From nobody Wed Jun 17 04:20:18 2026 Received: from mail-pj1-f49.google.com (mail-pj1-f49.google.com [209.85.216.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AD7973D75A0 for ; Tue, 28 Apr 2026 08:52:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.49 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777366356; cv=none; b=e2ouNNwncVrj1039hFsozWXeezB0p8SZTLl6jiOJHGV0OjTpV6og7enbe0fIdpmdmPwCtv3XRtw689mfNJeFkxk8pk4EUg2axqvq27dPvHhTbJXiLWb2H9A+cuRRSNtidK26LxKgfsaw4yqAnP2y6ohLSFejXkgFAxT9xwXVTqk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777366356; c=relaxed/simple; bh=nQdEySHsup5tuoqx9Fwrf6ki6sgYhd+krQ8jAeZzU/Y=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=BtYAQiFK8rcKWabeGo3bYDHedEFE/16ERyivqYkUaQZRDRuuoCwJZY8AfrlH05ar8sJ2N41EQOWptEMbhrhkdwFe9hG9lrMR5ANxpJWFCjMfzyXda6vBRrEnl7cqsV6HAmEX8XfLUqjZknfXuNyQMfc4R96bR+E6Wd3oyWNAeqo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=bytedance.com; spf=pass smtp.mailfrom=bytedance.com; dkim=pass (2048-bit key) header.d=bytedance.com header.i=@bytedance.com header.b=ZhMhEMoZ; arc=none smtp.client-ip=209.85.216.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=bytedance.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bytedance.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bytedance.com header.i=@bytedance.com header.b="ZhMhEMoZ" Received: by mail-pj1-f49.google.com with SMTP id 98e67ed59e1d1-35d99bae2ebso9876246a91.3 for ; Tue, 28 Apr 2026 01:52:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bytedance.com; s=google; t=1777366354; x=1777971154; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=g3RZ85zZRMSfm4V5G/nYn9e3XYF7QD6vD8DovC4NkGE=; b=ZhMhEMoZpXGeT1eEF0IiDMGFFkclzuLEBXmEf9xow3hHvQ/5GgU6w7i0aQn4GFtdg8 P3Tq4MpNHo7UifWcffZ6oN4D4hjoIz7JE0C+mBUoxLQ4RqoVgNGV2ouegSp0Ta1dUEv9 jvrn3bg0nWGkL5zj6JXOcPn5cH2kGF8nmSBJ3PlLPYx3SeoPVNtwLdsmhljFFMHMMlJS R9vx/HjWLE0Dit1FYoFh6KQ6cEagFxm7VYqktZWa/XKV9flyjxT9WVQajlhCyxeXG3dy nxVS0b2b2EVLH0kkFooA+ShjKnx+ttccMZP6/PFjAT1sTy8kq/leFHmcaPXcotFXZhkV /i3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777366354; x=1777971154; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=g3RZ85zZRMSfm4V5G/nYn9e3XYF7QD6vD8DovC4NkGE=; b=GWqgCyapZSAAxXfprB00bvLkQ3o2y2dduPjrJ3CfHvAR8AkCsqeFvbFZ8rd5Mo/+/w VNRJYj871L7pF18jV6kA1YxCT9T2TnfNtDvyJkLAj1Kv+svxMGPJ3QnnUIaCHH8rCRt5 ZmBWlA3NfegAR3zk9GQcdhVg9FZgbAAmTuM8OGYF0EwLbENqhTpRfCnJAHqoOx3iwHOr qwH1GlYtWxvodgpDj2CaYzMIRlNtMcls7aUJ8TeQyUao4ne9VxJeuNmky3wC5nvli/kL KO/YCPOo0eIDjBzbUO60zNir6Xd2LFbVvynCR6X/KjeQJ5mShr/3hv2X3pw7BbAy7/iV 77yQ== X-Forwarded-Encrypted: i=1; AFNElJ+U26PJrIvgEMriklQanuG1hkHjiQh3g8b4ivg1TMfcUKTh0KN8zBc10a7d9EeSxcI/9jjqFC5sXQkncho=@vger.kernel.org X-Gm-Message-State: AOJu0Ywaqo4XrsUwyQYt5oiDC3uI157kHVFeIClqq9O5PNCT5Kj7npGD NG+x4+tRZswOSBg9sVnYJCimZtNdYbOlcixus9q73rHHhceQ1WBW6XTxQvcNgcgobU0= X-Gm-Gg: AeBDiesL2VNttR8mfbBWZEFG940OzNfKsVbqwJEQCeQ7Y1T+mwCulOuoveeWYSmJBVJ p9YfsTvrpkmCBbmPnIQmavh8ryU2gHKpCVTcIEGLrXdxhIxBHq6l/X+VnAeLhHil67C6U7NvUmB 6RcQaiCYWTiw9WSHYpB70xDOGYGvLzRiG1zB8eslWYwiIEc7P+lSpSJV5U9ZnOA3/GzODiYjySL r7jwaXwZhH9w4JfknfJ0pV8d4wxDqnAwn3I67lpLkPXrxImI/auP0akcx1s2uZDmVUBzYtC8gso j8bkLCerdU1k+g7D5h+HCkwfI9zf4yBUcal67lQv+wrSEpdo675dYHkv+4CcPJlA+wLXb2GwxXD A/KlMbnE5Z3V0yGUsKmInOEdZFnJv2Djpo24MMOaOPUrWZoBIoisDRdlGW71dvosRDjgK65oaJz VZMe5j3k+0EF5dJ3//gmQ5xqvdjA/j3bcnHUWWsrIt6hi3kafK0wKZSrY= X-Received: by 2002:a17:90b:3510:b0:35f:b5df:463 with SMTP id 98e67ed59e1d1-364920a5111mr2319506a91.14.1777366354012; Tue, 28 Apr 2026 01:52:34 -0700 (PDT) Received: from n232-176-004.byted.org ([36.110.163.103]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-364902e7debsm2889080a91.15.2026.04.28.01.52.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 28 Apr 2026 01:52:33 -0700 (PDT) From: Muchun Song To: David Hildenbrand , Oscar Salvador , Greg Kroah-Hartman , "Rafael J . Wysocki" , Danilo Krummrich , Andrew Morton Cc: Vishal Verma , Ying Huang , Dan Williams , Miaohe Lin , Naoya Horiguchi , linux-mm@kvack.org, linux-cxl@vger.kernel.org, driver-core@lists.linux.dev, linux-kernel@vger.kernel.org, Muchun Song , stable@vger.kernel.org, muchun.song@linux.dev Subject: [PATCH v2 1/3] mm/memory_hotplug: fix memory block reference leak on remove Date: Tue, 28 Apr 2026 16:52:17 +0800 Message-Id: <20260428085219.1316047-2-songmuchun@bytedance.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20260428085219.1316047-1-songmuchun@bytedance.com> References: <20260428085219.1316047-1-songmuchun@bytedance.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" remove_memory_blocks_and_altmaps() looks up each memory block with find_memory_block(), which acquires a reference to the memory block device. That reference is never dropped on this path, resulting in a leaked device reference when removing memory blocks and their altmaps. Drop the reference after retrieving mem->altmap and clearing mem->altmap, before removing the memory block device. Fixes: 6b8f0798b85a ("mm/memory_hotplug: split memmap_on_memory requests ac= ross memblocks") Cc: stable@vger.kernel.org Signed-off-by: Muchun Song Acked-by: Oscar Salvador Acked-by: David Hildenbrand (Arm) --- v1->v2: - Add Acked-by from Oscar. - I didn't add memory_block_get_by_id/memory_block_put because this is a pure bugfix series. I will send that separate cleanup after the bugfixes have been merged. --- mm/memory_hotplug.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c index 2a943ec57c85..40c7915dabe0 100644 --- a/mm/memory_hotplug.c +++ b/mm/memory_hotplug.c @@ -1422,6 +1422,8 @@ static void remove_memory_blocks_and_altmaps(u64 star= t, u64 size) =20 altmap =3D mem->altmap; mem->altmap =3D NULL; + /* drop the ref. we got via find_memory_block() */ + put_device(&mem->dev); =20 remove_memory_block_devices(cur_start, memblock_size); =20 --=20 2.20.1 From nobody Wed Jun 17 04:20:18 2026 Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5449A3D6CD7 for ; Tue, 28 Apr 2026 08:52:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.47 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777366360; cv=none; b=NOClazGEawJlLOftg4udhX4fW4cYO/B6aC7IXfHcpZz+eeEv79M2fUIR7wfS4JprIkx7BCaRJFOP1RwVERPEDn8jyXZ2WWXMAgbeSDJum7vnlKCT38c5Wruzner09yrBYw397cimkv2to0XrudOYpS9//tYDuQlSszaYYc/en8g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777366360; c=relaxed/simple; bh=EwDlAeox+pLWJIfRBalnhzrey1T0agG3+31xvcpS+7k=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=tXaFqwkYkH2cItr6seYW2BEBeSlf90fVwxUUdUp11+DjsBLiFpfv5vfyOtBr3aLITnO29mR5W8NwoQCJBfF91F9t6i0o0iv1SGnmUjARmOWbygtO9UcQpAM/mwxtxecYoLQlDyoA4cPBCKvNq9pNxgfuYl7noBu/3e8mMdNGFRk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=bytedance.com; spf=pass smtp.mailfrom=bytedance.com; dkim=pass (2048-bit key) header.d=bytedance.com header.i=@bytedance.com header.b=CNxU1nz3; arc=none smtp.client-ip=209.85.216.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=bytedance.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bytedance.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bytedance.com header.i=@bytedance.com header.b="CNxU1nz3" Received: by mail-pj1-f47.google.com with SMTP id 98e67ed59e1d1-35d95017a68so7481125a91.3 for ; Tue, 28 Apr 2026 01:52:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bytedance.com; s=google; t=1777366358; x=1777971158; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=jiF95cax3V5L6nJjgrGO2oz2uPDfmL3HpmR2wC0cXHA=; b=CNxU1nz30MdSvXPHnj0FL6b1umN2/9BtKT7nZ4qUlCiw1n9YNcjAoTwQib3ke+5mlI vRznevTeBP8AeNxrW4AJljrkCNh1AeAxt6ulU7HN2pFYEG9sY8sHFTT8bRbeSmrkrhVA 37hCm3kgMpIvVjlX7MKFYCE2ftrv0ebDKTj364p2fsKBpPsF4zA0ftam4QkEvzQ+nZOM sZ+3/ZZ/WL13hIWP4yRyiz+0pRchGoxYto8on+cfYnVtWicf+U1+UwfdMuLxzAGwM4zD V3sGUV6D7YP/XAfsOBIL/Mke5fyfkdaVLD78VmCkMTzJBk2wuugrpntya4Za3XObZ7Ah HAzQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777366358; x=1777971158; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=jiF95cax3V5L6nJjgrGO2oz2uPDfmL3HpmR2wC0cXHA=; b=S3uRldiywQY/sRMX4++EOSvkfjo8zuuw0GcSFCrjnnMiqstcVM85WahjyS6EYdnJfM r5IK0bUP5C9ZDXI29mKOT/LD5HeHIKp292gcmme6t/+SsssFOb0Z9x8V0Ld4FCiEaaW7 Fdx+sn95tyUJHhKqnbux7m7yhu4KKLYnGum6rkv5Rzd5C+NfxOAgU/RkSR9KATstN6/Z 6TKXty/N4aS9xBkh0Wp289tCoR5xPmMMuA12Ay5bZOZvT/s/ArAnwYfiV2UAbN4HIh3P ioG/dKTgt3hwauCMUaLzjj+3leU9DOoGjon2yiTvzrbrSATyM82BXVnRi5aN/itHEQz0 RUhg== X-Forwarded-Encrypted: i=1; AFNElJ/h9z+orMWO4pMEBWImDIbC1/JKcFPFRRNfeHf0UNSwnwN2YQy5LrF/FUy3AeWDK75FZLL/QXB7ehHhpGs=@vger.kernel.org X-Gm-Message-State: AOJu0Yxj6kujQPBwm3tng4ZZo6FTZtAlIcwOaQPvSSZ8f+01xzPKlITi 1ukMfEOvVJyA5fFK9I7u+Qv9LasCM9CUGTUfkswCpWW9N+eQMmcRihxprglbH86UhFc= X-Gm-Gg: AeBDies3lCuGHTukMDA7azuHCbA4y5MGacqu1gU/dCap3nMsQnuXWCT1ee05ZhvogPO sYJ2BCHHqnP4Y7YJWBoch1eBzvwV16zpfMb6Mf7+mlfPzzUoML0US5D/gIBB7YEtj0qGlRPkHfW m6aWoxHXbh35xTFUJIL6mzHrgVKDUD8DzvGHB/Qpm+t4t6SAsuXPhjmeaB+ZngUiDK+rUAV00Jf OMX5DJI31j5QmLfUCdI8/hEoyRSjJe6gpvB/WyYd/AeL/ts4DVrowQc/xZwSsSHTYt+EqyqmiGa v/+GQ1HzVTu26GpGBFl1JeqzcTHL5QlBaA3LTf34XWn20tn1L7x7dDw3yoDJKq+5piKAzE7MS25 Y5SzkQcNxMVAGf0ff/ySRrY4S4pEnVolLqhGIXR8mp8BmPARdus2F7ZV3aawuCQPCxU9R8YtUqp oxKXL4QbAi+kyDoaQSoHGDqp6EEtahH+58Zsv3rhO/3o0guxHa8wA8IAI= X-Received: by 2002:a17:90b:554d:b0:35d:a380:6d1a with SMTP id 98e67ed59e1d1-36491f89850mr2386051a91.2.1777366358483; Tue, 28 Apr 2026 01:52:38 -0700 (PDT) Received: from n232-176-004.byted.org ([36.110.163.103]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-364902e7debsm2889080a91.15.2026.04.28.01.52.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 28 Apr 2026 01:52:38 -0700 (PDT) From: Muchun Song To: David Hildenbrand , Oscar Salvador , Greg Kroah-Hartman , "Rafael J . Wysocki" , Danilo Krummrich , Andrew Morton Cc: Vishal Verma , Ying Huang , Dan Williams , Miaohe Lin , Naoya Horiguchi , linux-mm@kvack.org, linux-cxl@vger.kernel.org, driver-core@lists.linux.dev, linux-kernel@vger.kernel.org, Muchun Song , stable@vger.kernel.org, muchun.song@linux.dev Subject: [PATCH v2 2/3] drivers/base/memory: fix memory block reference leak in poison accounting Date: Tue, 28 Apr 2026 16:52:18 +0800 Message-Id: <20260428085219.1316047-3-songmuchun@bytedance.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20260428085219.1316047-1-songmuchun@bytedance.com> References: <20260428085219.1316047-1-songmuchun@bytedance.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" memblk_nr_poison_inc() and memblk_nr_poison_sub() look up a memory block via find_memory_block_by_id(), which acquires a reference to the memory block device. Both helpers use the returned memory block without dropping that reference, leaking the device reference on each successful lookup. Drop the reference after updating nr_hwpoison. Fixes: 5033091de814 ("mm/hwpoison: introduce per-memory_block hwpoison coun= ter") Cc: stable@vger.kernel.org Signed-off-by: Muchun Song Reviewed-by: Miaohe Lin Acked-by: David Hildenbrand (Arm) Acked-by: Oscar Salvador --- v1->v2: - Add Reviewed-by from Miaohe. - Add device_hotplug_lock in the next patch. --- drivers/base/memory.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/base/memory.c b/drivers/base/memory.c index f806a683b767..6981b55d582a 100644 --- a/drivers/base/memory.c +++ b/drivers/base/memory.c @@ -1230,8 +1230,10 @@ void memblk_nr_poison_inc(unsigned long pfn) const unsigned long block_id =3D pfn_to_block_id(pfn); struct memory_block *mem =3D find_memory_block_by_id(block_id); =20 - if (mem) + if (mem) { atomic_long_inc(&mem->nr_hwpoison); + put_device(&mem->dev); + } } =20 void memblk_nr_poison_sub(unsigned long pfn, long i) @@ -1239,8 +1241,10 @@ void memblk_nr_poison_sub(unsigned long pfn, long i) const unsigned long block_id =3D pfn_to_block_id(pfn); struct memory_block *mem =3D find_memory_block_by_id(block_id); =20 - if (mem) + if (mem) { atomic_long_sub(i, &mem->nr_hwpoison); + put_device(&mem->dev); + } } =20 static unsigned long memblk_nr_poison(struct memory_block *mem) --=20 2.20.1 From nobody Wed Jun 17 04:20:18 2026 Received: from mail-pj1-f45.google.com (mail-pj1-f45.google.com [209.85.216.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 977593D75D1 for ; Tue, 28 Apr 2026 08:52:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.45 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777366366; cv=none; b=YXimFyc3d/DaEa+6UsnCIrtNEVM9hXCptBTDSjIA5wGDCsEBFVN29GWdRr+Hiz/xElML8+4S32DMZEgiX8/buttiSw3TnEgzxfhpjbNq8r8KrZeFHmP/ekd87Tp4El6lkK1pXv/KcyUEmYd0XuLsEdvEPQhbLdV5JKwJWgVSeUo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777366366; c=relaxed/simple; bh=iuwtwcgHq3raBwyHyUBxeAqB9w0cY8KY67dh1gll2ME=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=ruzJnb3g5gwgdnpkAXiP6c5WckFuAUQPN2Xjt2QMBBra0PL6ZI4X6ApQoXhz7fEDc/Fb+6sJYh+bXT+cgYgZnK8IAlBNNq0JN5XlKs1bBCrb0QsgXvDVZMK8ybiS5QxU2sQePwCcsCaZ79X2p6InWRrC3el8MDa744gqwWGgEQQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=bytedance.com; spf=pass smtp.mailfrom=bytedance.com; dkim=pass (2048-bit key) header.d=bytedance.com header.i=@bytedance.com header.b=kOByzhFP; arc=none smtp.client-ip=209.85.216.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=bytedance.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=bytedance.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=bytedance.com header.i=@bytedance.com header.b="kOByzhFP" Received: by mail-pj1-f45.google.com with SMTP id 98e67ed59e1d1-362e50b4641so2881779a91.0 for ; Tue, 28 Apr 2026 01:52:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bytedance.com; s=google; t=1777366364; x=1777971164; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=MSJ/Zlq/U4yHk19v3uYTHivwFzozYncFCgI5ZpuZJfE=; b=kOByzhFPX/q1ULrXheyyTe7xYjJI+jpR9TPJv4TMg687wAWdTx853MgeLdJkK2cepa w6v5svS+337LAiuHfSX133NZT/IICOxTPT5yBGtiIZHiP/wIizRBsjIg+cTXfDgI5EtH SIPlSAyudZFGxzQ4LunKSQicp9E3st/EOcXYE5Q/hb3+EEmgrCUd/6rn2/+m/NoNtqs7 45tQo84VlxTDdUOyhVYsv8vogD6yc3w78eiuR6dn8KI4JdiYaFHz/bed9APCsuPu3xeg DDHiQeEe0vg7VoW+n9dl6h0rcydF8s5iMW3UA6C89gLLb9x05jZSyS3jjM72KKOMPENO AGuw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777366364; x=1777971164; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=MSJ/Zlq/U4yHk19v3uYTHivwFzozYncFCgI5ZpuZJfE=; b=U9IDGlhedtnnyk8bxacy+OfcvWyfeg6fmHYT1JbLbKSVz3okb0BmPwiQYIF2rj4Ds0 m2frRPtOIkvh612+cl/y90StC8XcUD2jCRKJdMFxcljvzYitUbjwJ+Svu9Bb22fb4iv7 H7Fhax/hkxpF/MPNwoOBhFLep68SN12A1PcA+VcAXZ8yAj2YlxGqf4CGxTS69BPypOK4 jGfZs+7bTR7xk1BXu+cVMm8MDIauHlv5zIdQZunDkG9k4hW2l4PtP90oQSJv6y9V40kg yGoTjSJCyslsWBV3jo9D1S40JoW0ksYeA0wZOqRKC1IyHbfAc4yhMNjZ0eRf0FzXxemk k8Cw== X-Forwarded-Encrypted: i=1; AFNElJ/hiWtmZ6K2WGyd3QA7Ib+PuK9CpilODop7byxtZNeL/NPWT0jO9MGuNJo6BVAfzR+5eYtUfCE90bTovYc=@vger.kernel.org X-Gm-Message-State: AOJu0Yx3zSfuuJjZY8oQZFTeHRSE7vKDlKJ5g+xBTS5cqYkTHhdCNdXN FyNBNbASFltQE/HwZ+VS25x/lUDQXtEHc0zysJB9IDsQMJvIOXPag93jkSbjX9e/y6c= X-Gm-Gg: AeBDiesWI7LmABFskhOizMGGBWRWohLIDNthret33oeHEXJ2whWUFEUtkFodxEcF+8V JjoQd202/C51y9WW80WdMq+VG+Qbz4VbJ1PSngOazD+2i+3ioQuezwGtD86VYUu0j1wzlw3plxs gbR/m3Vcv/esGB1nCS3hCXzhmSa1VnRgSG6jKxjPb7q3N1n9P8MGDiZqUu61jOjv01NiOulAwZV QOCKEioE+CMXZWgd5R9xjRNojBjl1ZrtAxUwRpPAR4DcPpwkeS8asOFyRd8GsE9OBW4a0VauJ0V GDGqd5mEYVuTZYVNXxKWRd/eUBfVVPURypjt6kE9S2i9WATO2GElzW1vet9RC07XelilLLeIZxa dbgOUHkQ4IIKLaPSuA3ZCzPZwhzYOaCy2+stDyYY6B1HuFvlnllsOT0ewCMZjay5qoc4iXPOgbb FTU/NxbYwcVE2E+q1cVgbiXsDj+ElW7fZKeGvVKWCKiSf3DfcduPbaSJk= X-Received: by 2002:a17:90a:fc4d:b0:35b:e4f8:7cc5 with SMTP id 98e67ed59e1d1-36492068746mr2311671a91.25.1777366363725; Tue, 28 Apr 2026 01:52:43 -0700 (PDT) Received: from n232-176-004.byted.org ([36.110.163.103]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-364902e7debsm2889080a91.15.2026.04.28.01.52.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 28 Apr 2026 01:52:43 -0700 (PDT) From: Muchun Song To: David Hildenbrand , Oscar Salvador , Greg Kroah-Hartman , "Rafael J . Wysocki" , Danilo Krummrich , Andrew Morton Cc: Vishal Verma , Ying Huang , Dan Williams , Miaohe Lin , Naoya Horiguchi , linux-mm@kvack.org, linux-cxl@vger.kernel.org, driver-core@lists.linux.dev, linux-kernel@vger.kernel.org, Muchun Song , stable@vger.kernel.org, muchun.song@linux.dev Subject: [PATCH v2 3/3] drivers/base/memory: fix locking for poison accounting lookup Date: Tue, 28 Apr 2026 16:52:19 +0800 Message-Id: <20260428085219.1316047-4-songmuchun@bytedance.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20260428085219.1316047-1-songmuchun@bytedance.com> References: <20260428085219.1316047-1-songmuchun@bytedance.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" memblk_nr_poison_inc() and memblk_nr_poison_sub() call find_memory_block_by_id(), which requires device_hotplug_lock to serialize the xarray lookup against memory block removal. Take device_hotplug_lock around the lookup and nr_hwpoison update so the memory block cannot disappear between xa_load() and get_device(). Fixes: 5033091de814 ("mm/hwpoison: introduce per-memory_block hwpoison coun= ter") Cc: stable@vger.kernel.org Signed-off-by: Muchun Song Acked-by: Oscar Salvador --- drivers/base/memory.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/base/memory.c b/drivers/base/memory.c index 6981b55d582a..f76aee29e9a5 100644 --- a/drivers/base/memory.c +++ b/drivers/base/memory.c @@ -1228,23 +1228,29 @@ int walk_dynamic_memory_groups(int nid, walk_memory= _groups_func_t func, void memblk_nr_poison_inc(unsigned long pfn) { const unsigned long block_id =3D pfn_to_block_id(pfn); - struct memory_block *mem =3D find_memory_block_by_id(block_id); + struct memory_block *mem; =20 + lock_device_hotplug(); + mem =3D find_memory_block_by_id(block_id); if (mem) { atomic_long_inc(&mem->nr_hwpoison); put_device(&mem->dev); } + unlock_device_hotplug(); } =20 void memblk_nr_poison_sub(unsigned long pfn, long i) { const unsigned long block_id =3D pfn_to_block_id(pfn); - struct memory_block *mem =3D find_memory_block_by_id(block_id); + struct memory_block *mem; =20 + lock_device_hotplug(); + mem =3D find_memory_block_by_id(block_id); if (mem) { atomic_long_sub(i, &mem->nr_hwpoison); put_device(&mem->dev); } + unlock_device_hotplug(); } =20 static unsigned long memblk_nr_poison(struct memory_block *mem) --=20 2.20.1