[PATCH v2] mm/cma: fix reserved page leak on activation failure

[PATCH v2] mm/cma: fix reserved page leak on activation failure

[Muchun Song]

If cma_activate_area() fails after allocating only part of the range
bitmaps, the cleanup path still has to release the reserved pages when
CMA_RESERVE_PAGES_ON_ERROR is clear.

That is still worth doing even in this __init path. A bitmap_zalloc()
failure does not necessarily mean the system cannot make further progress:
freeing the reserved CMA pages can return a substantial amount of memory
to the buddy allocator and may relieve the temporary memory shortage that
caused the allocation failure in the first place.

However, the cleanup path currently uses the bitmap-freeing bound for page
release as well. That is only correct for ranges whose bitmap allocation
already succeeded. The failed range and all later ranges still keep their
reserved pages, so a partial bitmap allocation failure can permanently
leak them.

Fix this by releasing reserved pages for all ranges. Use the saved
early_pfn[] value for ranges whose bitmap allocation already succeeded and
for the failed range, and use cmr->early_pfn for later ranges whose bitmap
allocation was never attempted.

Fixes: c009da4258f9 ("mm, cma: support multiple contiguous ranges, if requested")
Cc: stable@vger.kernel.org
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
---
v1->v2:
- fix the failed-range cleanup to avoid using cmr->early_pfn after
  bitmap_zalloc() failure, as pointed out by Sashiko
- explain why the cleanup should still release reserved CMA pages in this
  __init failure path
---
 mm/cma.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/mm/cma.c b/mm/cma.c
index c7ca567f4c5c..a13ce4999b39 100644
--- a/mm/cma.c
+++ b/mm/cma.c
@@ -188,10 +188,13 @@ static void __init cma_activate_area(struct cma *cma)
 
 	/* Expose all pages to the buddy, they are useless for CMA. */
 	if (!test_bit(CMA_RESERVE_PAGES_ON_ERROR, &cma->flags)) {
-		for (r = 0; r < allocrange; r++) {
+		for (r = 0; r < cma->nranges; r++) {
+			unsigned long start_pfn;
+
 			cmr = &cma->ranges[r];
+			start_pfn = r <= allocrange ? early_pfn[r] : cmr->early_pfn;
 			end_pfn = cmr->base_pfn + cmr->count;
-			for (pfn = early_pfn[r]; pfn < end_pfn; pfn++)
+			for (pfn = start_pfn; pfn < end_pfn; pfn++)
 				free_reserved_page(pfn_to_page(pfn));
 		}
 	}

base-commit: e98d21c170b01ddef366f023bbfcf6b31509fa83
-- 
2.54.0

Re: [PATCH v2] mm/cma: fix reserved page leak on activation failure

[Usama Arif]

On Sat, 23 May 2026 14:01:23 +0800 Muchun Song <songmuchun@bytedance.com> wrote:

> If cma_activate_area() fails after allocating only part of the range
> bitmaps, the cleanup path still has to release the reserved pages when
> CMA_RESERVE_PAGES_ON_ERROR is clear.
> 
> That is still worth doing even in this __init path. A bitmap_zalloc()
> failure does not necessarily mean the system cannot make further progress:
> freeing the reserved CMA pages can return a substantial amount of memory
> to the buddy allocator and may relieve the temporary memory shortage that
> caused the allocation failure in the first place.
> 
> However, the cleanup path currently uses the bitmap-freeing bound for page
> release as well. That is only correct for ranges whose bitmap allocation
> already succeeded. The failed range and all later ranges still keep their
> reserved pages, so a partial bitmap allocation failure can permanently
> leak them.
> 
> Fix this by releasing reserved pages for all ranges. Use the saved
> early_pfn[] value for ranges whose bitmap allocation already succeeded and
> for the failed range, and use cmr->early_pfn for later ranges whose bitmap
> allocation was never attempted.
> 
> Fixes: c009da4258f9 ("mm, cma: support multiple contiguous ranges, if requested")
> Cc: stable@vger.kernel.org
> Signed-off-by: Muchun Song <songmuchun@bytedance.com>

Acked-by: Usama Arif <usama.arif@linux.dev>
 

Re: [PATCH v2] mm/cma: fix reserved page leak on activation failure

[Oscar Salvador (SUSE)]

On Sat, May 23, 2026 at 02:01:23PM +0800, Muchun Song wrote:
> If cma_activate_area() fails after allocating only part of the range
> bitmaps, the cleanup path still has to release the reserved pages when
> CMA_RESERVE_PAGES_ON_ERROR is clear.
> 
> That is still worth doing even in this __init path. A bitmap_zalloc()
> failure does not necessarily mean the system cannot make further progress:
> freeing the reserved CMA pages can return a substantial amount of memory
> to the buddy allocator and may relieve the temporary memory shortage that
> caused the allocation failure in the first place.
> 
> However, the cleanup path currently uses the bitmap-freeing bound for page
> release as well. That is only correct for ranges whose bitmap allocation
> already succeeded. The failed range and all later ranges still keep their
> reserved pages, so a partial bitmap allocation failure can permanently
> leak them.
> 
> Fix this by releasing reserved pages for all ranges. Use the saved
> early_pfn[] value for ranges whose bitmap allocation already succeeded and
> for the failed range, and use cmr->early_pfn for later ranges whose bitmap
> allocation was never attempted.
> 
> Fixes: c009da4258f9 ("mm, cma: support multiple contiguous ranges, if requested")
> Cc: stable@vger.kernel.org
> Signed-off-by: Muchun Song <songmuchun@bytedance.com>

Reviewed-by: Oscar Salvador (SUSE) <osalvador@kernel.org>

 

-- 
Oscar Salvador
SUSE Labs