[PATCH] mm/memblock: fix off-by-one page leak in reserve_mem_release_by_name()

[PATCH] mm/memblock: fix off-by-one page leak in reserve_mem_release_by_name()

[DaeMyung Kang]

free_reserved_area() treats its 'end' argument as exclusive: it aligns
end down via 'end & PAGE_MASK' and iterates with 'pos < end'.

reserve_mem_release_by_name() instead passes 'start + map->size - 1',
which causes the last page of a page-aligned reservation to never be
freed. For a reservation spanning N pages, only N - 1 pages are
released back to the allocator.

Fix it by passing the exclusive end address, 'start + map->size'.

Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
---
 mm/memblock.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/memblock.c b/mm/memblock.c
index b3ddfdec7a80..d4a02f1750e9 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -2434,7 +2434,7 @@ int reserve_mem_release_by_name(const char *name)
 		return 0;
 
 	start = phys_to_virt(map->start);
-	end = start + map->size - 1;
+	end = start + map->size;
 	snprintf(buf, sizeof(buf), "reserve_mem:%s", name);
 	free_reserved_area(start, end, 0, buf);
 	map->size = 0;
-- 
2.43.0

Re: [PATCH] mm/memblock: fix off-by-one page leak in reserve_mem_release_by_name()

[Donet Tom]

Hi

On 4/14/26 3:14 PM, DaeMyung Kang wrote:
> free_reserved_area() treats its 'end' argument as exclusive: it aligns
> end down via 'end & PAGE_MASK' and iterates with 'pos < end'.
>
> reserve_mem_release_by_name() instead passes 'start + map->size - 1',
> which causes the last page of a page-aligned reservation to never be
> freed. For a reservation spanning N pages, only N - 1 pages are
> released back to the allocator.
>
> Fix it by passing the exclusive end address, 'start + map->size'.
>
> Signed-off-by: DaeMyung Kang <charsyam@gmail.com>


Do we need a fixes tag?

-Donet

> ---
>   mm/memblock.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/mm/memblock.c b/mm/memblock.c
> index b3ddfdec7a80..d4a02f1750e9 100644
> --- a/mm/memblock.c
> +++ b/mm/memblock.c
> @@ -2434,7 +2434,7 @@ int reserve_mem_release_by_name(const char *name)
>   		return 0;
>   
>   	start = phys_to_virt(map->start);
> -	end = start + map->size - 1;
> +	end = start + map->size;
>   	snprintf(buf, sizeof(buf), "reserve_mem:%s", name);
>   	free_reserved_area(start, end, 0, buf);
>   	map->size = 0;

[PATCH v2] mm/memblock: fix off-by-one page leak in reserve_mem_release_by_name()

[DaeMyung Kang]

free_reserved_area() treats its 'end' argument as exclusive: it aligns
end down via 'end & PAGE_MASK' and iterates with 'pos < end'.

reserve_mem_release_by_name() instead passes 'start + map->size - 1',
which causes the last page of a page-aligned reservation to never be
freed. For a reservation spanning N pages, only N - 1 pages are
released back to the allocator.

Fix it by passing the exclusive end address, 'start + map->size'.

Fixes: 74e2498ccf7b ("mm/memblock: Add reserved memory release function")
Cc: stable@vger.kernel.org
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
---
Changes in v2:
 - Add Fixes: tag and Cc: stable (per Donet Tom's review).
 - v1: https://lore.kernel.org/lkml/

 mm/memblock.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/memblock.c b/mm/memblock.c
index b3ddfdec7a80..d4a02f1750e9 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -2434,7 +2434,7 @@ int reserve_mem_release_by_name(const char *name)
 		return 0;
 
 	start = phys_to_virt(map->start);
-	end = start + map->size - 1;
+	end = start + map->size;
 	snprintf(buf, sizeof(buf), "reserve_mem:%s", name);
 	free_reserved_area(start, end, 0, buf);
 	map->size = 0;
-- 
2.43.0

Re: [PATCH v2] mm/memblock: fix off-by-one page leak in reserve_mem_release_by_name()

[Donet Tom]

Hi

On 4/14/26 4:13 PM, DaeMyung Kang wrote:
> free_reserved_area() treats its 'end' argument as exclusive: it aligns
> end down via 'end & PAGE_MASK' and iterates with 'pos < end'.
>
> reserve_mem_release_by_name() instead passes 'start + map->size - 1',
> which causes the last page of a page-aligned reservation to never be
> freed. For a reservation spanning N pages, only N - 1 pages are
> released back to the allocator.
>
> Fix it by passing the exclusive end address, 'start + map->size'.
>
> Fixes: 74e2498ccf7b ("mm/memblock: Add reserved memory release function")
> Cc: stable@vger.kernel.org
> Signed-off-by: DaeMyung Kang <charsyam@gmail.com>


I think it might be better to send v2 as a separate patch  rather than 
as a reply to the previous version.

This patch looks good to me.

Reviewed-by: Donet Tom donettom@linux.ibm.com

-Donet


> ---
> Changes in v2:
>   - Add Fixes: tag and Cc: stable (per Donet Tom's review).
>   - v1: https://lore.kernel.org/lkml/
>
>   mm/memblock.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/mm/memblock.c b/mm/memblock.c
> index b3ddfdec7a80..d4a02f1750e9 100644
> --- a/mm/memblock.c
> +++ b/mm/memblock.c
> @@ -2434,7 +2434,7 @@ int reserve_mem_release_by_name(const char *name)
>   		return 0;
>   
>   	start = phys_to_virt(map->start);
> -	end = start + map->size - 1;
> +	end = start + map->size;
>   	snprintf(buf, sizeof(buf), "reserve_mem:%s", name);
>   	free_reserved_area(start, end, 0, buf);
>   	map->size = 0;

Re: [PATCH v2] mm/memblock: fix off-by-one page leak in reserve_mem_release_by_name()

[CharSyam]

[-- Attachment #1: Type: text/plain, Size: 2031 bytes --]

  Please disregard this patch -- I just noticed the same fix is already
  in linux-next as commit c12c3e150780 ("memblock: reserve_mem: fix end
  caclulation in reserve_mem_release_by_name()") by Mike Rapoport.

  Sorry for the noise.

  Thanks,
  DaeMyung

2026년 4월 14일 (화) 오후 8:13, Donet Tom <donettom@linux.ibm.com>님이 작성:

> Hi
>
> On 4/14/26 4:13 PM, DaeMyung Kang wrote:
> > free_reserved_area() treats its 'end' argument as exclusive: it aligns
> > end down via 'end & PAGE_MASK' and iterates with 'pos < end'.
> >
> > reserve_mem_release_by_name() instead passes 'start + map->size - 1',
> > which causes the last page of a page-aligned reservation to never be
> > freed. For a reservation spanning N pages, only N - 1 pages are
> > released back to the allocator.
> >
> > Fix it by passing the exclusive end address, 'start + map->size'.
> >
> > Fixes: 74e2498ccf7b ("mm/memblock: Add reserved memory release function")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
>
>
> I think it might be better to send v2 as a separate patch  rather than
> as a reply to the previous version.
>
> This patch looks good to me.
>
> Reviewed-by: Donet Tom donettom@linux.ibm.com
>
> -Donet
>
>
> > ---
> > Changes in v2:
> >   - Add Fixes: tag and Cc: stable (per Donet Tom's review).
> >   - v1: https://lore.kernel.org/lkml/
> >
> >   mm/memblock.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/mm/memblock.c b/mm/memblock.c
> > index b3ddfdec7a80..d4a02f1750e9 100644
> > --- a/mm/memblock.c
> > +++ b/mm/memblock.c
> > @@ -2434,7 +2434,7 @@ int reserve_mem_release_by_name(const char *name)
> >               return 0;
> >
> >       start = phys_to_virt(map->start);
> > -     end = start + map->size - 1;
> > +     end = start + map->size;
> >       snprintf(buf, sizeof(buf), "reserve_mem:%s", name);
> >       free_reserved_area(start, end, 0, buf);
> >       map->size = 0;
>

[-- Attachment #2: Type: text/html, Size: 2980 bytes --]

[PATCH v2] mm/memblock: fix off-by-one page leak in reserve_mem_release_by_name()

[DaeMyung Kang]

free_reserved_area() treats its 'end' argument as exclusive: it aligns
end down via 'end & PAGE_MASK' and iterates with 'pos < end'.

reserve_mem_release_by_name() instead passes 'start + map->size - 1',
which causes the last page of a page-aligned reservation to never be
freed. For a reservation spanning N pages, only N - 1 pages are
released back to the allocator.

Fix it by passing the exclusive end address, 'start + map->size'.

Fixes: 74e2498ccf7b ("mm/memblock: Add reserved memory release function")
Cc: stable@vger.kernel.org
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
---
Changes in v2:
 - Add Fixes: tag and Cc: stable (per Donet Tom's review).
 - v1: https://lore.kernel.org/lkml/

 mm/memblock.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/memblock.c b/mm/memblock.c
index b3ddfdec7a80..d4a02f1750e9 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -2434,7 +2434,7 @@ int reserve_mem_release_by_name(const char *name)
 		return 0;
 
 	start = phys_to_virt(map->start);
-	end = start + map->size - 1;
+	end = start + map->size;
 	snprintf(buf, sizeof(buf), "reserve_mem:%s", name);
 	free_reserved_area(start, end, 0, buf);
 	map->size = 0;
-- 
2.43.0