On 4/28/2026 11:18 AM, Muchun Song wrote:
> In create_altmaps_and_memory_blocks(), when arch_add_memory() succeeds
> with memmap_on_memory enabled, the vmemmap pages are allocated from
> params.altmap. If create_memory_block_devices() subsequently fails, the
> error path calls arch_remove_memory() with a NULL altmap instead of
> params.altmap.
>
> This is a bug that could lead to memory corruption. Since altmap is
> NULL, vmemmap_free() falls back to freeing the vmemmap pages into the
> system buddy allocator via free_pages() instead of the altmap.
> arch_remove_memory() then immediately destroys the physical linear
> mapping for this memory. This injects unowned pages into the buddy
> allocator, causing machine checks or memory corruption if the system
> later attempts to allocate and use those freed pages.
>
> Fix this by passing params.altmap to arch_remove_memory() in the error
> path.
>
> Fixes: 6b8f0798b85a ("mm/memory_hotplug: split memmap_on_memory requests
> across memblocks")
> Cc: [email protected]
> Signed-off-by: Muchun Song <[email protected]>
> Acked-by: David Hildenbrand (Arm) <[email protected]>
Reviewed-by: Georgi Djakov <[email protected]>
> ---
> mm/memory_hotplug.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
> index 4426abb05655..e3352284f635 100644
> --- a/mm/memory_hotplug.c
> +++ b/mm/memory_hotplug.c
> @@ -1469,7 +1469,7 @@ static int create_altmaps_and_memory_blocks(int nid,
> struct memory_group *group,
> ret = create_memory_block_devices(cur_start, memblock_size, nid,
> params.altmap, group);
> if (ret) {
> - arch_remove_memory(cur_start, memblock_size, NULL);
> + arch_remove_memory(cur_start, memblock_size,
> params.altmap);
> kfree(params.altmap);
> goto out;
> }
