hugetlbfs_fill_super() allocates a hugepage subpool when size or
min_size mount options are specified.  hugepage_new_subpool() may also
reserve huge pages for min_size.

If root dentry creation fails after the subpool is created, the failure
path frees the subpool with kfree().  This bypasses
hugepage_put_subpool() and can leave min_size reservations charged.

Use hugepage_put_subpool() on the failure path, matching the normal
put_super path.

Fixes: 7ca02d0ae586 ("hugetlbfs: accept subpool min_size mount option and setup accordingly")
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
---
 fs/hugetlbfs/inode.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 216e1a0dd0b2..6a1d7e778cb0 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -1419,7 +1419,8 @@ hugetlbfs_fill_super(struct super_block *sb, struct fs_context *fc)
 		goto out_free;
 	return 0;
 out_free:
-	kfree(sbinfo->spool);
+	if (sbinfo->spool)
+		hugepage_put_subpool(sbinfo->spool);
 	kfree(sbinfo);
 	return -ENOMEM;
 }
-- 
2.51.0

On Mon, 20 Jul 2026 10:18:59 +0800 Yichong Chen <chenyichong@uniontech.com> wrote:

> hugetlbfs_fill_super() allocates a hugepage subpool when size or
> min_size mount options are specified.  hugepage_new_subpool() may also
> reserve huge pages for min_size.
> 
> If root dentry creation fails after the subpool is created, the failure
> path frees the subpool with kfree().  This bypasses
> hugepage_put_subpool() and can leave min_size reservations charged.
> 
> Use hugepage_put_subpool() on the failure path, matching the normal
> put_super path.

lgtm, thanks.

This might have led AI review to find a pre-existing bug in
mm/hugetlb.c:unlock_or_release_subpool():

	https://sashiko.dev/#/patchset/20260720021900.1376309-1-chenyichong@uniontech.com

> --- a/fs/hugetlbfs/inode.c
> +++ b/fs/hugetlbfs/inode.c
> @@ -1419,7 +1419,8 @@ hugetlbfs_fill_super(struct super_block *sb, struct fs_context *fc)
>  		goto out_free;
>  	return 0;
>  out_free:
> -	kfree(sbinfo->spool);
> +	if (sbinfo->spool)
> +		hugepage_put_subpool(sbinfo->spool);

Both callers of hugepage_put_subpool do this NULL check.  We could move
that check into hugepage_put_subpool().

>  	kfree(sbinfo);
>  	return -ENOMEM;
>  }

Thanks, Andrew.

Yes, moving the NULL check into hugepage_put_subpool() makes sense.  I'll
send a follow-up cleanup patch for that.

The Sashiko comment about unlock_or_release_subpool() also looks like a
separate pre-existing race to me, so I'll look at that as an independent
fix.

Thanks,
Yichong

Both callers of hugepage_put_subpool() check whether the subpool pointer
is NULL before calling it.  Move the NULL check into
hugepage_put_subpool() so callers can use the helper unconditionally.

This is a follow-up cleanup after using hugepage_put_subpool() from the
hugetlbfs_fill_super() failure path.

Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
---
 fs/hugetlbfs/inode.c | 6 ++----
 mm/hugetlb.c         | 3 +++
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 6a1d7e778cb0..0c125eda16fd 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -1129,8 +1129,7 @@ static void hugetlbfs_put_super(struct super_block *sb)
 	if (sbi) {
 		sb->s_fs_info = NULL;
 
-		if (sbi->spool)
-			hugepage_put_subpool(sbi->spool);
+		hugepage_put_subpool(sbi->spool);
 
 		kfree(sbi);
 	}
@@ -1419,8 +1418,7 @@ hugetlbfs_fill_super(struct super_block *sb, struct fs_context *fc)
 		goto out_free;
 	return 0;
 out_free:
-	if (sbinfo->spool)
-		hugepage_put_subpool(sbinfo->spool);
+	hugepage_put_subpool(sbinfo->spool);
 	kfree(sbinfo);
 	return -ENOMEM;
 }
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 571212b80835..e319c6a00555 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -181,6 +181,9 @@ void hugepage_put_subpool(struct hugepage_subpool *spool)
 {
 	unsigned long flags;
 
+	if (!spool)
+		return;
+
 	spin_lock_irqsave(&spool->lock, flags);
 	BUG_ON(!spool->count);
 	spool->count--;
-- 
2.51.0

> On Jul 20, 2026, at 15:38, Yichong Chen <chenyichong@uniontech.com> wrote:
> 
> Both callers of hugepage_put_subpool() check whether the subpool pointer
> is NULL before calling it.  Move the NULL check into
> hugepage_put_subpool() so callers can use the helper unconditionally.
> 
> This is a follow-up cleanup after using hugepage_put_subpool() from the
> hugetlbfs_fill_super() failure path.
> 
> Signed-off-by: Yichong Chen <chenyichong@uniontech.com>

Reviewed-by: Muchun Song <muchun.song@linux.dev>