Re: [RFC PATCH v1 1/1] acpi/hmat: preserve hmat_adist_nb notifier block

On 7/9/26 02:37, Richard Cheng wrote:
> On Mon, Jul 06, 2026 at 07:57:09AM +0800, Alejandro Lucero Palau wrote:
>> On 7/2/26 08:20, Richard Cheng wrote:
>>> On Tue, Jun 30, 2026 at 03:35:07PM +0800, [email protected] wrote:
>>>> From: Alejandro Lucero <[email protected]>
>>>>
>>>> Remove __meminitdata from hmat_adist_nb declaration preserving it even
>>>> when CONFIG_MEMORY_HOTPLUG is not set. Otherwise further notifier
>>>> registrations using register_mt_adistance_algorithm() will find a
>>>> notifier chain likely corrupted. This is the case when a CXL Type2
>>>> driver will load after kernel initialization and a CXL region created from
>>>> its committed HDM decoders registers an mt_adistance_algorithm notifier.
>>>>
>>>> Signed-off-by: Alejandro Lucero <[email protected]>


<snip>


>>>>
>>>> Not sure what you mean here. The way I understand your comment leads to
>>>> contradictions ...
>>>>
>>>>
>>>> "keep unconditional removal" suggest to me unregistering hmat_adist_nb but
>>>> "keep" confuses me as it is not unregister now only memory released based on
>>>> __meminitdata ... but maybe you mean exactly what I did and avoid any change
>>>> to __meminitdata declaration based on a config attribute, what is what Dave
>>>> is suggesting to explore.
>>>>
>>>>
>>>> Please, could you clarify this?
>>>>
> Sorry for the ambiguity, and yes, the last reading is what I meant.
> I mean your patch's removal of the "__meminitdata", not unregistering
> the notifier.
> I think it would be better not to replace it with a conditional macro.
>
> To be more clear about what I understand,
> 1. with MEMORY_HOTPLUG=n, "__meminitdata == __initdata", so hmat_adist_nb
>     lives in ".init.data"
> 2. hmat_init() registers it, the mt_adistance_algorithms chain will hold a pointer to it, nothing ever unregister it.
> 3. When boot finishes, free_initmem() discards all ".init.data". The chain still points at that freed memory.
> 4. Any later register_mt_adistance_algorithm() call walks the chain and deref that stale pointer , causing use-after-free
>
> Note that, register_mt_adistance_algorithm() is an exported API, so any module
> loaded at runtime can trigger it, not only CXL. Dropping __meminitdata
> unconditionally closes the use-after-free for all caller, and the cost is just
> one notifier_block staying resident.
>
> Hope this clarify my point.


Hi Richard,


Yes, this is clear now.


I will send a v2 adding the Fixes tag and your point about the problem 
not limited to MEMORY_HOTPLUG config.


Thanks!