during abort"), which
> removes the tracking teardown from __kho_abort() altogether. That change
> builds on commit 36f8f7ef7fd2 ("kho: add interfaces to unpreserve
> folios, page ranges, and vmalloc") and commit 70f9133096c8 ("kho: drop
> notifiers"). In 6.18.y, KHO users still preserve memory from the
> KEXEC_KHO_FINALIZE notifier and have no interface to unpreserve it, so
> the teardown on abort is the only way their preservations get dropped.
> Backporting that commit would make preservations outlive every abort,
> so keep the teardown and fix only the mismatched free.
> 
> Fixes: fa759cd75bce ("kho: allocate metadata directly from the buddy allocator")
> Signed-off-by: Federico Parola <fparola@amazon.de>

Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>

> ---
>  kernel/kexec_handover.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/kexec_handover.c b/kernel/kexec_handover.c
> index 9fe5d14f1ec54..9691f6bc2fba7 100644
> --- a/kernel/kexec_handover.c
> +++ b/kernel/kexec_handover.c
> @@ -1054,7 +1054,7 @@ static int __kho_abort(void)
>  		unsigned long phys;
>  
>  		xa_for_each(&physxa->phys_bits, phys, bits)
> -			kfree(bits);
> +			free_page((unsigned long)bits);
>  
>  		xa_destroy(&physxa->phys_bits);
>  		kfree(physxa);
> -- 
> 2.47.3
> 

-- 
Sincerely yours,
Mike.