Re: [PATCH 04/10] mm/bootmem_info: allow calling free_bootmem_page() on pages without a bootmem_type

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Freeing unregistered vmemmap pages at runtime directly via `free_reserved_page()` bypasses atomic refcount checks, causing a Use-After-Free or double-free when racing with PFN scanners.
--

--- Patch [4]: [PATCH 04/10] mm/bootmem_info: allow calling free_bootmem_page() on pages without a bootmem_type ---
commit a34f9e5045801f37b33acf3125423a2dfdea2fc8
Author: David Hildenbrand (Arm) <david@kernel.org>
Subject: mm/bootmem_info: allow calling free_bootmem_page() on pages without a bootmem_type

This commit allows free_bootmem_page() to temporarily support freeing
unregistered vmemmap pages allocated during boot. Instead of triggering a
BUG, pages without a bootmem_type now fall back to being freed via
free_reserved_page().

> diff --git a/include/linux/bootmem_info.h b/include/linux/bootmem_info.h
> index f724340755e55..486acc6127039 100644
> --- a/include/linux/bootmem_info.h
> +++ b/include/linux/bootmem_info.h
> @@ -44,12 +44,12 @@ static inline void free_bootmem_page(struct page *page)
>  {
>  	enum bootmem_type type = bootmem_type(page);
>  
> -	VM_BUG_ON_PAGE(page_ref_count(page) != 2, page);
> -
> -	if (type == SECTION_INFO || type == MIX_SECTION_INFO)
> +	if (type == SECTION_INFO || type == MIX_SECTION_INFO) {
> +		VM_WARN_ON_PAGE(page_ref_count(page) != 2, page);
>  		put_page_bootmem(page);
> -	else
> -		VM_BUG_ON_PAGE(1, page);
> +	} else {
> +		free_reserved_page(page);

[Severity: High]
Can this race with PFN scanners and cause a use-after-free or double-free?

Since this is used for freeing unregistered vmemmap pages at runtime (via
HugeTLB Vmemmap Optimization), a physical memory scanner like DAMON might
concurrently iterate over this PFN and take a reference using folio_try_get().

If that happens, calling free_reserved_page() directly here bypasses atomic
refcount checks. Looking at free_reserved_pages() in mm/page_alloc.c, it
unconditionally clobbers any concurrent reference:

mm/page_alloc.c:free_reserved_pages() {
	...
	for (i = 0; i < nr_pages; i++) {
		clear_page_tag_ref(page + i);
		ClearPageReserved(page + i);
		set_page_count(page + i, 0);
	}
	...
}

Even scanners that check PageReserved can hit a race window here, as
PageReserved is cleared right before the refcount is forced to 0.

> +	}
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708-bootmem_info_part2-v1-0-156ce4986598@kernel.org?part=4