x86/mm: Fix freeing of PMD-sized vmemmap pages

Commit bf9e4e30f353 ("x86/mm: use pagetable_free()"), switched from
freeing non-boot page tables through __free_pages() to
pagetable_free().

However, the function is also called to free vmemmap pages.

Given that vmemmap pages are not page tables, already the page_ptdesc(page)
is wrong. But worse, pagetable_free() calls:

	__free_pages(page, compound_order(page));

Since vmemmap pages are not compound pages (see vmemmap_alloc_block())
-- except for HVO, which doesn't apply here -- only first page of a
PMD-sized vmemmap page is freed, leaking the other ones.

Fix it by properly decoupling pagetable and vmemmap freeing.
free_pagetable() no longer has to mess with SECTION_INFO, as only the
vmemmap is marked like that in register_page_bootmem_memmap().

The indentation in remove_pmd_table() is messed up. Fix that while
touching it.

Bootmem info handling will soon be fixed up. For now, handle it
similar to free_pagetable(), just avoiding the ifdef.

[ dhansen: changelog munging. More imperative voice ]

Fixes: bf9e4e30f353 ("x86/mm: use pagetable_free()")
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Tested-by: Lance Yang <lance.yang@linux.dev>
Link: https://lore.kernel.org/20260429-vmemmap-v2-1-8dfcacffd877@kernel.org
Link: https://patch.msgid.link/20260429-vmemmap-v2-1-8dfcacffd877@kernel.org
Cc: stable@vger.kernel.org

diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index df2261fa4f985b24422ca3d2bca5b82c621b51ce..7e20b22d658b9a09f6a85c5b0fe4fabde73ff6e3 100644 (file)
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -1014,7 +1014,7 @@ static void __meminit free_pagetable(struct page *page, int order)
 #ifdef CONFIG_HAVE_BOOTMEM_INFO_NODE
                enum bootmem_type type = bootmem_type(page);
 
-               if (type == SECTION_INFO || type == MIX_SECTION_INFO) {
+               if (type == MIX_SECTION_INFO) {
                        while (nr_pages--)
                                put_page_bootmem(page++);
                } else {
@@ -1028,13 +1028,24 @@ static void __meminit free_pagetable(struct page *page, int order)
        }
 }
 
-static void __meminit free_hugepage_table(struct page *page,
+static void __meminit free_vmemmap_pages(struct page *page, unsigned int order,
                struct vmem_altmap *altmap)
 {
-       if (altmap)
-               vmem_altmap_free(altmap, PMD_SIZE / PAGE_SIZE);
-       else
-               free_pagetable(page, get_order(PMD_SIZE));
+       unsigned long nr_pages = 1u << order;
+
+       if (altmap) {
+               vmem_altmap_free(altmap, nr_pages);
+       } else if (PageReserved(page)) {
+               if (IS_ENABLED(CONFIG_HAVE_BOOTMEM_INFO_NODE) &&
+                   bootmem_type(page) == SECTION_INFO) {
+                       while (nr_pages--)
+                               put_page_bootmem(page++);
+               } else {
+                       free_reserved_pages(page, nr_pages);
+               }
+       } else {
+               __free_pages(page, order);
+       }
 }
 
 static void __meminit free_pte_table(pte_t *pte_start, pmd_t *pmd)
@@ -1118,7 +1129,8 @@ remove_pte_table(pte_t *pte_start, unsigned long addr, unsigned long end,
                        return;
 
                if (!direct)
-                       free_pagetable(pte_page(*pte), 0);
+                       /* We never populate base pages from the altmap. */
+                       free_vmemmap_pages(pte_page(*pte), 0, NULL);
 
                spin_lock(&init_mm.page_table_lock);
                pte_clear(&init_mm, addr, pte);
@@ -1153,19 +1165,19 @@ remove_pmd_table(pmd_t *pmd_start, unsigned long addr, unsigned long end,
                        if (IS_ALIGNED(addr, PMD_SIZE) &&
                            IS_ALIGNED(next, PMD_SIZE)) {
                                if (!direct)
-                                       free_hugepage_table(pmd_page(*pmd),
-                                                           altmap);
+                                       free_vmemmap_pages(pmd_page(*pmd),
+                                                          PMD_ORDER, altmap);
 
                                spin_lock(&init_mm.page_table_lock);
                                pmd_clear(pmd);
                                spin_unlock(&init_mm.page_table_lock);
                                pages++;
                        } else if (vmemmap_pmd_is_unused(addr, next)) {
-                                       free_hugepage_table(pmd_page(*pmd),
-                                                           altmap);
-                                       spin_lock(&init_mm.page_table_lock);
-                                       pmd_clear(pmd);
-                                       spin_unlock(&init_mm.page_table_lock);
+                               free_vmemmap_pages(pmd_page(*pmd), PMD_ORDER,
+                                                  altmap);
+                               spin_lock(&init_mm.page_table_lock);
+                               pmd_clear(pmd);
+                               spin_unlock(&init_mm.page_table_lock);
                        }
                        continue;
                }