From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 883C73644B3; Tue, 21 Jul 2026 19:54:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784663680; cv=none; b=r57pZNwNzcY6L/A0k8JSTYhIQ5bHJXmMRiXj9+I2OhVLzCa7uJLZo5u5WZIQv9TQCzbjNz0wZRnv5Goq+18mkTcnZQAqv4kM1PrJc3F7/JDaQj+YJ453wGCSkswFbDKN4HJXfYAedZ9H8wmT+4bH/eVTx8MfKTyUeT2GOKcP83I= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784663680; c=relaxed/simple; bh=RaggwaGUKjnbzLhDPxzV5jAhlxqk/ePY9xvKn2IMtVA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=k7RuLmgLVhwBy/7v2o75z71ngtxpOUaS2qrX/tEFu5fNJAYHO+M7jOtGuItb90XmlIp8lApdbPhaeGzjq2z9QnaKXrREdKmRGebkyLWT3VaV4Xl4sCHuIPToPalH9u0dUsmRyqayC3EY6pd7aGlDSuPyygt9kNr5IEmXNZVkhjo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=DfjOuv87; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="DfjOuv87" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BBC7D1F000E9; Tue, 21 Jul 2026 19:54:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784663679; bh=MGbvm2forfIRvjIIdYVBWVMIpvZ7cUAp+r6UH6bS1/E=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=DfjOuv87UBXe7EYoSs5LynomkHzEsEv83W4faiPvZkP3RWboiyQoC0BbGNnUB9/PM ADAV+XidnCLX/bxrpJdXy8TypSNWuWOVxXjR1Icx6UnaP0o+EPmL9Y7i7hhrsa99xU V7rQoaAYqvMNBj5Db2YL2T3B7EE43SMaJMAWYzrY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Muchun Song , "David Hildenbrand (Arm)" , "Liam R. Howlett" , Georgi Djakov , "Aneesh Kumar K.V" , Joao Martins , Lorenzo Stoakes , Madhavan Srinivasan , Michael Ellerman , Michal Hocko , "Mike Rapoport (Microsoft)" , Nicholas Piggin , Oscar Salvador , Suren Baghdasaryan , Vlastimil Babka , Andrew Morton Subject: [PATCH 6.12 0913/1276] mm/memory_hotplug: fix incorrect altmap passing in error path Date: Tue, 21 Jul 2026 17:22:36 +0200 Message-ID: <20260721152506.466517411@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260721152446.065700225@linuxfoundation.org> References: <20260721152446.065700225@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Muchun Song commit 2fac4afa0e2e68841334c78c1821e49f74fbc66a upstream. In create_altmaps_and_memory_blocks(), when arch_add_memory() succeeds with memmap_on_memory enabled, the vmemmap pages are allocated from params.altmap. If create_memory_block_devices() subsequently fails, the error path calls arch_remove_memory() with a NULL altmap instead of params.altmap. This is a bug that could lead to memory corruption. Since altmap is NULL, vmemmap_free() falls back to freeing the vmemmap pages into the system buddy allocator via free_pages() instead of the altmap. arch_remove_memory() then immediately destroys the physical linear mapping for this memory. This injects unowned pages into the buddy allocator, causing machine checks or memory corruption if the system later attempts to allocate and use those freed pages. Fix this by passing params.altmap to arch_remove_memory() in the error path. Link: https://lore.kernel.org/20260428081855.1249045-3-songmuchun@bytedance.com Fixes: 6b8f0798b85a ("mm/memory_hotplug: split memmap_on_memory requests across memblocks") Signed-off-by: Muchun Song Acked-by: David Hildenbrand (Arm) Acked-by: Liam R. Howlett Reviewed-by: Georgi Djakov Cc: "Aneesh Kumar K.V" Cc: Joao Martins Cc: Lorenzo Stoakes Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Michal Hocko Cc: Mike Rapoport (Microsoft) Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman --- mm/memory_hotplug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/mm/memory_hotplug.c +++ b/mm/memory_hotplug.c @@ -1456,7 +1456,7 @@ static int create_altmaps_and_memory_blo ret = create_memory_block_devices(cur_start, memblock_size, params.altmap, group); if (ret) { - arch_remove_memory(cur_start, memblock_size, NULL); + arch_remove_memory(cur_start, memblock_size, params.altmap); kfree(params.altmap); goto out; }