Re: [rppt:free-late/v0.3] [memblock, treewide] bbe3478393: KASAN:use-after-free_in_memblock_isolate_range

hi, Mike,

On Fri, Mar 20, 2026 at 03:32:45PM +0200, Mike Rapoport wrote:
> Hello,
> 
> On Fri, Mar 20, 2026 at 03:53:54PM +0800, kernel test robot wrote:
> > 
> > Hello,
> > 
> > kernel test robot noticed "KASAN:use-after-free_in_memblock_isolate_range" on:
> > 
> > commit: bbe3478393e135e2fc98f32fa8ab182de6742136 ("memblock, treewide: make memblock_free() handle late freeing")
> > https://git.kernel.org/cgit/linux/kernel/git/rppt/linux.git free-late/v0.3
> > 
> > in testcase: ltp
> > version: 
> > with following parameters:
> > 
> > 	test: uevent
> > 
> > 
> > config: x86_64-rhel-9.4-ltp
> > compiler: gcc-14
> > test machine: 22 threads 1 sockets Intel(R) Core(TM) Ultra 9 185H @ 4.5GHz (Meteor Lake) with 32G memory
> > 
> > (please refer to attached dmesg/kmsg for entire log/backtrace)
> > 
> > 
> > If you fix the issue in a separate patch/commit (i.e. not just a new version of
> > the same patch/commit), kindly add following tags
> > | Reported-by: kernel test robot <[email protected]>
> > | Closes: https://lore.kernel.org/oe-lkp/[email protected]
> 
> Thanks for the report!
> 
> The patch below fixes the issue for me, I'd appreciate if you can verify it
> on your setup as well:

yes, below patch can fix the issue we reported by same test. thanks

Tested-by: kernel test robot <[email protected]>

> 
> 
> diff --git a/mm/memblock.c b/mm/memblock.c
> index 780e70d4971a..3e21d6135789 100644
> --- a/mm/memblock.c
> +++ b/mm/memblock.c
> @@ -985,15 +985,18 @@ void __init_memblock memblock_free(void *ptr, size_t size)
>  int __init_memblock memblock_phys_free(phys_addr_t base, phys_addr_t size)
>  {
>  	phys_addr_t end = base + size - 1;
> +	int ret;
>  
>  	memblock_dbg("%s: [%pa-%pa] %pS\n", __func__,
>  		     &base, &end, (void *)_RET_IP_);
>  
>  	kmemleak_free_part_phys(base, size);
> +	ret = memblock_remove_range(&memblock.reserved, base, size);
> +
>  	if (slab_is_available())
>  		__free_reserved_area(base, base + size, -1);
>  
> -	return memblock_remove_range(&memblock.reserved, base, size);
> +	return ret;
>  }
>  
>  int __init_memblock __memblock_reserve(phys_addr_t base, phys_addr_t size,
> 
> -- 
> Sincerely yours,
> Mike.
>