From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CA8A623BD02; Mon, 25 May 2026 17:29:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779730174; cv=none; b=pj2HdT8yNqECLHjoQOjaLCpSHjgo3NBHTUIgldnICa5BxpygMa6v65u4uyWw9I0sz/P95PbUziDH7/xeAKkCYquNIl1EBiFEIcdoc4pTiv33150mSfj0lxYO3nPx+qr7vbw7GA3/ZhlVsYdqzZRpXe+bQKpGaWvo8dorrVhufko= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779730174; c=relaxed/simple; bh=v6XB4mPPpGyKOjrzpe4Q6U5GbUalkA5ofLc0LmAuyMI=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=KYwf4BKbW0ohdoJiVw86vKa6a0YVrqt7v7qipOBhsNdJKITCcXMSv8GlibxGn/z0B32goiPVaAW1US/gBlWegM3usTtFnuKOuCVN5Goj1ZN1plReK8r1nnWiInIIi0Mz7XwKtbICnwsLv5eRhY9/hLu5uCd/ash62NW+3Ty+NuU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=NX74LKJq; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="NX74LKJq" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1B6A81F000E9; Mon, 25 May 2026 17:29:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1779730173; bh=3paURfHuzbm+zxGp4fe8y83ocd0xA8H387UcFSHOVuc=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=NX74LKJq/IjUDVEmxYUJwJ1ISe2v0ECqFGIT4e4f0KgSYNfV9C+7CKD3fGy0nHuhL WdruTXRaEshe6RqKjS8eJHUizxDyH/k4gZNZTaDZFsOXbLU+eMlDyetEF+fTQ1a/qL /Z/IADSkxqwxWyS8KVGTZniyyEmo5vymXF7R79K/tiJUHjo4pzOo4R6qKSMJWJPSYV WpS5bOzZdSU9sqZWkqk5Rst73jagSk3nko+eO5vZedPM+zNwFfElsSOK05eODEyY60 QsHkPsWTVXzxgf5UJWiQzqZJZokKKSSKUGsKtIJ42D6iKCk43AdPItdTfFWJpWlgWs V6IkYsZnlXaxg== Date: Mon, 25 May 2026 19:29:25 +0200 From: "Oscar Salvador (SUSE)" To: Muchun Song Cc: Andrew Morton , David Hildenbrand , Lorenzo Stoakes , "Liam R. Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Frank van der Linden , linux-mm@kvack.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, muchun.song@linux.dev Subject: Re: [PATCH] mm/cma: fix reserved page leak on activation failure Message-ID: References: <20260522062658.4095405-1-songmuchun@bytedance.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260522062658.4095405-1-songmuchun@bytedance.com> On Fri, May 22, 2026 at 02:26:58PM +0800, Muchun Song wrote: > If cma_activate_area() fails after allocating only part of the range > bitmaps, its cleanup path frees the bitmaps for the ranges below > allocrange and then releases reserved pages using the same bound. > > That bound is only correct for bitmap freeing. Pages in ranges that did > not reach bitmap allocation are still reserved and should also be > returned to the buddy when CMA_RESERVE_PAGES_ON_ERROR is clear. As a > result, a partial bitmap allocation failure can permanently leak the > reserved pages from the failed range and all later ranges. > > Fix this by releasing reserved pages for all ranges. For ranges whose > bitmap allocation succeeded, use the early_pfn[] snapshot saved before > the bitmap pointer overwrote the union field. For later ranges, continue > to use cmr->early_pfn directly. > > Fixes: c009da4258f9 ("mm, cma: support multiple contiguous ranges, if requested") > Cc: stable@vger.kernel.org > Signed-off-by: Muchun Song Reviewed-by: Oscar Salvador (SUSE) -- Oscar Salvador SUSE Labs