[PATCH 00/10] mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part 2)

[PATCH 00/10] mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part 2)

[David Hildenbrand (Arm)]

Let's remove the remaining pieces of CONFIG_HAVE_BOOTMEM_INFO_NODE,
performing some smaller cleanups around freeing of reserved vmemmap
pages on the way.

Tested on x86-64 with hugetlb vmemmap optimization in combination with
KMEMLEAK. Heavily cross-compiled.

Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
---
David Hildenbrand (Arm) (10):
      x86/mm: drop order parameter from free_pagetable()
      mm: provide free_reserved_pages(), removing x86 variant
      s390/mm: use free_reserved_pages() in vmem_free_pages()
      mm/bootmem_info: allow calling free_bootmem_page() on pages without a bootmem_type
      x86/mm: stop marking vmemmap as SECTION_INFO
      x86/mm: stop marking page tables as MIX_SECTION_INFO
      x86/mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE
      mm/hugetlb_vmemmap: remove bootmem_info leftovers
      mm/sparse: remove bootmem_info.h include
      mm/bootmem_info: remove CONFIG_HAVE_BOOTMEM_INFO_NODE

 MAINTAINERS                  |   1 -
 arch/s390/mm/vmem.c          |   4 +-
 arch/x86/mm/init_64.c        | 134 ++++---------------------------------------
 include/linux/bootmem_info.h |  89 ----------------------------
 include/linux/mm.h           |   8 ++-
 mm/Kconfig                   |   8 ---
 mm/Makefile                  |   1 -
 mm/bootmem_info.c            |  72 -----------------------
 mm/hugetlb_vmemmap.c         |   8 +--
 mm/page_alloc.c              |  33 ++++++++---
 mm/sparse.c                  |   1 -
 11 files changed, 46 insertions(+), 313 deletions(-)

---

base-commit: d11ba1f570615ec8d4814d6313ee1d7075a33787

change-id: 20260428-bootmem_info_part2-4bbb445d9b3d

--

Cheers,

David

[PATCH 01/10] x86/mm: drop order parameter from free_pagetable()

[David Hildenbrand (Arm)]

All callers pass 0, so let's drop the parameter.

Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
---
 arch/x86/mm/init_64.c | 21 +++++++++------------
 1 file changed, 9 insertions(+), 12 deletions(-)

diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index d57f29ca23a5a..69e36f02a663a 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -1006,22 +1006,19 @@ static void free_reserved_pages(struct page *page, unsigned long nr_pages)
 		free_reserved_page(page++);
 }
 
-static void __meminit free_pagetable(struct page *page, int order)
+static void __meminit free_pagetable(struct page *page)
 {
 	/* bootmem page has reserved flag */
 	if (PageReserved(page)) {
-		unsigned long nr_pages = 1 << order;
 #ifdef CONFIG_HAVE_BOOTMEM_INFO_NODE
 		enum bootmem_type type = bootmem_type(page);
 
-		if (type == MIX_SECTION_INFO) {
-			while (nr_pages--)
-				put_page_bootmem(page++);
-		} else {
-			free_reserved_pages(page, nr_pages);
-		}
+		if (type == MIX_SECTION_INFO)
+			put_page_bootmem(page);
+		else
+			free_reserved_page(page);
 #else
-		free_reserved_pages(page, nr_pages);
+		free_reserved_page(page);
 #endif
 	} else {
 		pagetable_free(page_ptdesc(page));
@@ -1060,7 +1057,7 @@ static void __meminit free_pte_table(pte_t *pte_start, pmd_t *pmd)
 	}
 
 	/* free a pte table */
-	free_pagetable(pmd_page(*pmd), 0);
+	free_pagetable(pmd_page(*pmd));
 	spin_lock(&init_mm.page_table_lock);
 	pmd_clear(pmd);
 	spin_unlock(&init_mm.page_table_lock);
@@ -1078,7 +1075,7 @@ static void __meminit free_pmd_table(pmd_t *pmd_start, pud_t *pud)
 	}
 
 	/* free a pmd table */
-	free_pagetable(pud_page(*pud), 0);
+	free_pagetable(pud_page(*pud));
 	spin_lock(&init_mm.page_table_lock);
 	pud_clear(pud);
 	spin_unlock(&init_mm.page_table_lock);
@@ -1096,7 +1093,7 @@ static void __meminit free_pud_table(pud_t *pud_start, p4d_t *p4d)
 	}
 
 	/* free a pud table */
-	free_pagetable(p4d_page(*p4d), 0);
+	free_pagetable(p4d_page(*p4d));
 	spin_lock(&init_mm.page_table_lock);
 	p4d_clear(p4d);
 	spin_unlock(&init_mm.page_table_lock);

-- 
2.43.0

Re: [PATCH 01/10] x86/mm: drop order parameter from free_pagetable()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Page table pages are freed to the buddy allocator before their parent entries are cleared, creating a use-after-free window for hardware MMU walkers.
--

--- Patch [1]: [PATCH 01/10] x86/mm: drop order parameter from free_pagetable() ---
commit 9c29ffca799af465974343eaff811f5b52635f1f
Author: David Hildenbrand (Arm) <david@kernel.org>

x86/mm: drop order parameter from free_pagetable()

All callers pass 0, so let's drop the parameter.

> diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
> index d57f29ca23a5a..69e36f02a663a 100644
> --- a/arch/x86/mm/init_64.c
> +++ b/arch/x86/mm/init_64.c

[ ... ]

> @@ -1060,7 +1057,7 @@ static void __meminit free_pte_table(pte_t *pte_start, pmd_t *pmd)
>  	}
>  
>  	/* free a pte table */
> -	free_pagetable(pmd_page(*pmd), 0);
> +	free_pagetable(pmd_page(*pmd));
>  	spin_lock(&init_mm.page_table_lock);
>  	pmd_clear(pmd);

[Severity: High]
This is a pre-existing issue, but does calling free_pagetable() before
pmd_clear() create a use-after-free window?

The PTE table page is freed to the allocator before the PMD entry pointing to
it is cleared. If the freed page is quickly reallocated and populated with
arbitrary data, could hardware speculative page table walks or lockless software
walkers (like ptdump) follow the still-valid PMD entry and interpret this
data as valid page table entries?

>  	spin_unlock(&init_mm.page_table_lock);

[ ... ]

> @@ -1078,7 +1075,7 @@ static void __meminit free_pmd_table(pmd_t *pmd_start, pud_t *pud)
>  	}
>  
>  	/* free a pmd table */
> -	free_pagetable(pud_page(*pud), 0);
> +	free_pagetable(pud_page(*pud));
>  	spin_lock(&init_mm.page_table_lock);
>  	pud_clear(pud);

[Severity: High]
This is a pre-existing issue, but does this create a similar use-after-free
window for the PMD table page?

The PMD table page is freed to the buddy allocator before the PUD entry
pointing to it is cleared here.

>  	spin_unlock(&init_mm.page_table_lock);

[ ... ]

> @@ -1096,7 +1093,7 @@ static void __meminit free_pud_table(pud_t *pud_start, p4d_t *p4d)
>  	}
>  
>  	/* free a pud table */
> -	free_pagetable(p4d_page(*p4d), 0);
> +	free_pagetable(p4d_page(*p4d));
>  	spin_lock(&init_mm.page_table_lock);
>  	p4d_clear(p4d);

[Severity: High]
This is a pre-existing issue, but does this create a similar use-after-free
window for the PUD table page?

The PUD table page is freed to the buddy allocator before the P4D entry
pointing to it is cleared here.

>  	spin_unlock(&init_mm.page_table_lock);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708-bootmem_info_part2-v1-0-156ce4986598@kernel.org?part=1

Re: [PATCH 01/10] x86/mm: drop order parameter from free_pagetable()

[David Hildenbrand (Arm)]

>  	/* free a pte table */
> -	free_pagetable(pmd_page(*pmd), 0);
> +	free_pagetable(pmd_page(*pmd));
>  	spin_lock(&init_mm.page_table_lock);
>  	pmd_clear(pmd);
>  	spin_unlock(&init_mm.page_table_lock);
> @@ -1078,7 +1075,7 @@ static void __meminit free_pmd_table(pmd_t *pmd_start, pud_t *pud)
>  	}
>  
>  	/* free a pmd table */
> -	free_pagetable(pud_page(*pud), 0);
> +	free_pagetable(pud_page(*pud));
>  	spin_lock(&init_mm.page_table_lock);
>  	pud_clear(pud);
>  	spin_unlock(&init_mm.page_table_lock);
> @@ -1096,7 +1093,7 @@ static void __meminit free_pud_table(pud_t *pud_start, p4d_t *p4d)
>  	}
>  
>  	/* free a pud table */
> -	free_pagetable(p4d_page(*p4d), 0);
> +	free_pagetable(p4d_page(*p4d));
>  	spin_lock(&init_mm.page_table_lock);
>  	p4d_clear(p4d);
>  	spin_unlock(&init_mm.page_table_lock);
> 

Sashiko raises some pre-existing things around use-after free that I will just
ignore. We don't expect anybody to walk pages tables we are tearing down here,
and we'd have to wait for the TLB flush to get this right. And I don't see the
need to.

-- 
Cheers,

David

Re: [PATCH 01/10] x86/mm: drop order parameter from free_pagetable()

[Muchun Song]

> On Jul 8, 2026, at 22:10, David Hildenbrand (Arm) <david@kernel.org> wrote:
> 
> All callers pass 0, so let's drop the parameter.
> 
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>

Reviewed-by: Muchun Song <muchun.song@linux.dev>

Thanks.

[PATCH 02/10] mm: provide free_reserved_pages(), removing x86 variant

[David Hildenbrand (Arm)]

Let's extend free_reserved_page() in page_alloc.c to free_reserved_pages(),
dropping the custom x86 variant. The common-code variant will consume an
order, so adjust the x86 callers accordingly.

Make free_reserved_pages() assume that we are freeing ordinary
high-order pages, just with the special "reserved" flavor. The target
use case for now is freeing vmemmap PMD pages.

Set the refcount directly to 0 (instead of 1) and call
__free_frozen_pages(). Add some kerneldoc. Use a single
adjust_managed_page_count() call.

Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
---
 arch/x86/mm/init_64.c |  8 +-------
 include/linux/mm.h    |  8 ++++++--
 mm/page_alloc.c       | 33 ++++++++++++++++++++++++++-------
 3 files changed, 33 insertions(+), 16 deletions(-)

diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 69e36f02a663a..320e742b0bb3f 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -1000,12 +1000,6 @@ int arch_add_memory(int nid, u64 start, u64 size,
 	return add_pages(nid, start_pfn, nr_pages, params);
 }
 
-static void free_reserved_pages(struct page *page, unsigned long nr_pages)
-{
-	while (nr_pages--)
-		free_reserved_page(page++);
-}
-
 static void __meminit free_pagetable(struct page *page)
 {
 	/* bootmem page has reserved flag */
@@ -1038,7 +1032,7 @@ static void __meminit free_vmemmap_pages(struct page *page, unsigned int order,
 			while (nr_pages--)
 				put_page_bootmem(page++);
 		} else {
-			free_reserved_pages(page, nr_pages);
+			free_reserved_pages(page, order);
 		}
 	} else {
 		__free_pages(page, order);
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 113e1752548c2..62b261cccf16f 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -3993,8 +3993,12 @@ extern unsigned long free_reserved_area(void *start, void *end,
 
 extern void adjust_managed_page_count(struct page *page, long count);
 
-/* Free the reserved page into the buddy system, so it gets managed. */
-void free_reserved_page(struct page *page);
+void free_reserved_pages(struct page *page, unsigned int order);
+
+static inline void free_reserved_page(struct page *page)
+{
+	free_reserved_pages(page, 0);
+}
 
 static inline void mark_page_reserved(struct page *page)
 {
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index a63733dac659e..9311d1f3793ad 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -6381,15 +6381,34 @@ void adjust_managed_page_count(struct page *page, long count)
 }
 EXPORT_SYMBOL(adjust_managed_page_count);
 
-void free_reserved_page(struct page *page)
+/**
+ * free_reserved_pages - free reserved pages
+ * @page: First page to free.
+ * @order: The page order to free.
+ *
+ * Free pages allocated through memblock during boot, letting the buddy
+ * manage them from now on.
+ *
+ * @page must be naturally aligned to the order and the order must not
+ * exceed MAX_PAGE_ORDER. All pages must be reserved.
+ */
+void free_reserved_pages(struct page *page, unsigned int order)
 {
-	clear_page_tag_ref(page);
-	ClearPageReserved(page);
-	init_page_count(page);
-	__free_page(page);
-	adjust_managed_page_count(page, 1);
+	const unsigned long nr_pages = 1UL << order;
+	int i;
+
+	VM_WARN_ON_ONCE(!IS_ALIGNED(page_to_pfn(page), nr_pages));
+	VM_WARN_ON_ONCE(order > MAX_PAGE_ORDER);
+
+	for (i = 0; i < nr_pages; i++) {
+		clear_page_tag_ref(page + i);
+		ClearPageReserved(page + i);
+		set_page_count(page + i, 0);
+	}
+	adjust_managed_page_count(page, nr_pages);
+	__free_frozen_pages(page, order, FPI_NONE);
 }
-EXPORT_SYMBOL(free_reserved_page);
+EXPORT_SYMBOL(free_reserved_pages);
 
 static int page_alloc_cpu_dead(unsigned int cpu)
 {

-- 
2.43.0

Re: [PATCH 02/10] mm: provide free_reserved_pages(), removing x86 variant

[David Hildenbrand (Arm)]

On 7/8/26 16:10, David Hildenbrand (Arm) wrote:
> Let's extend free_reserved_page() in page_alloc.c to free_reserved_pages(),
> dropping the custom x86 variant. The common-code variant will consume an
> order, so adjust the x86 callers accordingly.
> 
> Make free_reserved_pages() assume that we are freeing ordinary
> high-order pages, just with the special "reserved" flavor. The target
> use case for now is freeing vmemmap PMD pages.
> 
> Set the refcount directly to 0 (instead of 1) and call
> __free_frozen_pages(). Add some kerneldoc. Use a single
> adjust_managed_page_count() call.
> 
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
> ---
>  arch/x86/mm/init_64.c |  8 +-------
>  include/linux/mm.h    |  8 ++++++--
>  mm/page_alloc.c       | 33 ++++++++++++++++++++++++++-------
>  3 files changed, 33 insertions(+), 16 deletions(-)
> 
> diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
> index 69e36f02a663a..320e742b0bb3f 100644
> --- a/arch/x86/mm/init_64.c
> +++ b/arch/x86/mm/init_64.c
> @@ -1000,12 +1000,6 @@ int arch_add_memory(int nid, u64 start, u64 size,
>  	return add_pages(nid, start_pfn, nr_pages, params);
>  }
>  
> -static void free_reserved_pages(struct page *page, unsigned long nr_pages)
> -{
> -	while (nr_pages--)
> -		free_reserved_page(page++);
> -}
> -
>  static void __meminit free_pagetable(struct page *page)
>  {
>  	/* bootmem page has reserved flag */
> @@ -1038,7 +1032,7 @@ static void __meminit free_vmemmap_pages(struct page *page, unsigned int order,
>  			while (nr_pages--)
>  				put_page_bootmem(page++);
>  		} else {
> -			free_reserved_pages(page, nr_pages);
> +			free_reserved_pages(page, order);
>  		}
>  	} else {
>  		__free_pages(page, order);
> diff --git a/include/linux/mm.h b/include/linux/mm.h
> index 113e1752548c2..62b261cccf16f 100644
> --- a/include/linux/mm.h
> +++ b/include/linux/mm.h
> @@ -3993,8 +3993,12 @@ extern unsigned long free_reserved_area(void *start, void *end,
>  
>  extern void adjust_managed_page_count(struct page *page, long count);
>  
> -/* Free the reserved page into the buddy system, so it gets managed. */
> -void free_reserved_page(struct page *page);
> +void free_reserved_pages(struct page *page, unsigned int order);
> +
> +static inline void free_reserved_page(struct page *page)
> +{
> +	free_reserved_pages(page, 0);
> +}
>  
>  static inline void mark_page_reserved(struct page *page)
>  {
> diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> index a63733dac659e..9311d1f3793ad 100644
> --- a/mm/page_alloc.c
> +++ b/mm/page_alloc.c
> @@ -6381,15 +6381,34 @@ void adjust_managed_page_count(struct page *page, long count)
>  }
>  EXPORT_SYMBOL(adjust_managed_page_count);
>  
> -void free_reserved_page(struct page *page)
> +/**
> + * free_reserved_pages - free reserved pages
> + * @page: First page to free.
> + * @order: The page order to free.
> + *
> + * Free pages allocated through memblock during boot, letting the buddy
> + * manage them from now on.
> + *
> + * @page must be naturally aligned to the order and the order must not
> + * exceed MAX_PAGE_ORDER. All pages must be reserved.
> + */
> +void free_reserved_pages(struct page *page, unsigned int order)
>  {
> -	clear_page_tag_ref(page);
> -	ClearPageReserved(page);
> -	init_page_count(page);
> -	__free_page(page);
> -	adjust_managed_page_count(page, 1);
> +	const unsigned long nr_pages = 1UL << order;
> +	int i;
> +
> +	VM_WARN_ON_ONCE(!IS_ALIGNED(page_to_pfn(page), nr_pages));
> +	VM_WARN_ON_ONCE(order > MAX_PAGE_ORDER);
> +
> +	for (i = 0; i < nr_pages; i++) {
> +		clear_page_tag_ref(page + i);
> +		ClearPageReserved(page + i);
> +		set_page_count(page + i, 0);

Sashiko raises in reply to #4 that PFN walkers trying to grab pages could see
their reference getting overridden.

While that is not something we should be worrying about (or fixing in old code),
I think it's best to ClearPageReserved() after set_page_count(), so someone
actually trying to grab a reference would have the chance to rely on
PageReserved from being a reliable indication.

-- 
Cheers,

David

Re: [PATCH 02/10] mm: provide free_reserved_pages(), removing x86 variant

[Muchun Song]

> On Jul 8, 2026, at 22:10, David Hildenbrand (Arm) <david@kernel.org> wrote:
> 
> Let's extend free_reserved_page() in page_alloc.c to free_reserved_pages(),
> dropping the custom x86 variant. The common-code variant will consume an
> order, so adjust the x86 callers accordingly.
> 
> Make free_reserved_pages() assume that we are freeing ordinary
> high-order pages, just with the special "reserved" flavor. The target
> use case for now is freeing vmemmap PMD pages.
> 
> Set the refcount directly to 0 (instead of 1) and call
> __free_frozen_pages(). Add some kerneldoc. Use a single
> adjust_managed_page_count() call.
> 
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>

Reviewed-by: Muchun Song <muchun.song@linux.dev>

Thanks.

[PATCH 03/10] s390/mm: use free_reserved_pages() in vmem_free_pages()

[David Hildenbrand (Arm)]

Let's use our new generic helper.

Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
---
 arch/s390/mm/vmem.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/arch/s390/mm/vmem.c b/arch/s390/mm/vmem.c
index 94ee06ae89134..d2879ce860a13 100644
--- a/arch/s390/mm/vmem.c
+++ b/arch/s390/mm/vmem.c
@@ -39,7 +39,6 @@ static void __ref *vmem_alloc_pages(unsigned int order)
 
 static void vmem_free_pages(unsigned long addr, int order, struct vmem_altmap *altmap)
 {
-	unsigned int nr_pages = 1 << order;
 	struct page *page;
 
 	if (altmap) {
@@ -49,8 +48,7 @@ static void vmem_free_pages(unsigned long addr, int order, struct vmem_altmap *a
 	page = virt_to_page((void *)addr);
 	if (PageReserved(page)) {
 		/* allocated from memblock */
-		while (nr_pages--)
-			free_reserved_page(page++);
+		free_reserved_pages(page, order);
 	} else {
 		free_pages(addr, order);
 	}

-- 
2.43.0

Re: [PATCH 03/10] s390/mm: use free_reserved_pages() in vmem_free_pages()

[Heiko Carstens]

On Wed, Jul 08, 2026 at 04:10:58PM +0200, David Hildenbrand (Arm) wrote:
> Let's use our new generic helper.
> 
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
> ---
>  arch/s390/mm/vmem.c | 4 +---
>  1 file changed, 1 insertion(+), 3 deletions(-)

Acked-by: Heiko Carstens <hca@linux.ibm.com>

Re: [PATCH 03/10] s390/mm: use free_reserved_pages() in vmem_free_pages()

[Muchun Song]

> On Jul 8, 2026, at 22:10, David Hildenbrand (Arm) <david@kernel.org> wrote:
> 
> Let's use our new generic helper.
> 
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>

Reviewed-by: Muchun Song <muchun.song@linux.dev>

Thanks.

[PATCH 04/10] mm/bootmem_info: allow calling free_bootmem_page() on pages without a bootmem_type

[David Hildenbrand (Arm)]

As preparation for further changes, let's temporarily allow freeing
pages that were not previously registered.

This will allow freeing unregistered vmemmap pages allocated during boot
through free_bootmem_page() from hugetlb code, until we fully rip all
of that out.

Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
---
 include/linux/bootmem_info.h | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/include/linux/bootmem_info.h b/include/linux/bootmem_info.h
index f724340755e55..486acc6127039 100644
--- a/include/linux/bootmem_info.h
+++ b/include/linux/bootmem_info.h
@@ -44,12 +44,12 @@ static inline void free_bootmem_page(struct page *page)
 {
 	enum bootmem_type type = bootmem_type(page);
 
-	VM_BUG_ON_PAGE(page_ref_count(page) != 2, page);
-
-	if (type == SECTION_INFO || type == MIX_SECTION_INFO)
+	if (type == SECTION_INFO || type == MIX_SECTION_INFO) {
+		VM_WARN_ON_PAGE(page_ref_count(page) != 2, page);
 		put_page_bootmem(page);
-	else
-		VM_BUG_ON_PAGE(1, page);
+	} else {
+		free_reserved_page(page);
+	}
 }
 #else
 static inline void register_page_bootmem_info_node(struct pglist_data *pgdat)

-- 
2.43.0

Re: [PATCH 04/10] mm/bootmem_info: allow calling free_bootmem_page() on pages without a bootmem_type

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Freeing unregistered vmemmap pages at runtime directly via `free_reserved_page()` bypasses atomic refcount checks, causing a Use-After-Free or double-free when racing with PFN scanners.
--

--- Patch [4]: [PATCH 04/10] mm/bootmem_info: allow calling free_bootmem_page() on pages without a bootmem_type ---
commit a34f9e5045801f37b33acf3125423a2dfdea2fc8
Author: David Hildenbrand (Arm) <david@kernel.org>
Subject: mm/bootmem_info: allow calling free_bootmem_page() on pages without a bootmem_type

This commit allows free_bootmem_page() to temporarily support freeing
unregistered vmemmap pages allocated during boot. Instead of triggering a
BUG, pages without a bootmem_type now fall back to being freed via
free_reserved_page().

> diff --git a/include/linux/bootmem_info.h b/include/linux/bootmem_info.h
> index f724340755e55..486acc6127039 100644
> --- a/include/linux/bootmem_info.h
> +++ b/include/linux/bootmem_info.h
> @@ -44,12 +44,12 @@ static inline void free_bootmem_page(struct page *page)
>  {
>  	enum bootmem_type type = bootmem_type(page);
>  
> -	VM_BUG_ON_PAGE(page_ref_count(page) != 2, page);
> -
> -	if (type == SECTION_INFO || type == MIX_SECTION_INFO)
> +	if (type == SECTION_INFO || type == MIX_SECTION_INFO) {
> +		VM_WARN_ON_PAGE(page_ref_count(page) != 2, page);
>  		put_page_bootmem(page);
> -	else
> -		VM_BUG_ON_PAGE(1, page);
> +	} else {
> +		free_reserved_page(page);

[Severity: High]
Can this race with PFN scanners and cause a use-after-free or double-free?

Since this is used for freeing unregistered vmemmap pages at runtime (via
HugeTLB Vmemmap Optimization), a physical memory scanner like DAMON might
concurrently iterate over this PFN and take a reference using folio_try_get().

If that happens, calling free_reserved_page() directly here bypasses atomic
refcount checks. Looking at free_reserved_pages() in mm/page_alloc.c, it
unconditionally clobbers any concurrent reference:

mm/page_alloc.c:free_reserved_pages() {
	...
	for (i = 0; i < nr_pages; i++) {
		clear_page_tag_ref(page + i);
		ClearPageReserved(page + i);
		set_page_count(page + i, 0);
	}
	...
}

Even scanners that check PageReserved can hit a race window here, as
PageReserved is cleared right before the refcount is forced to 0.

> +	}
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708-bootmem_info_part2-v1-0-156ce4986598@kernel.org?part=4

Re: [PATCH 04/10] mm/bootmem_info: allow calling free_bootmem_page() on pages without a bootmem_type

[Muchun Song]

> On Jul 8, 2026, at 22:10, David Hildenbrand (Arm) <david@kernel.org> wrote:
> 
> As preparation for further changes, let's temporarily allow freeing
> pages that were not previously registered.
> 
> This will allow freeing unregistered vmemmap pages allocated during boot
> through free_bootmem_page() from hugetlb code, until we fully rip all
> of that out.
> 
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>

Reviewed-by: Muchun Song <muchun.song@linux.dev>

Thanks.

[PATCH 05/10] x86/mm: stop marking vmemmap as SECTION_INFO

[David Hildenbrand (Arm)]

We added the whole bootmem registration machinery in commit 04753278769f
("memory hotplug: register section/node id to free").

The main use case was to remember to which memory section memmap pages
belonged, so the memmap could be handled accordingly when freeing
memory.

However, all that machinery is not required anymore: a memory section
can only get offlined if *all* pages can get offlined; and it can only
get unplugged once offline. If some of these pages are unmovable memmap
pages: bad luck, doesn't work. Offlining will fail.

Further, a lot of this machinery was required for pre-vmemmap support.
Now we only support the vmemmap with memory hotplug.

So the whole machinery is useless today. Let's start by removing the
last pieces by first stopping to mark vmemmap pages as SECTION_INFO.
In free_vmemmap_pages(), we can now always just free the reserved pages
directly.

Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
---
 arch/x86/mm/init_64.c | 30 ++++--------------------------
 1 file changed, 4 insertions(+), 26 deletions(-)

diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 320e742b0bb3f..82bb0384b8ab0 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -1024,19 +1024,12 @@ static void __meminit free_vmemmap_pages(struct page *page, unsigned int order,
 {
 	unsigned long nr_pages = 1u << order;
 
-	if (altmap) {
+	if (altmap)
 		vmem_altmap_free(altmap, nr_pages);
-	} else if (PageReserved(page)) {
-		if (IS_ENABLED(CONFIG_HAVE_BOOTMEM_INFO_NODE) &&
-		    bootmem_type(page) == SECTION_INFO) {
-			while (nr_pages--)
-				put_page_bootmem(page++);
-		} else {
-			free_reserved_pages(page, order);
-		}
-	} else {
+	else if (PageReserved(page))
+		free_reserved_pages(page, order);
+	else
 		__free_pages(page, order);
-	}
 }
 
 static void __meminit free_pte_table(pte_t *pte_start, pmd_t *pmd)
@@ -1593,12 +1586,8 @@ void register_page_bootmem_memmap(unsigned long section_nr,
 	p4d_t *p4d;
 	pud_t *pud;
 	pmd_t *pmd;
-	unsigned int nr_pmd_pages;
-	struct page *page;
 
 	for (; addr < end; addr = next) {
-		pte_t *pte = NULL;
-
 		pgd = pgd_offset_k(addr);
 		if (pgd_none(*pgd)) {
 			next = (addr + PAGE_SIZE) & PAGE_MASK;
@@ -1630,19 +1619,8 @@ void register_page_bootmem_memmap(unsigned long section_nr,
 			next = (addr + PAGE_SIZE) & PAGE_MASK;
 			get_page_bootmem(section_nr, pmd_page(*pmd),
 					 MIX_SECTION_INFO);
-
-			pte = pte_offset_kernel(pmd, addr);
-			if (pte_none(*pte))
-				continue;
-			get_page_bootmem(section_nr, pte_page(*pte),
-					 SECTION_INFO);
 		} else {
 			next = pmd_addr_end(addr, end);
-			nr_pmd_pages = (next - addr) >> PAGE_SHIFT;
-			page = pmd_page(*pmd);
-			while (nr_pmd_pages--)
-				get_page_bootmem(section_nr, page++,
-						 SECTION_INFO);
 		}
 	}
 }

-- 
2.43.0

Re: [PATCH 05/10] x86/mm: stop marking vmemmap as SECTION_INFO

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] Kernel page table pages (PGD, P4D, PUD, PMD) permanently leak during memory hot-remove due to mismatched reference counting.
- [High] Kernel page table pages and vmemmap physical pages are synchronously freed to the buddy allocator BEFORE their corresponding higher-level page table entries are cleared, causing a Use-After-Free.
--

--- Patch [5]: [PATCH 05/10] x86/mm: stop marking vmemmap as SECTION_INFO ---
commit 9fecf5a2d51cb3529c85d6e643dda7a25adb7fd1
Author: David Hildenbrand (Arm) <david@kernel.org>

x86/mm: stop marking vmemmap as SECTION_INFO

This commit removes the remaining vmemmap bootmem registration machinery
which is no longer required. It stops marking vmemmap pages as
SECTION_INFO and allows free_vmemmap_pages() to free reserved pages
directly.

> diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
> index 320e742b0bb3f..82bb0384b8ab0 100644
> --- a/arch/x86/mm/init_64.c
> +++ b/arch/x86/mm/init_64.c
> @@ -1024,19 +1024,12 @@ static void __meminit free_vmemmap_pages(struct page *page, unsigned int order,
[ ... ]
> -	} else {
> +	else
>  		__free_pages(page, order);
> -	}
>  }
>  
>  static void __meminit free_pte_table(pte_t *pte_start, pmd_t *pmd)

[Severity: High]
This is a pre-existing issue, but does this function (and others like it) 
free the PTE table page before clearing the corresponding PMD entry?

Looking at free_pte_table(), free_pagetable() frees the PTE table page 
to the buddy allocator. Only after this does the code acquire 
init_mm.page_table_lock and call pmd_clear() to unlink it:

arch/x86/mm/init_64.c:free_pte_table() {
    ...
    free_pagetable(pmd_page(*pmd));
    spin_lock(&init_mm.page_table_lock);
    pmd_clear(pmd);
    ...
}

Because init_mm is shared globally, could a hardware MMU page table walk 
on another CPU speculatively traverse the still-valid PMD entry into 
the freed page before the pmd_clear() occurs? 

If the buddy allocator reallocates this page to userspace and it is 
populated with user-controlled data, could this lead to a use-after-free 
and potential privilege escalation? 

A similar pattern appears to exist in remove_pte_table() for physical 
vmemmap pages.

[ ... ]
> @@ -1593,12 +1586,8 @@ void register_page_bootmem_memmap(unsigned long section_nr,
>  	p4d_t *p4d;
>  	pud_t *pud;
>  	pmd_t *pmd;
> -	unsigned int nr_pmd_pages;
> -	struct page *page;
>  
>  	for (; addr < end; addr = next) {

[Severity: High]
This isn't a bug introduced by this patch, but does this loop permanently 
leak kernel page table pages during memory hot-remove?

When vmemmap is mapped with 4KB base pages (e.g., if huge pages are not 
used), the loop steps forward by PAGE_SIZE. In each iteration, it calls 
get_page_bootmem() on the intermediate page table pages (like pgd_page 
and pmd_page), unconditionally incrementing the page refcount.

Because a PMD covers 2MB, the loop visits the exact same pmd_page 512 
times, incrementing its refcount by 512. 

However, during memory hot-remove, when the page table is emptied, 
free_pmd_table() calls free_pagetable() exactly once, which decrements 
the refcount by only 1:

arch/x86/mm/init_64.c:free_pmd_table() {
    ...
    free_pagetable(pud_page(*pud));
    ...
}

Will the refcount fail to reach 0, permanently leaking the page table 
page during hot-remove?

> -		pte_t *pte = NULL;
> -
>  		pgd = pgd_offset_k(addr);
>  		if (pgd_none(*pgd)) {
>  			next = (addr + PAGE_SIZE) & PAGE_MASK;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708-bootmem_info_part2-v1-0-156ce4986598@kernel.org?part=5

Re: [PATCH 05/10] x86/mm: stop marking vmemmap as SECTION_INFO

[David Hildenbrand (Arm)]

On 7/8/26 16:11, David Hildenbrand (Arm) wrote:
> We added the whole bootmem registration machinery in commit 04753278769f
> ("memory hotplug: register section/node id to free").
> 
> The main use case was to remember to which memory section memmap pages
> belonged, so the memmap could be handled accordingly when freeing
> memory.
> 
> However, all that machinery is not required anymore: a memory section
> can only get offlined if *all* pages can get offlined; and it can only
> get unplugged once offline. If some of these pages are unmovable memmap
> pages: bad luck, doesn't work. Offlining will fail.
> 
> Further, a lot of this machinery was required for pre-vmemmap support.
> Now we only support the vmemmap with memory hotplug.
> 
> So the whole machinery is useless today. Let's start by removing the
> last pieces by first stopping to mark vmemmap pages as SECTION_INFO.
> In free_vmemmap_pages(), we can now always just free the reserved pages
> directly.
> 
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
> ---

Sashiko mentions the same thing about freeing page tables that are still mapped
that I will ignore, and it also mentions an oddity in the PMD vmemmap handling
with get_page_bootmem() (taking 512 references whereby teardown only drops one
reference) that I will ignore, as I am ripping that part out completely either way.

-- 
Cheers,

David

[PATCH 06/10] x86/mm: stop marking page tables as MIX_SECTION_INFO

[David Hildenbrand (Arm)]

There is no good reason to mark boot page tables as MIX_SECTION_INFO: we
only free boot page tables when they are completely empty, and memory
offlining/hotunplug doesn't benefit from it in any way.

So just stop marking page tables as MIX_SECTION_INFO. In
free_pagetable(), we can now simply free reserved pages directly.

Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
---
 arch/x86/mm/init_64.c | 59 ++-------------------------------------------------
 1 file changed, 2 insertions(+), 57 deletions(-)

diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 82bb0384b8ab0..1b17dcf781e66 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -1002,21 +1002,10 @@ int arch_add_memory(int nid, u64 start, u64 size,
 
 static void __meminit free_pagetable(struct page *page)
 {
-	/* bootmem page has reserved flag */
-	if (PageReserved(page)) {
-#ifdef CONFIG_HAVE_BOOTMEM_INFO_NODE
-		enum bootmem_type type = bootmem_type(page);
-
-		if (type == MIX_SECTION_INFO)
-			put_page_bootmem(page);
-		else
-			free_reserved_page(page);
-#else
+	if (PageReserved(page))
 		free_reserved_page(page);
-#endif
-	} else {
+	else
 		pagetable_free(page_ptdesc(page));
-	}
 }
 
 static void __meminit free_vmemmap_pages(struct page *page, unsigned int order,
@@ -1579,50 +1568,6 @@ int __meminit vmemmap_populate(unsigned long start, unsigned long end, int node,
 void register_page_bootmem_memmap(unsigned long section_nr,
 				  struct page *start_page, unsigned long nr_pages)
 {
-	unsigned long addr = (unsigned long)start_page;
-	unsigned long end = (unsigned long)(start_page + nr_pages);
-	unsigned long next;
-	pgd_t *pgd;
-	p4d_t *p4d;
-	pud_t *pud;
-	pmd_t *pmd;
-
-	for (; addr < end; addr = next) {
-		pgd = pgd_offset_k(addr);
-		if (pgd_none(*pgd)) {
-			next = (addr + PAGE_SIZE) & PAGE_MASK;
-			continue;
-		}
-		get_page_bootmem(section_nr, pgd_page(*pgd), MIX_SECTION_INFO);
-
-		p4d = p4d_offset(pgd, addr);
-		if (p4d_none(*p4d)) {
-			next = (addr + PAGE_SIZE) & PAGE_MASK;
-			continue;
-		}
-		get_page_bootmem(section_nr, p4d_page(*p4d), MIX_SECTION_INFO);
-
-		pud = pud_offset(p4d, addr);
-		if (pud_none(*pud)) {
-			next = (addr + PAGE_SIZE) & PAGE_MASK;
-			continue;
-		}
-		get_page_bootmem(section_nr, pud_page(*pud), MIX_SECTION_INFO);
-
-		pmd = pmd_offset(pud, addr);
-		if (pmd_none(*pmd)) {
-			next = (addr + PAGE_SIZE) & PAGE_MASK;
-			continue;
-		}
-
-		if (!boot_cpu_has(X86_FEATURE_PSE) || !pmd_leaf(*pmd)) {
-			next = (addr + PAGE_SIZE) & PAGE_MASK;
-			get_page_bootmem(section_nr, pmd_page(*pmd),
-					 MIX_SECTION_INFO);
-		} else {
-			next = pmd_addr_end(addr, end);
-		}
-	}
 }
 #endif
 

-- 
2.43.0

Re: [PATCH 06/10] x86/mm: stop marking page tables as MIX_SECTION_INFO

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [Low] The patch leaves the entire bootmem_info infrastructure as dead code without removing it.

Pre-existing issues:
- [High] Kernel page table pages and vmemmap pages are freed to the buddy allocator before their parent entries are cleared and before the TLB is flushed, creating a dangling pointer window.
--

--- Patch [6]: [PATCH 06/10] x86/mm: stop marking page tables as MIX_SECTION_INFO ---
commit 898f480b722bff5d0f4c640bb5e5d118e809c16f
Author: David Hildenbrand (Arm) <david@kernel.org>
Subject: x86/mm: stop marking page tables as MIX_SECTION_INFO

This commit stops marking boot page tables as MIX_SECTION_INFO since they
are only freed when completely empty and memory offlining doesn't benefit
from it. It updates free_pagetable() to free reserved pages directly and
empties register_page_bootmem_memmap() to reflect this change.

> diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
> index 82bb0384b8ab0..1b17dcf781e66 100644
> --- a/arch/x86/mm/init_64.c
> +++ b/arch/x86/mm/init_64.c
> @@ -1002,21 +1002,10 @@ int arch_add_memory(int nid, u64 start, u64 size,
>  
>  static void __meminit free_pagetable(struct page *page)
>  {
> -	/* bootmem page has reserved flag */
> -	if (PageReserved(page)) {
> -#ifdef CONFIG_HAVE_BOOTMEM_INFO_NODE
> -		enum bootmem_type type = bootmem_type(page);
> -
> -		if (type == MIX_SECTION_INFO)
> -			put_page_bootmem(page);
> -		else
> -			free_reserved_page(page);
> -#else
> +	if (PageReserved(page))
>  		free_reserved_page(page);
> -#endif
> -	} else {
> +	else
>  		pagetable_free(page_ptdesc(page));
> -	}
>  }

[Severity: High]
This isn't a bug introduced by this patch, but looking at how free_pagetable()
is called during memory hot-remove:

arch/x86/mm/init_64.c:free_pte_table() {
    ...
	/* free a pte table */
	free_pagetable(pmd_page(*pmd));
	spin_lock(&init_mm.page_table_lock);
	pmd_clear(pmd);
	spin_unlock(&init_mm.page_table_lock);
    ...
}

arch/x86/mm/init_64.c:free_pmd_table() {
    ...
	/* free a pmd table */
	free_pagetable(pud_page(*pud));
	spin_lock(&init_mm.page_table_lock);
	pud_clear(pud);
	spin_unlock(&init_mm.page_table_lock);
    ...
}

Could freeing the page table pages to the buddy allocator before their parent
entries are cleared lead to a use-after-free window? If the freed page is
reallocated before the PMD or PUD is cleared, a lockless hardware MMU walker
might follow the dangling pointer and interpret the new page contents as valid
page table entries.

Would it be safer to clear the parent entries and flush the TLB before freeing
the child pages?

[ ... ]

> @@ -1579,50 +1568,6 @@ int __meminit vmemmap_populate(unsigned long start, unsigned long end, int node,
>  void register_page_bootmem_memmap(unsigned long section_nr,
>  				  struct page *start_page, unsigned long nr_pages)
>  {
> -	unsigned long addr = (unsigned long)start_page;
> -	unsigned long end = (unsigned long)(start_page + nr_pages);
> -	unsigned long next;
> -	pgd_t *pgd;
> -	p4d_t *p4d;
> -	pud_t *pud;
> -	pmd_t *pmd;
> -
> -	for (; addr < end; addr = next) {
> -		pgd = pgd_offset_k(addr);
> -		if (pgd_none(*pgd)) {
> -			next = (addr + PAGE_SIZE) & PAGE_MASK;
> -			continue;
> -		}
> -		get_page_bootmem(section_nr, pgd_page(*pgd), MIX_SECTION_INFO);

[ ... ]

> -		if (!boot_cpu_has(X86_FEATURE_PSE) || !pmd_leaf(*pmd)) {
> -			next = (addr + PAGE_SIZE) & PAGE_MASK;
> -			get_page_bootmem(section_nr, pmd_page(*pmd),
> -					 MIX_SECTION_INFO);
> -		} else {
> -			next = pmd_addr_end(addr, end);
> -		}
> -	}
>  }

[Severity: Low]
By removing the implementation of register_page_bootmem_memmap(), is the rest
of the bootmem_info infrastructure left as dead code?

Without get_page_bootmem() being called here, it appears no page will ever
have its bootmem_type set to SECTION_INFO or MIX_SECTION_INFO. As a result,
the SECTION_INFO check in free_bootmem_page() would always evaluate to false,
meaning put_page_bootmem() is never executed.

Should the remaining bootmem_info code, such as
register_page_bootmem_info_node() in mm/bootmem_info.c, be removed as well to
clean up the unused infrastructure?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708-bootmem_info_part2-v1-0-156ce4986598@kernel.org?part=6

Re: [PATCH 06/10] x86/mm: stop marking page tables as MIX_SECTION_INFO

[David Hildenbrand (Arm)]

On 7/8/26 16:11, David Hildenbrand (Arm) wrote:
> There is no good reason to mark boot page tables as MIX_SECTION_INFO: we
> only free boot page tables when they are completely empty, and memory
> offlining/hotunplug doesn't benefit from it in any way.
> 
> So just stop marking page tables as MIX_SECTION_INFO. In
> free_pagetable(), we can now simply free reserved pages directly.
> 
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
> ---
>  arch/x86/mm/init_64.c | 59 ++-------------------------------------------------
>  1 file changed, 2 insertions(+), 57 deletions(-)
> 
> diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
> index 82bb0384b8ab0..1b17dcf781e66 100644
> --- a/arch/x86/mm/init_64.c
> +++ b/arch/x86/mm/init_64.c
> @@ -1002,21 +1002,10 @@ int arch_add_memory(int nid, u64 start, u64 size,
>  
>  static void __meminit free_pagetable(struct page *page)
>  {
> -	/* bootmem page has reserved flag */
> -	if (PageReserved(page)) {
> -#ifdef CONFIG_HAVE_BOOTMEM_INFO_NODE
> -		enum bootmem_type type = bootmem_type(page);
> -
> -		if (type == MIX_SECTION_INFO)
> -			put_page_bootmem(page);
> -		else
> -			free_reserved_page(page);
> -#else
> +	if (PageReserved(page))
>  		free_reserved_page(page);
> -#endif
> -	} else {
> +	else
>  		pagetable_free(page_ptdesc(page));
> -	}
>  }
>  
>  static void __meminit free_vmemmap_pages(struct page *page, unsigned int order,
> @@ -1579,50 +1568,6 @@ int __meminit vmemmap_populate(unsigned long start, unsigned long end, int node,
>  void register_page_bootmem_memmap(unsigned long section_nr,
>  				  struct page *start_page, unsigned long nr_pages)
>  {
> -	unsigned long addr = (unsigned long)start_page;
> -	unsigned long end = (unsigned long)(start_page + nr_pages);
> -	unsigned long next;
> -	pgd_t *pgd;
> -	p4d_t *p4d;
> -	pud_t *pud;
> -	pmd_t *pmd;
> -
> -	for (; addr < end; addr = next) {
> -		pgd = pgd_offset_k(addr);
> -		if (pgd_none(*pgd)) {
> -			next = (addr + PAGE_SIZE) & PAGE_MASK;
> -			continue;
> -		}
> -		get_page_bootmem(section_nr, pgd_page(*pgd), MIX_SECTION_INFO);
> -
> -		p4d = p4d_offset(pgd, addr);
> -		if (p4d_none(*p4d)) {
> -			next = (addr + PAGE_SIZE) & PAGE_MASK;
> -			continue;
> -		}
> -		get_page_bootmem(section_nr, p4d_page(*p4d), MIX_SECTION_INFO);
> -
> -		pud = pud_offset(p4d, addr);
> -		if (pud_none(*pud)) {
> -			next = (addr + PAGE_SIZE) & PAGE_MASK;
> -			continue;
> -		}
> -		get_page_bootmem(section_nr, pud_page(*pud), MIX_SECTION_INFO);
> -
> -		pmd = pmd_offset(pud, addr);
> -		if (pmd_none(*pmd)) {
> -			next = (addr + PAGE_SIZE) & PAGE_MASK;
> -			continue;
> -		}
> -
> -		if (!boot_cpu_has(X86_FEATURE_PSE) || !pmd_leaf(*pmd)) {
> -			next = (addr + PAGE_SIZE) & PAGE_MASK;
> -			get_page_bootmem(section_nr, pmd_page(*pmd),
> -					 MIX_SECTION_INFO);
> -		} else {
> -			next = pmd_addr_end(addr, end);
> -		}
> -	}
>  }
>  #endif
>  
> 

Sashiko being rather useless:

New issues:
- [Low] The patch leaves the entire bootmem_info infrastructure as dead code
without removing it.

-> It's not aware of other patches in the series? Surprising.


Pre-existing issues:
- [High] Kernel page table pages and vmemmap pages are freed to the buddy
allocator before their parent entries are cleared and before the TLB is flushed,
creating a dangling pointer window.

-> Reported two times in previous patches and I will not fix that.


-- 
Cheers,

David

[PATCH 07/10] x86/mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE

[David Hildenbrand (Arm)]

CONFIG_HAVE_BOOTMEM_INFO_NODE now essentially doesn't do anything.

So let's remove support for CONFIG_HAVE_BOOTMEM_INFO_NODE.

Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
---
 arch/x86/mm/init_64.c | 26 --------------------------
 mm/Kconfig            |  1 -
 2 files changed, 27 deletions(-)

diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 1b17dcf781e66..ab4c5a02326f7 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -33,7 +33,6 @@
 #include <linux/nmi.h>
 #include <linux/gfp.h>
 #include <linux/kcore.h>
-#include <linux/bootmem_info.h>
 
 #include <asm/processor.h>
 #include <asm/bios_ebda.h>
@@ -1286,16 +1285,6 @@ void __ref arch_remove_memory(u64 start, u64 size, struct vmem_altmap *altmap,
 
 static struct kcore_list kcore_vsyscall;
 
-static void __init register_page_bootmem_info(void)
-{
-#if defined(CONFIG_NUMA) || defined(CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP)
-	int i;
-
-	for_each_online_node(i)
-		register_page_bootmem_info_node(NODE_DATA(i));
-#endif
-}
-
 /*
  * Pre-allocates page-table pages for the vmalloc area in the kernel page-table.
  * Only the level which needs to be synchronized between all page-tables is
@@ -1358,14 +1347,6 @@ void __init mem_init(void)
 	after_bootmem = 1;
 	x86_init.hyper.init_after_bootmem();
 
-	/*
-	 * Must be done after boot memory is put on freelist, because here we
-	 * might set fields in deferred struct pages that have not yet been
-	 * initialized, and memblock_free_all() initializes all the reserved
-	 * deferred pages for us.
-	 */
-	register_page_bootmem_info();
-
 	/* Register memory areas for /proc/kcore */
 	if (get_gate_vma(&init_mm))
 		kclist_add(&kcore_vsyscall, (void *)VSYSCALL_ADDR, PAGE_SIZE, KCORE_USER);
@@ -1564,13 +1545,6 @@ int __meminit vmemmap_populate(unsigned long start, unsigned long end, int node,
 	return err;
 }
 
-#ifdef CONFIG_HAVE_BOOTMEM_INFO_NODE
-void register_page_bootmem_memmap(unsigned long section_nr,
-				  struct page *start_page, unsigned long nr_pages)
-{
-}
-#endif
-
 void __meminit vmemmap_populate_print_last(void)
 {
 	if (p_start) {
diff --git a/mm/Kconfig b/mm/Kconfig
index f794a341d7422..592003a258bad 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -590,7 +590,6 @@ endchoice
 
 config MEMORY_HOTREMOVE
 	bool "Allow for memory hot remove"
-	select HAVE_BOOTMEM_INFO_NODE if X86_64
 	depends on MEMORY_HOTPLUG
 	select MIGRATION
 

-- 
2.43.0

Re: [PATCH 07/10] x86/mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [Medium] Incomplete feature removal leaves behind dead code.

Pre-existing issues:
- [High] Page tables and vmemmap target pages are freed to the buddy allocator before their page table entries are cleared, causing a Use-After-Free race with hardware page table walkers.
--

--- Patch [7]: [PATCH 07/10] x86/mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE ---
commit 4f73978273a221d985e72d75af30f38db0280de6
Author: David Hildenbrand (Arm) <david@kernel.org>

x86/mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE
    
CONFIG_HAVE_BOOTMEM_INFO_NODE now essentially doesn't do anything.
So let's remove support for CONFIG_HAVE_BOOTMEM_INFO_NODE.

> diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
> index 1b17dcf781e66..ab4c5a02326f7 100644
> --- a/arch/x86/mm/init_64.c
> +++ b/arch/x86/mm/init_64.c

[ ... ]

> diff --git a/mm/Kconfig b/mm/Kconfig
> index f794a341d7422..592003a258bad 100644
> --- a/mm/Kconfig
> +++ b/mm/Kconfig
> @@ -590,7 +590,6 @@ endchoice
>  
>  config MEMORY_HOTREMOVE
>  	bool "Allow for memory hot remove"
> -	select HAVE_BOOTMEM_INFO_NODE if X86_64

[Severity: Medium]
Since the intention of this commit is to remove support for 
CONFIG_HAVE_BOOTMEM_INFO_NODE, should the definition of the config itself 
also be deleted?

Currently, `config HAVE_BOOTMEM_INFO_NODE` remains in mm/Kconfig as a dead 
`def_bool n` option. Additionally, `mm/bootmem_info.c` and its build rule 
`obj-$(CONFIG_HAVE_BOOTMEM_INFO_NODE) += bootmem_info.o` in mm/Makefile are 
left behind as dead code.

>  	depends on MEMORY_HOTPLUG
>  	select MIGRATION
>  

[Severity: High]
This isn't a bug introduced by this patch, but while reviewing the memory 
hot-remove code in arch/x86/mm/init_64.c, I noticed that page tables and 
vmemmap target pages appear to be freed to the buddy allocator before their 
page table entries are actually cleared.

In arch/x86/mm/init_64.c:free_pte_table():

	/* free a pte table */
	free_pagetable(pmd_page(*pmd));
	spin_lock(&init_mm.page_table_lock);
	pmd_clear(pmd);

And similarly in arch/x86/mm/init_64.c:remove_pte_table():

			if (!direct)
				/* We never populate base pages from the altmap. */
				free_vmemmap_pages(pte_page(*pte), 0, NULL);

			spin_lock(&init_mm.page_table_lock);
			pte_clear(&init_mm, addr, pte);

Does this open a use-after-free race window where hardware page table walkers 
or speculative execution could access the recently-freed memory and interpret 
arbitrary data as page tables before the clear operation completes?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708-bootmem_info_part2-v1-0-156ce4986598@kernel.org?part=7

[PATCH 08/10] mm/hugetlb_vmemmap: remove bootmem_info leftovers

[David Hildenbrand (Arm)]

We never set CONFIG_HAVE_BOOTMEM_INFO_NODE, so we can just switch to
free_reserved_page() and drop the register_page_bootmem_memmap() call.

Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
---
 mm/hugetlb_vmemmap.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/mm/hugetlb_vmemmap.c b/mm/hugetlb_vmemmap.c
index 1430a5aa2de57..917db0984143c 100644
--- a/mm/hugetlb_vmemmap.c
+++ b/mm/hugetlb_vmemmap.c
@@ -12,7 +12,6 @@
 
 #include <linux/pgtable.h>
 #include <linux/moduleparam.h>
-#include <linux/bootmem_info.h>
 #include <linux/mmdebug.h>
 #include <linux/pagewalk.h>
 #include <linux/pgalloc.h>
@@ -177,13 +176,13 @@ static int vmemmap_remap_range(unsigned long start, unsigned long end,
  * Free a vmemmap page. A vmemmap page can be allocated from the memblock
  * allocator or buddy allocator. If the PG_reserved flag is set, it means
  * that it allocated from the memblock allocator, just free it via the
- * free_bootmem_page(). Otherwise, use __free_page().
+ * free_reserved_page(). Otherwise, use __free_page().
  */
 static inline void free_vmemmap_page(struct page *page)
 {
 	if (PageReserved(page)) {
 		memmap_boot_pages_add(-1);
-		free_bootmem_page(page);
+		free_reserved_page(page);
 	} else {
 		memmap_pages_add(-1);
 		__free_page(page);
@@ -641,9 +640,6 @@ static void __hugetlb_vmemmap_optimize_folios(struct hstate *h,
 			epfn = spfn + hugetlb_vmemmap_size(h);
 			vmemmap_wrprotect_hvo(spfn, epfn, folio_nid(folio),
 					HUGETLB_VMEMMAP_RESERVE_SIZE);
-			register_page_bootmem_memmap(pfn_to_section_nr(folio_pfn(folio)),
-					&folio->page,
-					HUGETLB_VMEMMAP_RESERVE_PAGES);
 			continue;
 		}
 

-- 
2.43.0

Re: [PATCH 08/10] mm/hugetlb_vmemmap: remove bootmem_info leftovers

[Muchun Song]

> On Jul 8, 2026, at 22:11, David Hildenbrand (Arm) <david@kernel.org> wrote:
> 
> We never set CONFIG_HAVE_BOOTMEM_INFO_NODE, so we can just switch to
> free_reserved_page() and drop the register_page_bootmem_memmap() call.
> 
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>

Reviewed-by: Muchun Song <muchun.song@linux.dev>

Thanks.

[PATCH 09/10] mm/sparse: remove bootmem_info.h include

[David Hildenbrand (Arm)]

No longer required, so let's remove it.

Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
---
 mm/sparse.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/mm/sparse.c b/mm/sparse.c
index 058ef93003672..b5c74aab3379a 100644
--- a/mm/sparse.c
+++ b/mm/sparse.c
@@ -13,7 +13,6 @@
 #include <linux/vmalloc.h>
 #include <linux/swap.h>
 #include <linux/swapops.h>
-#include <linux/bootmem_info.h>
 #include <linux/vmstat.h>
 #include "internal.h"
 #include <asm/dma.h>

-- 
2.43.0

Re: [PATCH 09/10] mm/sparse: remove bootmem_info.h include

[Muchun Song]

> On Jul 8, 2026, at 22:11, David Hildenbrand (Arm) <david@kernel.org> wrote:
> 
> No longer required, so let's remove it.
> 
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>

Reviewed-by: Muchun Song <muchun.song@linux.dev>

Thanks.

[PATCH 10/10] mm/bootmem_info: remove CONFIG_HAVE_BOOTMEM_INFO_NODE

[David Hildenbrand (Arm)]

The whole infrastructure is unused now. Let's remove the config option
along with mm/bootmem_info. + include/linux/bootmem_info.h.

Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
---
 MAINTAINERS                  |  1 -
 include/linux/bootmem_info.h | 89 --------------------------------------------
 mm/Kconfig                   |  7 ----
 mm/Makefile                  |  1 -
 mm/bootmem_info.c            | 72 -----------------------------------
 5 files changed, 170 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index d19822d574fd4..9a67ae0f7865e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -16877,7 +16877,6 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock.git fixes
 F:	Documentation/core-api/boot-time-mm.rst
 F:	include/linux/kho/abi/memblock.h
 F:	include/linux/memblock.h
-F:	mm/bootmem_info.c
 F:	mm/memblock.c
 F:	mm/memtest.c
 F:	mm/mm_init.c
diff --git a/include/linux/bootmem_info.h b/include/linux/bootmem_info.h
deleted file mode 100644
index 486acc6127039..0000000000000
--- a/include/linux/bootmem_info.h
+++ /dev/null
@@ -1,89 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#ifndef __LINUX_BOOTMEM_INFO_H
-#define __LINUX_BOOTMEM_INFO_H
-
-#include <linux/mm.h>
-#include <linux/kmemleak.h>
-
-/*
- * Types for free bootmem stored in the low bits of page->private.
- */
-enum bootmem_type {
-	MEMORY_HOTPLUG_MIN_BOOTMEM_TYPE = 1,
-	SECTION_INFO = MEMORY_HOTPLUG_MIN_BOOTMEM_TYPE,
-	MIX_SECTION_INFO,
-	NODE_INFO,
-	MEMORY_HOTPLUG_MAX_BOOTMEM_TYPE = NODE_INFO,
-};
-
-#ifdef CONFIG_HAVE_BOOTMEM_INFO_NODE
-void __init register_page_bootmem_info_node(struct pglist_data *pgdat);
-void register_page_bootmem_memmap(unsigned long section_nr, struct page *map,
-				  unsigned long nr_pages);
-
-void get_page_bootmem(unsigned long info, struct page *page,
-		enum bootmem_type type);
-void put_page_bootmem(struct page *page);
-
-static inline enum bootmem_type bootmem_type(const struct page *page)
-{
-	return (unsigned long)page->private & 0xf;
-}
-
-static inline unsigned long bootmem_info(const struct page *page)
-{
-	return (unsigned long)page->private >> 4;
-}
-
-/*
- * Any memory allocated via the memblock allocator and not via the
- * buddy will be marked reserved already in the memmap. For those
- * pages, we can call this function to free it to buddy allocator.
- */
-static inline void free_bootmem_page(struct page *page)
-{
-	enum bootmem_type type = bootmem_type(page);
-
-	if (type == SECTION_INFO || type == MIX_SECTION_INFO) {
-		VM_WARN_ON_PAGE(page_ref_count(page) != 2, page);
-		put_page_bootmem(page);
-	} else {
-		free_reserved_page(page);
-	}
-}
-#else
-static inline void register_page_bootmem_info_node(struct pglist_data *pgdat)
-{
-}
-
-static inline void register_page_bootmem_memmap(unsigned long section_nr,
-		struct page *map, unsigned long nr_pages)
-{
-}
-
-static inline void put_page_bootmem(struct page *page)
-{
-}
-
-static inline enum bootmem_type bootmem_type(const struct page *page)
-{
-	return SECTION_INFO;
-}
-
-static inline unsigned long bootmem_info(const struct page *page)
-{
-	return 0;
-}
-
-static inline void get_page_bootmem(unsigned long info, struct page *page,
-				    enum bootmem_type type)
-{
-}
-
-static inline void free_bootmem_page(struct page *page)
-{
-	free_reserved_page(page);
-}
-#endif
-
-#endif /* __LINUX_BOOTMEM_INFO_H */
diff --git a/mm/Kconfig b/mm/Kconfig
index 592003a258bad..169a3ba12a255 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -509,13 +509,6 @@ config EXCLUSIVE_SYSTEM_RAM
 	def_bool y
 	depends on !DEVMEM || STRICT_DEVMEM
 
-#
-# Only be set on architectures that have completely implemented memory hotplug
-# feature. If you are not sure, don't touch it.
-#
-config HAVE_BOOTMEM_INFO_NODE
-	def_bool n
-
 config ARCH_ENABLE_MEMORY_HOTPLUG
 	bool
 
diff --git a/mm/Makefile b/mm/Makefile
index 4fc713867b9bd..52428a3d3ae14 100644
--- a/mm/Makefile
+++ b/mm/Makefile
@@ -141,7 +141,6 @@ obj-$(CONFIG_MEMFD_CREATE) += memfd.o
 obj-$(CONFIG_MAPPING_DIRTY_HELPERS) += mapping_dirty_helpers.o
 obj-$(CONFIG_PTDUMP) += ptdump.o
 obj-$(CONFIG_PAGE_REPORTING) += page_reporting.o
-obj-$(CONFIG_HAVE_BOOTMEM_INFO_NODE) += bootmem_info.o
 obj-$(CONFIG_GENERIC_IOREMAP) += ioremap.o
 obj-$(CONFIG_SHRINKER_DEBUG) += shrinker_debug.o
 obj-$(CONFIG_EXECMEM) += execmem.o
diff --git a/mm/bootmem_info.c b/mm/bootmem_info.c
deleted file mode 100644
index 0fa78db7fbc0b..0000000000000
--- a/mm/bootmem_info.c
+++ /dev/null
@@ -1,72 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * Bootmem core functions.
- *
- * Copyright (c) 2020, Bytedance.
- *
- *     Author: Muchun Song <songmuchun@bytedance.com>
- *
- */
-#include <linux/mm.h>
-#include <linux/compiler.h>
-#include <linux/memblock.h>
-#include <linux/bootmem_info.h>
-#include <linux/memory_hotplug.h>
-#include <linux/kmemleak.h>
-
-void get_page_bootmem(unsigned long info, struct page *page,
-		enum bootmem_type type)
-{
-	BUG_ON(type > 0xf);
-	BUG_ON(info > (ULONG_MAX >> 4));
-	set_page_private(page, info << 4 | type);
-	page_ref_inc(page);
-}
-
-void put_page_bootmem(struct page *page)
-{
-	enum bootmem_type type = bootmem_type(page);
-
-	BUG_ON(type < MEMORY_HOTPLUG_MIN_BOOTMEM_TYPE ||
-	       type > MEMORY_HOTPLUG_MAX_BOOTMEM_TYPE);
-
-	if (page_ref_dec_return(page) == 1) {
-		set_page_private(page, 0);
-		free_reserved_page(page);
-	}
-}
-
-static void __init register_page_bootmem_info_section(unsigned long start_pfn)
-{
-	unsigned long section_nr;
-	struct mem_section *ms;
-
-	start_pfn = SECTION_ALIGN_DOWN(start_pfn);
-	section_nr = pfn_to_section_nr(start_pfn);
-	ms = __nr_to_section(section_nr);
-
-	if (!preinited_vmemmap_section(ms))
-		register_page_bootmem_memmap(section_nr, pfn_to_page(start_pfn),
-					     PAGES_PER_SECTION);
-}
-
-void __init register_page_bootmem_info_node(struct pglist_data *pgdat)
-{
-	unsigned long pfn, end_pfn;
-	int node = pgdat->node_id;
-
-	pfn = pgdat->node_start_pfn;
-	end_pfn = pgdat_end_pfn(pgdat);
-
-	/* register section info */
-	for (; pfn < end_pfn; pfn += PAGES_PER_SECTION) {
-		/*
-		 * Some platforms can assign the same pfn to multiple nodes - on
-		 * node0 as well as nodeN.  To avoid registering a pfn against
-		 * multiple nodes we check that this pfn does not already
-		 * reside in some other nodes.
-		 */
-		if (pfn_valid(pfn) && (early_pfn_to_nid(pfn) == node))
-			register_page_bootmem_info_section(pfn);
-	}
-}

-- 
2.43.0

Re: [PATCH 10/10] mm/bootmem_info: remove CONFIG_HAVE_BOOTMEM_INFO_NODE

[Muchun Song]

> On Jul 8, 2026, at 22:11, David Hildenbrand (Arm) <david@kernel.org> wrote:
> 
> The whole infrastructure is unused now. Let's remove the config option
> along with mm/bootmem_info. + include/linux/bootmem_info.h.
> 
> Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>

Reviewed-by: Muchun Song <muchun.song@linux.dev>

Thanks.

Re: [PATCH 00/10] mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part 2)

[Andrew Morton]

On Wed, 08 Jul 2026 16:10:55 +0200 "David Hildenbrand (Arm)" <david@kernel.org> wrote:

> Let's remove the remaining pieces of CONFIG_HAVE_BOOTMEM_INFO_NODE,
> performing some smaller cleanups around freeing of reserved vmemmap
> pages on the way.

Thanks, looks pretty simple.   I'll add it to mm-new, along with a note that [02/10] is to-be-updated.

Re: [PATCH 00/10] mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part 2)

[Mike Rapoport]

On Wed, 08 Jul 2026 16:10:55 +0200, David Hildenbrand (Arm) <david@kernel.org> wrote:
> mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part 2)
> 
> Let's remove the remaining pieces of CONFIG_HAVE_BOOTMEM_INFO_NODE,
> performing some smaller cleanups around freeing of reserved vmemmap
> pages on the way.
> 
> Tested on x86-64 with hugetlb vmemmap optimization in combination with
> KMEMLEAK. Heavily cross-compiled.
> 
> [...]

Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org>

-- 
Sincerely yours,
Mike.