PM: hibernate: Fix memory leak in snapshot_write_next() error path

[PATCH] PM: hibernate: Fix memory leak in snapshot_write_next() error path

Posted by Malaya Kumar Rout 2 weeks ago

When memory_bm_create() succeeds for copy_bm but fails for zero_bm,
the function returns without freeing the resources allocated for
copy_bm. This results in a memory leak that includes radix tree nodes,
zone structures, and page lists.

Fix this by calling memory_bm_free() to release copy_bm's resources
before returning the error code when zero_bm allocation fails.

Fixes: 005e8dddd497 ("PM: hibernate: don't store zero pages in the image file")
Signed-off-by: Malaya Kumar Rout <malayarout91@gmail.com>
---
 kernel/power/snapshot.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index d933b5b2c05d..4a73927cc55b 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -2797,9 +2797,10 @@ int snapshot_write_next(struct snapshot_handle *handle)
 			return error;
 
 		error = memory_bm_create(&zero_bm, GFP_ATOMIC, PG_ANY);
-		if (error)
+		if (error) {
+			memory_bm_free(&copy_bm, PG_UNSAFE_CLEAR);
 			return error;
-
+		}
 		nr_zero_pages = 0;
 
 		hibernate_restore_protection_begin();
-- 
2.54.0

Re: [PATCH] PM: hibernate: Fix memory leak in snapshot_write_next() error path

Posted by Brian Geffon 1 week, 5 days ago

On Sat, Jul 11, 2026 at 10:53 AM Malaya Kumar Rout
<malayarout91@gmail.com> wrote:
>
> When memory_bm_create() succeeds for copy_bm but fails for zero_bm,
> the function returns without freeing the resources allocated for
> copy_bm. This results in a memory leak that includes radix tree nodes,
> zone structures, and page lists.
>
> Fix this by calling memory_bm_free() to release copy_bm's resources
> before returning the error code when zero_bm allocation fails.
>
> Fixes: 005e8dddd497 ("PM: hibernate: don't store zero pages in the image file")
> Signed-off-by: Malaya Kumar Rout <malayarout91@gmail.com>

Acked-by: Brian Geffon <bgeffon@google.com>

>
> ---
>  kernel/power/snapshot.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
> index d933b5b2c05d..4a73927cc55b 100644
> --- a/kernel/power/snapshot.c
> +++ b/kernel/power/snapshot.c
> @@ -2797,9 +2797,10 @@ int snapshot_write_next(struct snapshot_handle *handle)
>                         return error;
>
>                 error = memory_bm_create(&zero_bm, GFP_ATOMIC, PG_ANY);
> -               if (error)
> +               if (error) {
> +                       memory_bm_free(&copy_bm, PG_UNSAFE_CLEAR);
>                         return error;
> -
> +               }
>                 nr_zero_pages = 0;
>
>                 hibernate_restore_protection_begin();
> --
> 2.54.0
>

Re: [PATCH] PM: hibernate: Fix memory leak in snapshot_write_next() error path

Posted by Rafael J. Wysocki (Intel) 2 days, 9 hours ago

On Mon, Jul 13, 2026 at 3:27 PM Brian Geffon <bgeffon@google.com> wrote:
>
> On Sat, Jul 11, 2026 at 10:53 AM Malaya Kumar Rout
> <malayarout91@gmail.com> wrote:
> >
> > When memory_bm_create() succeeds for copy_bm but fails for zero_bm,
> > the function returns without freeing the resources allocated for
> > copy_bm. This results in a memory leak that includes radix tree nodes,
> > zone structures, and page lists.
> >
> > Fix this by calling memory_bm_free() to release copy_bm's resources
> > before returning the error code when zero_bm allocation fails.
> >
> > Fixes: 005e8dddd497 ("PM: hibernate: don't store zero pages in the image file")
> > Signed-off-by: Malaya Kumar Rout <malayarout91@gmail.com>
>
> Acked-by: Brian Geffon <bgeffon@google.com>

Applied as 7.3 material, thanks!

> > ---
> >  kernel/power/snapshot.c | 5 +++--
> >  1 file changed, 3 insertions(+), 2 deletions(-)
> >
> > diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
> > index d933b5b2c05d..4a73927cc55b 100644
> > --- a/kernel/power/snapshot.c
> > +++ b/kernel/power/snapshot.c
> > @@ -2797,9 +2797,10 @@ int snapshot_write_next(struct snapshot_handle *handle)
> >                         return error;
> >
> >                 error = memory_bm_create(&zero_bm, GFP_ATOMIC, PG_ANY);
> > -               if (error)
> > +               if (error) {
> > +                       memory_bm_free(&copy_bm, PG_UNSAFE_CLEAR);
> >                         return error;
> > -
> > +               }
> >                 nr_zero_pages = 0;
> >
> >                 hibernate_restore_protection_begin();
> > --
> > 2.54.0
> >