When free_raw_hwp_pages() fails its work, the refcnt of the hugetlb page
would have been incremented if ret > 0. Using put_page() to fix refcnt
leaking in this case.

Fixes: debb6b9c3fdd ("mm, hwpoison: make unpoison aware of raw error info in hwpoisoned hugepage")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
---
 mm/memory-failure.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 22840cd5fe59..0c5ad7505b99 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -2378,6 +2378,7 @@ int unpoison_memory(unsigned long pfn)
 			count = free_raw_hwp_pages(page, false);
 			if (count == 0) {
 				ret = -EBUSY;
+				put_page(page);
 				goto unlock_mutex;
 			}
 		}
-- 
2.23.0

On Thu, Aug 18, 2022 at 09:00:12PM +0800, Miaohe Lin wrote:
> When free_raw_hwp_pages() fails its work, the refcnt of the hugetlb page
> would have been incremented if ret > 0. Using put_page() to fix refcnt
> leaking in this case.
> 
> Fixes: debb6b9c3fdd ("mm, hwpoison: make unpoison aware of raw error info in hwpoisoned hugepage")
> Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>

Acked-by: Naoya Horiguchi <naoya.horiguchi@nec.com>

> ---
>  mm/memory-failure.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/mm/memory-failure.c b/mm/memory-failure.c
> index 22840cd5fe59..0c5ad7505b99 100644
> --- a/mm/memory-failure.c
> +++ b/mm/memory-failure.c
> @@ -2378,6 +2378,7 @@ int unpoison_memory(unsigned long pfn)
>  			count = free_raw_hwp_pages(page, false);
>  			if (count == 0) {
>  				ret = -EBUSY;
> +				put_page(page);
>  				goto unlock_mutex;
>  			}
>  		}
> -- 
> 2.23.0