Re: [PATCH v2] mm/memblock: fix off-by-one page leak in reserve_mem_release_by_name()

[CharSyam <charsyam@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 2031 bytes --]

  Please disregard this patch -- I just noticed the same fix is already
  in linux-next as commit c12c3e150780 ("memblock: reserve_mem: fix end
  caclulation in reserve_mem_release_by_name()") by Mike Rapoport.

  Sorry for the noise.

  Thanks,
  DaeMyung

2026년 4월 14일 (화) 오후 8:13, Donet Tom <donettom@linux.ibm.com>님이 작성:

> Hi
>
> On 4/14/26 4:13 PM, DaeMyung Kang wrote:
> > free_reserved_area() treats its 'end' argument as exclusive: it aligns
> > end down via 'end & PAGE_MASK' and iterates with 'pos < end'.
> >
> > reserve_mem_release_by_name() instead passes 'start + map->size - 1',
> > which causes the last page of a page-aligned reservation to never be
> > freed. For a reservation spanning N pages, only N - 1 pages are
> > released back to the allocator.
> >
> > Fix it by passing the exclusive end address, 'start + map->size'.
> >
> > Fixes: 74e2498ccf7b ("mm/memblock: Add reserved memory release function")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
>
>
> I think it might be better to send v2 as a separate patch  rather than
> as a reply to the previous version.
>
> This patch looks good to me.
>
> Reviewed-by: Donet Tom donettom@linux.ibm.com
>
> -Donet
>
>
> > ---
> > Changes in v2:
> >   - Add Fixes: tag and Cc: stable (per Donet Tom's review).
> >   - v1: https://lore.kernel.org/lkml/
> >
> >   mm/memblock.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/mm/memblock.c b/mm/memblock.c
> > index b3ddfdec7a80..d4a02f1750e9 100644
> > --- a/mm/memblock.c
> > +++ b/mm/memblock.c
> > @@ -2434,7 +2434,7 @@ int reserve_mem_release_by_name(const char *name)
> >               return 0;
> >
> >       start = phys_to_virt(map->start);
> > -     end = start + map->size - 1;
> > +     end = start + map->size;
> >       snprintf(buf, sizeof(buf), "reserve_mem:%s", name);
> >       free_reserved_area(start, end, 0, buf);
> >       map->size = 0;
>

[-- Attachment #2: Type: text/html, Size: 2980 bytes --]