[PATCH 44/46] mm/cma: don't release CMA pages still in use

[Muchun Song]

> On Oct 27, 2026, at 07:18, David Hildenbrand (Arm) <david at kernel.org> wrote:
> 
> From: Rik van Riel <riel at surriel.com>
> 
> When a driver calls dma_free_contiguous() before quiescing DMA, the
> page might still have a reference from the device.
> put_page_testzero() there returns false, WARN fires, but the code proceeds
> to free_contig_frozen_range() putting a live page onto buddy and clearing
> the bitmap. A subsequent allocation can hand the same PFN to a new
> owner while the original holder still references it.
> 
> A concurrent put_page() that drops the last reference between the
> testzero loop and free_contig_frozen_range() can double-queue the page
> via page->lru, corrupting buddy lists.
> 
> Avoid the corruption by not freeing a CMA region if any of the
> pages inside are still in use.
> 
> Make it explicit in the warning that the driver allowed a leak.
> 
> While at it, use page_ref_freeze() to make the semantics clearer and
> switch to pr_warn_ratelimited().
> 
> Fixes: 9bda131c6093 ("mm: cma: add cma_alloc_frozen{_compound}()")
> Cc: stable at vger.kernel.org
> Signed-off-by: Rik van Riel <riel at surriel.com>
> Link: https://patch.msgid.link/20260811132045.5f114772@fangorn
> [ david: use page_ref_freeze() + pr_warn_ratelimited() ]
> Signed-off-by: David Hildenbrand (Arm) <david at kernel.org>

Acked-by: Muchun Song <muchun.song at linux.dev>

Thanks