From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ot1-f52.google.com (mail-ot1-f52.google.com [209.85.210.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8C15333EB06 for ; Wed, 4 Mar 2026 15:25:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.52 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772637952; cv=none; b=afkC+uWgbs4/vVAPzRibJQgt8OP6H9qSNeziUiocZDsmj8big4k/R7MDAfqBr2okQFT0ulBcYkSJ86SqcedXDmrn2qqXEQg30kIaF734swq7BFl5Aww70CqymA8BeaNFxeYE0dzxBdfBrNmL//xnsfEBOFjqz+w0GMLrcT1Z6i8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772637952; c=relaxed/simple; bh=5fR+Tvo/P3TeIHLpYeLkSgC9aUN2dzjm+UYSOXGrhug=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DYVBuPVse1+Pzlkq8W6Karnwt49IY9Es86dFHrg1IlH8Mr9Wyn5NMCzpk0su2XtvB8s88lMbXnJlXnFB09PKmwrFMAQ1VDaEAVTrvrwTI6yfvvUIGGBwEvHeR+nZRBRlHL3RTbkO62nwjfaCBU9thSLI7NX1SrF3ta3ed/YKQUU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=mj2P4NRb; arc=none smtp.client-ip=209.85.210.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="mj2P4NRb" Received: by mail-ot1-f52.google.com with SMTP id 46e09a7af769-7d4b9c839b1so3627721a34.1 for ; Wed, 04 Mar 2026 07:25:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1772637949; x=1773242749; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=0dHp9bCxpQGcBk9L8T5sP4H/+YcADHb57HQaohzDaCM=; b=mj2P4NRbIwuWaX1Md7ZaJ/7Q3RmvovNo8QXcBGWffNByfnIeLexMi3Bw5h6Pj3mRKp iHr2W4ECIXm7ND94WXK080LZiX1ragmwFy6A8B8Ol1TV2dtJYcjgeNuBqI1ifLIqBd3I gGV4e5tn5jSR5NTvDaBg+8cukHiAtBhGyvje4yx4KpkPNwVRiXDn8id2/4HOCeqJLOL2 XJWEkhjy6TFI2uqQcF49bGyF5kloA+7u728YJ+EdgpatrTtWC2a325TmClKmGPpPQPnT k3h7MqCofjcrItrpTr6Fv1vqRgnoxim3dZff5yqh06mPZkFnGmde9Bjxpu6oESGN4Kyd 3vqA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772637949; x=1773242749; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=0dHp9bCxpQGcBk9L8T5sP4H/+YcADHb57HQaohzDaCM=; b=tIlj7x4+M69x7iH1g61rMjnV89heFeaVslBvZeOOiRDsB+llg+QmXFKYvnlvruetZC ooc/lj3+OsigSyXHftzXyqSPIop+5Nw3iVdrNuOoLehzuQBJOMBA9nzaIGxtkEy1im3b 3B3RJyG9l0YuopbLJ1g/bEIRF5yNiPfMYpo9z2IZ0KJ9zrmbZSQxr/c+0pJdqzDDqvW/ QinaFFLIJLB+elJHY9ISBxtucfuTWRPGgzMYTJG4jn6HP1e25/wagvob5ouv/8NRriUM 4Xc1DEpBJbLvIzFoRUTpmfQo1geOeb6Uomg8+n9z5E3ikr8qmAjsy4o0HqPMmWSDZZZQ q4QQ== X-Forwarded-Encrypted: i=1; AJvYcCXsCNZbiAoS3YtlOgj2C/tLIUvSr4DjZwJhHXvgcwcA8XQph3M00NFn3xlkM0yWMkvutQM57jvbQFaB0Rc=@vger.kernel.org X-Gm-Message-State: AOJu0YzTMVZAe6qmx9iPaIGrxTuJMQcZZEktm47QDJcdkw3x37O71eN/ kND8UF8o93v7ynmAKbhJ4QokVIwudzhgPhvTJwMcEUwB+rtO9vspqDjp X-Gm-Gg: ATEYQzwmkeciBV1UQ6kEdjRnd1Smxg2Ky0zi/jQdr1l2UXkNGoKLF/uePs/t9Gicopo Ud4EOi46GlY6auJ8wcn2kI/CWI1uzQYb8ac5FBNN52r943P4KRaYUIaWwR89PczokKYSA9594Ke beWUse64UCYVBJ9YF9PgU8XkOazEDBXt75VQ1llswp77mZYytPfTkbLasQAvMMjaRcZicIIQ9Xn mI+PIVjp25T33xY8wccx0zWpx/V2+1tc7xCmJQgGVHcSy9MZ5Imv66guEAF1D2NKXNMsbzuAeOR N+QSh1Oe+8gPMQN5Tr1MDenJPhe3ArmcUiJysFhUmSBLHdyfYjJxhGQF/AuCBFymLsD3UeCVf/c DTx1MDWSVNsy3pRIK7AjA+qghm3s68OuY2CmFkFrW3OTm1MZWQ+kuv+C1NKEEKjdyy71/NBp4nl hIrjW2H+8U5zhv3C4pZKGRFmjyQcBs8uU= X-Received: by 2002:a05:6830:d09:b0:7cf:d1b7:96ca with SMTP id 46e09a7af769-7d6c7f4b450mr1231038a34.6.1772637949342; Wed, 04 Mar 2026 07:25:49 -0800 (PST) Received: from localhost ([2a03:2880:10ff:c::]) by smtp.gmail.com with ESMTPSA id 46e09a7af769-7d58644dd17sm15624459a34.5.2026.03.04.07.25.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Mar 2026 07:25:48 -0800 (PST) From: Joshua Hahn To: Usama Arif Cc: Andrew Morton , npache@redhat.com, david@kernel.org, ziy@nvidia.com, linux-mm@kvack.org, matthew.brost@intel.com, joshua.hahnjy@gmail.com, hannes@cmpxchg.org, rakie.kim@sk.com, byungchul@sk.com, gourry@gourry.net, ying.huang@linux.alibaba.com, apopple@nvidia.com, riel@surriel.com, shakeel.butt@linux.dev, kas@kernel.org, linux-kernel@vger.kernel.org, kernel-team@meta.com, Usama Arif Subject: Re: [PATCH] mm/migrate_device: fix folio refcount leak on folio_split_unmapped failure Date: Wed, 4 Mar 2026 07:25:46 -0800 Message-ID: <20260304152546.3719551-1-joshua.hahnjy@gmail.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260304120132.3973445-1-usamaarif642@gmail.com> References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit On Wed, 4 Mar 2026 04:01:32 -0800 Usama Arif wrote: > From: Usama Arif > > migrate_vma_split_unmapped_folio() takes an extra reference via > folio_get() before calling folio_split_unmapped(). On success, the > split consumes this reference: __folio_freeze_and_split_unmapped() > expects the +1 in its folio_ref_freeze() check, and distributes it > across the resulting sub-folios via folio_ref_unfreeze(...+1), which > are later balanced by folio_put() calls in __migrate_device_finalize(). > > If folio_split_unmapped() fails (e.g., unexpected pinning returns > -EAGAIN), the function returns without calling folio_put(). The extra > reference is never released. > > Add the missing folio_put() on the error path. Agreed with Kiryl that maybe there is an opportunity to do additional cleanup. But as a fix for the issue, I think that this patch looks good to me. We can send a follow-up patch in the future if we want to clean this area up : -) Reviewed-by: Joshua Hahn > Fixes: 4265d67e405a4 ("mm/migrate_device: add THP splitting during migration") > Closes: https://lore.kernel.org/all/CAA1CXcDyqPPwf_-W7B+PFQtL8HdoJGCEqVsVxq7DhOUB=L4PQA@mail.gmail.com/ > Reported-by: Nico Pache > Signed-off-by: Usama Arif > --- > mm/migrate_device.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/mm/migrate_device.c b/mm/migrate_device.c > index 0a8b31939640f..351ecd9065d13 100644 > --- a/mm/migrate_device.c > +++ b/mm/migrate_device.c > @@ -917,8 +917,10 @@ static int migrate_vma_split_unmapped_folio(struct migrate_vma *migrate, > folio_get(folio); > split_huge_pmd_address(migrate->vma, addr, true); > ret = folio_split_unmapped(folio, 0); > - if (ret) > + if (ret) { > + folio_put(folio); > return ret; > + } > migrate->src[idx] &= ~MIGRATE_PFN_COMPOUND; > flags = migrate->src[idx] & ((1UL << MIGRATE_PFN_SHIFT) - 1); > pfn = migrate->src[idx] >> MIGRATE_PFN_SHIFT; > -- > 2.47.3