[PATCH] arm64: mm: Fix pfn_is_map_memory() misreporting mapped memory

[Mike Rapoport]

On Wed, Sep 16, 2026 at 12:13:21PM +0200, Ard Biesheuvel wrote:
> (cc Mike)
> 
> On Tue, 8 Sep 2026, at 18:20, Vladimir Murzin wrote:
> > Commit 7ace06a01efa ("arm64: mm: fix accidental linear mapping of
> > no-map reserved memory") removed sub-page no-map regions from the
> > linear mapping. However, pfn_is_map_memory() can still report that
> > such a region is mapped.
> >
> > For instance, with 64K pages, say we have
> >
> > normal:        ...–0xa2007fff
> > no-map: 0xa2008000–0xa200ffff
> > normal: 0xa2010000–...
> >
> > The range 0xa2000000–0xa200ffff is not linearly mapped, but
> > pfn_is_map_memory(__phys_to_pfn(0xa2008000)) aligns the address to
> > page granularity and passes 0xa2000000 to memblock_is_map_memory().
> > That address belongs to the preceding normal memblock region, so the
> > no-map region is ignored and the function returns true.
> >
> > Fix that by checking if entire page is subset of memory block.
> >
> > Fixes: 7ace06a01efa ("arm64: mm: fix accidental linear mapping of 
> > no-map reserved memory")
> > Assisted-by: LLM
> > Signed-off-by: Vladimir Murzin <vladimir.murzin at arm.com>
> > ---
> >  arch/arm64/mm/init.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
> > index fbf215ecc7d0..5da80e1e1727 100644
> > --- a/arch/arm64/mm/init.c
> > +++ b/arch/arm64/mm/init.c
> > @@ -172,7 +172,8 @@ int pfn_is_map_memory(unsigned long pfn)
> >  	if (PHYS_PFN(addr) != pfn)
> >  		return 0;
> > 
> > -	return memblock_is_map_memory(addr);
> > +	return memblock_is_region_memory(addr, PAGE_SIZE) &&
> > +		memblock_is_map_memory(addr);
> >  }
> >  EXPORT_SYMBOL(pfn_is_map_memory);
> > 
> 
> memblock_is_region_memory() only tells you whether the range in
> question is covered by a single entry in memblock.memory.regions[].
> 
> memblock has other flags, which may or may not be set on sub-page
> regions too. So I don't think this is the right solution in the
> general case, even if it fixes your example.
> 
> Given that the no-map attribute fundamentally only applies to page
> granular regions, it would make sense to round those outwards
> whenever they are created.
> 
> --- a/mm/memblock.c
> +++ b/mm/memblock.c
> @@ -1119,6 +1119,10 @@
>  int __init_memblock memblock_mark_nomap(phys_addr_t base, phys_addr_t size)
>  {
> +       phys_addr_t end = PAGE_ALIGN(base + size);
> +
> +       base &= PAGE_MASK;
> +       size = end - base;
>         return memblock_setclr_flag(&memblock.memory, base, size, 1, MEMBLOCK_NOMAP);
>  }

Makes sense to me, just lacks kernel-doc update ;-)

> Note that I recently removed the frivolous use of MEMBLOCK_NOMAP in
> __map_mem() so the remaining calls should mostly be true reservations
> originating from the boot environment.

There is still riscv :)

-- 
Sincerely yours,
Mike.