Re: [rppt:free-late/v0.3] [memblock, treewide] bbe3478393: KASAN:use-after-free_in_memblock_isolate_range

[Mike Rapoport <rppt@kernel.org>]

Hello,

On Fri, Mar 20, 2026 at 03:53:54PM +0800, kernel test robot wrote:
> 
> Hello,
> 
> kernel test robot noticed "KASAN:use-after-free_in_memblock_isolate_range" on:
> 
> commit: bbe3478393e135e2fc98f32fa8ab182de6742136 ("memblock, treewide: make memblock_free() handle late freeing")
> https://git.kernel.org/cgit/linux/kernel/git/rppt/linux.git free-late/v0.3
> 
> in testcase: ltp
> version: 
> with following parameters:
> 
> 	test: uevent
> 
> 
> config: x86_64-rhel-9.4-ltp
> compiler: gcc-14
> test machine: 22 threads 1 sockets Intel(R) Core(TM) Ultra 9 185H @ 4.5GHz (Meteor Lake) with 32G memory
> 
> (please refer to attached dmesg/kmsg for entire log/backtrace)
> 
> 
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <oliver.sang@intel.com>
> | Closes: https://lore.kernel.org/oe-lkp/202603200841.b2d24d21-lkp@intel.com

Thanks for the report!

The patch below fixes the issue for me, I'd appreciate if you can verify it
on your setup as well:


diff --git a/mm/memblock.c b/mm/memblock.c
index 780e70d4971a..3e21d6135789 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -985,15 +985,18 @@ void __init_memblock memblock_free(void *ptr, size_t size)
 int __init_memblock memblock_phys_free(phys_addr_t base, phys_addr_t size)
 {
 	phys_addr_t end = base + size - 1;
+	int ret;
 
 	memblock_dbg("%s: [%pa-%pa] %pS\n", __func__,
 		     &base, &end, (void *)_RET_IP_);
 
 	kmemleak_free_part_phys(base, size);
+	ret = memblock_remove_range(&memblock.reserved, base, size);
+
 	if (slab_is_available())
 		__free_reserved_area(base, base + size, -1);
 
-	return memblock_remove_range(&memblock.reserved, base, size);
+	return ret;
 }
 
 int __init_memblock __memblock_reserve(phys_addr_t base, phys_addr_t size,

-- 
Sincerely yours,
Mike.