[PATCH 6.18.y 0/2] kho: free buddy-allocated metadata with free_page()

[PATCH 6.18.y 0/2] kho: free buddy-allocated metadata with free_page()

[Federico Parola]

Commit fa759cd75bce ("kho: allocate metadata directly from the buddy
allocator"), merged in 6.18, moved the KHO serialization chunks and the
preserved memory bitmaps from kzalloc() to get_zeroed_page(). Two places
still release them with kfree(): kho_mem_ser_free() for the chunks and
__kho_abort() for the bitmaps. kfree() on such a page hits the
WARN_ON_ONCE() in free_large_kmalloc() and returns without freeing it,
so each aborted or failed KHO finalization leaks the metadata pages.

Patch 1 is a clean backport of the upstream fix for the chunks.

Patch 2 fixes the bitmaps and has no upstream counterpart. Upstream
removed the tracking teardown from __kho_abort() in commit 99cd2ffac697
("kho: don't unpreserve memory during abort"), which relies on the
unpreserve interfaces and the notifier removal that came with 6.19. In
6.18.y, KHO users still preserve memory from the KEXEC_KHO_FINALIZE
notifier, and the teardown on abort is the only thing that drops those
preservations. I kept it and changed only the free; patch 2 has the
details.

Federico Parola (1):
  kho: free phys_bits bitmaps using free_page() in __kho_abort()

Pratyush Yadav (1):
  kho: free chunks using free_page() instead of kfree()

 kernel/kexec_handover.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

-- 
2.47.3

[PATCH 6.18.y 1/2] kho: free chunks using free_page() instead of kfree()

[Federico Parola]

From: Pratyush Yadav <pratyush@kernel.org>

[ Upstream commit b15515155af735a86e5bcd67ed739162f0de27f5 ]

Before commit fa759cd75bce5 ("kho: allocate metadata directly from the
buddy allocator"), the chunks were allocated from the slab allocator using
kzalloc().  Those were rightly freed using kfree().

When the commit switched to using the buddy allocator directly, it missed
updating kho_mem_ser_free() to use free_page() instead of kfree().

Link: https://lkml.kernel.org/r/20251118182218.63044-1-pratyush@kernel.org
Fixes: fa759cd75bce5 ("kho: allocate metadata directly from the buddy allocator")
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Alexander Graf <graf@amazon.com>
Cc: David Matlack <dmatlack@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Federico Parola <fparola@amazon.de>
---
 kernel/kexec_handover.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/kexec_handover.c b/kernel/kexec_handover.c
index ac9fa7727b5ff..9fe5d14f1ec54 100644
--- a/kernel/kexec_handover.c
+++ b/kernel/kexec_handover.c
@@ -365,7 +365,7 @@ static void kho_mem_ser_free(struct khoser_mem_chunk *first_chunk)
 		struct khoser_mem_chunk *tmp = chunk;
 
 		chunk = KHOSER_LOAD_PTR(chunk->hdr.next);
-		kfree(tmp);
+		free_page((unsigned long)tmp);
 	}
 }
 
-- 
2.47.3

[PATCH 6.18.y 2/2] kho: free phys_bits bitmaps using free_page() in __kho_abort()

[Federico Parola]

Commit fa759cd75bce ("kho: allocate metadata directly from the buddy
allocator") switched the allocation of preserved memory bitmaps to
get_zeroed_page(), but __kho_abort() still releases them with kfree().
kfree() on a buddy page that is not a large kmalloc allocation hits the
WARN_ON_ONCE() in free_large_kmalloc() and returns without freeing it,
so every aborted finalization leaks all bitmap pages.

Free the bitmaps with free_page() instead.

This is a stable-only patch. Upstream fixed it as a side effect of
commit 99cd2ffac697 ("kho: don't unpreserve memory during abort"), which
removes the tracking teardown from __kho_abort() altogether. That change
builds on commit 36f8f7ef7fd2 ("kho: add interfaces to unpreserve
folios, page ranges, and vmalloc") and commit 70f9133096c8 ("kho: drop
notifiers"). In 6.18.y, KHO users still preserve memory from the
KEXEC_KHO_FINALIZE notifier and have no interface to unpreserve it, so
the teardown on abort is the only way their preservations get dropped.
Backporting that commit would make preservations outlive every abort,
so keep the teardown and fix only the mismatched free.

Fixes: fa759cd75bce ("kho: allocate metadata directly from the buddy allocator")
Signed-off-by: Federico Parola <fparola@amazon.de>
---
 kernel/kexec_handover.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/kexec_handover.c b/kernel/kexec_handover.c
index 9fe5d14f1ec54..9691f6bc2fba7 100644
--- a/kernel/kexec_handover.c
+++ b/kernel/kexec_handover.c
@@ -1054,7 +1054,7 @@ static int __kho_abort(void)
 		unsigned long phys;
 
 		xa_for_each(&physxa->phys_bits, phys, bits)
-			kfree(bits);
+			free_page((unsigned long)bits);
 
 		xa_destroy(&physxa->phys_bits);
 		kfree(physxa);
-- 
2.47.3

Re: [PATCH 6.18.y 2/2] kho: free phys_bits bitmaps using free_page() in __kho_abort()

[Sasha Levin]

> This is a stable-only patch. Upstream fixed it as a side effect of
> commit 99cd2ffac697 ("kho: don't unpreserve memory during abort"), which
> removes the tracking teardown from __kho_abort() altogether. That change

Patch 1/2 is queued for 6.18. I'm holding this one until we have an Acked-by
or Reviewed-by from a KHO maintainer (Pratyush, Mike or Pasha). It is a
stable-only fix with no upstream equivalent, so I'd like one of you to look at
it first.

-- 
Thanks,
Sasha

Re: [PATCH 6.18.y 2/2] kho: free phys_bits bitmaps using free_page() in __kho_abort()

[Mike Rapoport]

On Thu, Oct 15, 2026 at 02:45:29PM +0000, Federico Parola wrote:
> Commit fa759cd75bce ("kho: allocate metadata directly from the buddy
> allocator") switched the allocation of preserved memory bitmaps to
> get_zeroed_page(), but __kho_abort() still releases them with kfree().
> kfree() on a buddy page that is not a large kmalloc allocation hits the
> WARN_ON_ONCE() in free_large_kmalloc() and returns without freeing it,
> so every aborted finalization leaks all bitmap pages.
> 
> Free the bitmaps with free_page() instead.
> 
> This is a stable-only patch. Upstream fixed it as a side effect of
> commit 99cd2ffac697 ("kho: don't unpreserve memory during abort"), which
> removes the tracking teardown from __kho_abort() altogether. That change
> builds on commit 36f8f7ef7fd2 ("kho: add interfaces to unpreserve
> folios, page ranges, and vmalloc") and commit 70f9133096c8 ("kho: drop
> notifiers"). In 6.18.y, KHO users still preserve memory from the
> KEXEC_KHO_FINALIZE notifier and have no interface to unpreserve it, so
> the teardown on abort is the only way their preservations get dropped.
> Backporting that commit would make preservations outlive every abort,
> so keep the teardown and fix only the mismatched free.
> 
> Fixes: fa759cd75bce ("kho: allocate metadata directly from the buddy allocator")
> Signed-off-by: Federico Parola <fparola@amazon.de>

Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>

> ---
>  kernel/kexec_handover.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/kexec_handover.c b/kernel/kexec_handover.c
> index 9fe5d14f1ec54..9691f6bc2fba7 100644
> --- a/kernel/kexec_handover.c
> +++ b/kernel/kexec_handover.c
> @@ -1054,7 +1054,7 @@ static int __kho_abort(void)
>  		unsigned long phys;
>  
>  		xa_for_each(&physxa->phys_bits, phys, bits)
> -			kfree(bits);
> +			free_page((unsigned long)bits);
>  
>  		xa_destroy(&physxa->phys_bits);
>  		kfree(physxa);
> -- 
> 2.47.3
> 

-- 
Sincerely yours,
Mike.