From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mta1.migadu.com (out-152.mta1.migadu.com [95.215.58.152]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 65640233149 for ; Tue, 25 Aug 2026 02:10:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.152 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787623837; cv=none; b=QVeFV7VODTKx4/5bRbfOwv6SkIw3ICGmyYhTeDrwWcifm/Qt2qmUVvDNsAEX3TMItg1tz37ovwEpfKK4LghbOvFLLIoAJCJIvPVJ2xMghNAm0ggcclWGtwfJrfczhXj+mAOjSNBKMJz7mzs2fScvvEHuf6oEtcXBYPjRj4rH7OA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787623837; c=relaxed/simple; bh=sz2kKPbexaSAMQ67g6lWgaRO+H52ytnVjVAZyyUbZXc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Fqo5NPaeDQpGPb0lWnxsZE4+2TRb+rsWoLTvj+98K+iVm3OIZXUaAqSEv1awPe+TWu5zk1VioXNo3EfEs/aVVk1/haPE8WFcqsQ/mbp5MNI86kS7WDQ4Z4n263b+Ch1hikr9w5MPjoRg/GxU8F8FyduwEuE7Cdvg6R+ctaX2gSk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=JniZxRFc; arc=none smtp.client-ip=95.215.58.152 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="JniZxRFc" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=sz2kKPbexaSAMQ67g6lWgaRO+H52ytnVjVAZyyUbZXc=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1787623833; v=1; x=1788228633; b=JniZxRFcSNwVQ4T8iie8WOcb1WCcFwqd9LrpUgrC/0lndZus9EGo+/cB/wOGz6XMiENohjuH JEVluGpTfXPiXe7Zkub5vfp2RG510Os1TRcnEov3svEhG070y8rPAsiWU00/aGLP6Ony+75UKJJ HLPnVXj5l3GKYDrJQP8ivCvU= X-Envelope-To: linux-kernel@vger.kernel.org Received: from localhost.localdomain (223.70.160.239) by smtp.migadu.com with ESMTPS id cc9adeca0ea53b17; Tue, 25 Aug 2026 02:10:33 +0000 X-Mizu-Trace-ID: cc9adeca0ea53b17 X-Migadu-Flow: FLOW_OUT From: Hongfu Li To: muchun.song@linux.dev, osalvador@suse.de, david@kernel.org, akpm@linux-foundation.org, steven.sistare@oracle.com, vivek.kasireddy@intel.com Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, hongfu.li@linux.dev, Hongfu Li Subject: [PATCH] mm/hugetlb: fix resv_huge_pages double decrement in memfd error path Date: Tue, 25 Aug 2026 10:10:13 +0800 Message-ID: <20260825021013.25672-1-hongfu.li@linux.dev> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Hongfu Li alloc_hugetlb_folio_reserve() decrements h->resv_huge_pages when dequeuing a folio, but unlike the use_global_reservation handling in hugetlb_alloc_folio(), it does not set HPageRestoreReserve on the folio. Its sole caller memfd_alloc_folio() pre-allocates a reservation via hugetlb_reserve_pages() before allocating. When hugetlb_add_to_page_cache() fails, folio_put() drops the folio without HPageRestoreReserve set, so free_huge_folio() does not restore the reservation. The subsequent hugetlb_unreserve_pages() on the err_unresv path decrements the counter a second time, leaving resv_huge_pages off by one for every failed allocation. Set HPageRestoreReserve when consuming the reservation in alloc_hugetlb_folio_reserve(). On the error path, free_huge_folio() then restores the reservation before hugetlb_unreserve_pages() releases it. The success path is unaffected, as hugetlb_add_to_page_cache() clears the flag once the folio is added to the page cache. Fixes: 26a8ea80929c ("mm/hugetlb: fix memfd_pin_folios resv_huge_pages leak") Signed-off-by: Hongfu Li --- mm/hugetlb.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index d8849196ad9b..fadfe1dbc047 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -2178,8 +2178,10 @@ struct folio *alloc_hugetlb_folio_reserve(struct hstate *h, int preferred_nid, folio = dequeue_hugetlb_folio_nodemask(h, gfp_mask, preferred_nid, nmask); - if (folio) + if (folio) { + folio_set_hugetlb_restore_reserve(folio); h->resv_huge_pages--; + } spin_unlock_irq(&hugetlb_lock); return folio; -- 2.54.0