From nobody Sat Sep 26 09:20:36 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 04CE7451992; Wed, 2 Sep 2026 23:30:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788391852; cv=none; b=J67NccHwmGEC4UcRZCmPUmpbMDwnwoOHcatWNvDoo4pqlDIhA7P/OV3pEiLWacmKCDyHdbIlYMMcH7W/+YPgpj7EDZn6AvPn0tmBA9wz+7FP4R6LmFrqwUH+NpcOOSI/PLn6j5XRTBL++HxRumLskVbmv+Bn5RDvj3TG+iDIudk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788391852; c=relaxed/simple; bh=YmTzLGCwOa83Q9censUxVmhxihQS3PGlGIxxvn+2hMQ=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Q1D9zzKjwicpWQuTdZo9vXj24BWpwGNHuHRIjlyOA8nQue2F1wCqztCibPt1rfimiESInV3uEZ5UJ8q03tnMJEmnuWwxNAeoxd6wz0zTx3SVfjNLEUl9ZYOHcff85hqqV3+SqJmjp7qM+EKBaknW4HuJ+Lgbp65gW0esK8cvn0E= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=uObNl2d2; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="uObNl2d2" Received: by smtp.kernel.org (Postfix) with ESMTPS id B93B9C2BCF7; Wed, 2 Sep 2026 23:30:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1788391851; bh=YmTzLGCwOa83Q9censUxVmhxihQS3PGlGIxxvn+2hMQ=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=uObNl2d2SiGKfQAUiAKEIjUwP4GukueS8gXoj+ArYQ38XEevH3eLly3Yphu1FT3T/ 5nzebHCZQVwupekJ36MQ8eU/G1tRblvuo/jGwU8BYo8qpVi+JuKUAlEGKQID//BSzO eskVlgX63KW95dhD70m5c0IMBeVKo1/WEmDuyg67jySelzPmg4Qy5L8UzAuTT85I+7 bOnOQr5FWPkM3htSMAxeD1SmwP+xkT51skIQC3OUrNAKhaSFlahnu/9hMhNovGoOPn GpgAS+yE+bVRJJjUlee1Hst6v0DJKrhIPvl+74Dwu/OvBnqJ0OFw04lH/WXIUxGER8 0qf+Fp9fS4xlg== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 96094C61DD6; Wed, 2 Sep 2026 23:30:51 +0000 (UTC) From: Ackerley Tng via B4 Relay Date: Wed, 02 Sep 2026 16:30:47 -0700 Subject: [PATCH 1/3] mm: hugetlb: Track used_hpages when getting/putting pages from subpool Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260902-hugetlb-subpool-always-track-used-v1-1-de1cd14bd713@google.com> References: <20260902-hugetlb-subpool-always-track-used-v1-0-de1cd14bd713@google.com> In-Reply-To: <20260902-hugetlb-subpool-always-track-used-v1-0-de1cd14bd713@google.com> To: Alex Shi , Andrew Morton , David Hildenbrand , Dongliang Mu , Hongxiang Lou , Johannes Weiner , Jonathan Corbet , Joshua Hahn , "Liam R. Howlett" , Lorenzo Stoakes , Miaohe Lin , Michal Hocko , Mike Rapoport , Muchun Song , Nhat Pham , Oscar Salvador , Peter Xu , Randy Dunlap , Roman Gushchin , Shakeel Butt , Shuah Khan , Suren Baghdasaryan , Usama Arif , Vlastimil Babka , Wupeng Ma , Yanteng Si , fvdl@google.com, jthoughton@google.com, rientjes@google.com, vannapurve@google.com Cc: linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, Ackerley Tng , stable@vger.kernel.org X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1788391851; l=12003; i=ackerleytng@google.com; s=20260225; h=from:subject:message-id; bh=wbqSyhMI6dzMpDAelK9o12CP0bEKd0RZWUUuGXS5JZ8=; b=jEAb4yMSLDuGWrdYD9ZdQCoj7Wf/mmcrXgpyyl46iEvLdMe2w9MxyjEo1IvxRfUKZclWo6uOu 50YDMznEm8PBqq9IW+bKTWguaUCJm1bLZBWCwiXrDmPLjtL7arHO/73 X-Developer-Key: i=ackerleytng@google.com; a=ed25519; pk=sAZDYXdm6Iz8FHitpHeFlCMXwabodTm7p8/3/8xUxuU= X-Endpoint-Received: by B4 Relay for ackerleytng@google.com/20260225 with auth_id=649 X-Original-From: Ackerley Tng Reply-To: ackerleytng@google.com From: Ackerley Tng HugeTLB subpools currently only track used_hpages when the user configures a size limit. This is buggy since when there are existing allocations from the subpool that would have satisfied the minimum reservations, hugepage_subpool_put_pages() will still restore a reservation to the subpool. See below for an example of a false reservation. In addition, the subpool is considered free prematurely, is freed, and this ends up causing a use-after-free. The fix is to always track used_hpages within subpools, which is also beneficial in general because with that information, reservation tracking is also fully managed within hugepage_subpool_put_pages(). The subpool always knows how many pages were allocated through it. Every page allocated through the subpool increments used_hpages, regardless of whether a reservation was taken from it. Conceptually, now, every allocation involving a subpool uses a page from the subpool, which must be returned to the subpool. Every page taken from the subpool tries to use a subpool reservation. Restoring a page to the subpool reservations only if the page was taken from subpool reservations. (If used_hpages >=3D min_hpages, the page must have not have been taken from the reservations.) Always tracking used_hpages provides the subpool with information of both used and reserved counts to make the correct decision for both max_size and min_size correctly. With used_hpages always tracked, subpool_is_free() can be simplified, such that the subpool can be declared free if there are no more pages in use. Also update the + Documentation for used_hpages in the subpool struct, since it no longer matters whether the used pages count against the maximum. + Docstring for hugepage_subpool_{get,put}_pages + Documentation to use active voice, and remove some details in favor of having details documented in the docstring Also update statfs reporting. Previously, if max_hpages is negative, used_hpages is static at 0, so returning max_hpages - used_hpages returns -1 and is always correct. Now, if the subpool doesn't have a maximum requested size, indicate no limit for free pages (-1). If it does have a maximum size, report the difference between the requested size and the number of used pages. This difference is always positive, because if the mount does have a maximum size, hugepage_subpool_get_pages() ensures that the subpool usage never exceeds the maximum. Fixes: 1c5ecae3a93fa ("hugetlbfs: add minimum size accounting to subpools") Cc: stable@vger.kernel.org Signed-off-by: Ackerley Tng --- Documentation/mm/hugetlbfs_reserv.rst | 17 +---- .../translations/zh_CN/mm/hugetlbfs_reserv.rst | 11 +--- fs/hugetlbfs/inode.c | 8 ++- include/linux/hugetlb.h | 4 +- mm/hugetlb.c | 73 +++++++++++++-----= ---- 5 files changed, 55 insertions(+), 58 deletions(-) diff --git a/Documentation/mm/hugetlbfs_reserv.rst b/Documentation/mm/huget= lbfs_reserv.rst index a49115db18c76..d244583fdcbc3 100644 --- a/Documentation/mm/hugetlbfs_reserv.rst +++ b/Documentation/mm/hugetlbfs_reserv.rst @@ -314,21 +314,8 @@ huge pages. If they can not be reserved, the mount fa= ils. The routines hugepage_subpool_get/put_pages() are called when pages are obtained from or released back to a subpool. They perform all subpool accounting, and track any reservations associated with the subpool. -hugepage_subpool_get/put_pages are passed the number of huge pages by which -to adjust the subpool 'used page' count (down for get, up for put). Norma= lly, -they return the same value that was passed or an error if not enough pages -exist in the subpool. - -However, if reserves are associated with the subpool a return value less -than the passed value may be returned. This return value indicates the -number of additional global pool adjustments which must be made. For exam= ple, -suppose a subpool contains 3 reserved huge pages and someone asks for 5. -The 3 reserved pages associated with the subpool can be used to satisfy pa= rt -of the request. But, 2 pages must be obtained from the global pools. To -relay this information to the caller, the value 2 is returned. The caller -is then responsible for attempting to obtain the additional two pages from -the global pools. - +hugepage_subpool_get/put_pages() use the number of huge pages passed to ad= just +the subpool 'used page' count. =20 COW and Reservations =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D diff --git a/Documentation/translations/zh_CN/mm/hugetlbfs_reserv.rst b/Doc= umentation/translations/zh_CN/mm/hugetlbfs_reserv.rst index 20947f8bd0654..ae1f1f31477fc 100644 --- a/Documentation/translations/zh_CN/mm/hugetlbfs_reserv.rst +++ b/Documentation/translations/zh_CN/mm/hugetlbfs_reserv.rst @@ -246,15 +246,8 @@ hugepage_subpool=E7=9A=84min_hpages=E5=AD=97=E6=AE=B5= =E4=B8=AD=E8=A2=AB=E8=B7=9F=E8=B8=AA=E3=80=82=E5=9C=A8=E6=8C=82=E8=BD=BD=E6= =97=B6=EF=BC=8Chugetlb_acct_me =E8=A2=AB=E8=B0=83=E7=94=A8=E4=BB=A5=E9=A2=84=E7=95=99=E6=8C=87=E5=AE=9A= =E6=95=B0=E9=87=8F=E7=9A=84=E5=B7=A8=E9=A1=B5=E3=80=82=E5=A6=82=E6=9E=9C=E5= =AE=83=E4=BB=AC=E4=B8=8D=E8=83=BD=E8=A2=AB=E9=A2=84=E7=95=99=EF=BC=8C=E6=8C= =82=E8=BD=BD=E5=B0=B1=E4=BC=9A=E5=A4=B1=E8=B4=A5=E3=80=82 =20 =E5=BD=93=E4=BB=8E=E5=AD=90=E6=B1=A0=E4=B8=AD=E8=8E=B7=E5=8F=96=E6=88=96= =E9=87=8A=E6=94=BE=E9=A1=B5=E9=9D=A2=E6=97=B6=EF=BC=8C=E4=BC=9A=E8=B0=83=E7= =94=A8hugepage_subpool_get/put_pages()=E5=87=BD=E6=95=B0=E3=80=82 -hugepage_subpool_get/put_pages=E8=A2=AB=E4=BC=A0=E9=80=92=E7=BB=99=E5=B7= =A8=E9=A1=B5=E6=95=B0=E9=87=8F=EF=BC=8C=E4=BB=A5=E6=AD=A4=E6=9D=A5=E8=B0=83= =E6=95=B4=E5=AD=90=E6=B1=A0=E7=9A=84 =E2=80=9C=E5=B7=B2=E7=94=A8=E9=A1=B5= =E9=9D=A2=E2=80=9D =E8=AE=A1=E6=95=B0 -=EF=BC=88get=E4=B8=BA=E4=B8=8B=E9=99=8D=EF=BC=8Cput=E4=B8=BA=E4=B8=8A=E5= =8D=87=EF=BC=89=E3=80=82=E9=80=9A=E5=B8=B8=E6=83=85=E5=86=B5=E4=B8=8B=EF=BC= =8C=E5=A6=82=E6=9E=9C=E5=AD=90=E6=B1=A0=E4=B8=AD=E6=B2=A1=E6=9C=89=E8=B6=B3= =E5=A4=9F=E7=9A=84=E9=A1=B5=E9=9D=A2=EF=BC=8C=E5=AE=83=E4=BB=AC=E4=BC=9A=E8= =BF=94=E5=9B=9E=E4=B8=8E=E4=BC=A0=E9=80=92=E7=9A=84=E7=9B=B8=E5=90=8C=E7=9A= =84=E5=80=BC=E6=88=96 -=E4=B8=80=E4=B8=AA=E9=94=99=E8=AF=AF=E3=80=82 - -=E7=84=B6=E8=80=8C=EF=BC=8C=E5=A6=82=E6=9E=9C=E9=A2=84=E7=95=99=E4=B8=8E= =E5=AD=90=E6=B1=A0=E7=9B=B8=E5=85=B3=E8=81=94=EF=BC=8C=E5=8F=AF=E8=83=BD=E4= =BC=9A=E8=BF=94=E5=9B=9E=E4=B8=80=E4=B8=AA=E5=B0=8F=E4=BA=8E=E4=BC=A0=E9=80= =92=E5=80=BC=E7=9A=84=E8=BF=94=E5=9B=9E=E5=80=BC=E3=80=82=E8=BF=99=E4=B8=AA= =E8=BF=94=E5=9B=9E=E5=80=BC=E8=A1=A8=E7=A4=BA=E5=BF=85=E9=A1=BB=E8=BF=9B=E8= =A1=8C=E7=9A=84=E9=A2=9D=E5=A4=96=E5=85=A8=E5=B1=80 -=E6=B1=A0=E8=B0=83=E6=95=B4=E7=9A=84=E6=95=B0=E9=87=8F=E3=80=82=E4=BE=8B= =E5=A6=82=EF=BC=8C=E5=81=87=E8=AE=BE=E4=B8=80=E4=B8=AA=E5=AD=90=E6=B1=A0=E5= =8C=85=E5=90=AB3=E4=B8=AA=E9=A2=84=E7=95=99=E7=9A=84=E5=B7=A8=E9=A1=B5=EF= =BC=8C=E6=9C=89=E4=BA=BA=E8=A6=81=E6=B1=825=E4=B8=AA=E3=80=82=E4=B8=8E=E5= =AD=90=E6=B1=A0=E7=9B=B8=E5=85=B3=E7=9A=843=E4=B8=AA=E9=A2=84=E7=95=99=E9= =A1=B5=E5=8F=AF=E4=BB=A5=E7=94=A8=E6=9D=A5 -=E6=BB=A1=E8=B6=B3=E9=83=A8=E5=88=86=E8=AF=B7=E6=B1=82=E3=80=82=E4=BD=86= =E6=98=AF=EF=BC=8C=E5=BF=85=E9=A1=BB=E4=BB=8E=E5=85=A8=E5=B1=80=E6=B1=A0=E4= =B8=AD=E8=8E=B7=E5=BE=972=E4=B8=AA=E9=A1=B5=E9=9D=A2=E3=80=82=E4=B8=BA=E4= =BA=86=E5=90=91=E8=B0=83=E7=94=A8=E8=80=85=E8=BD=AC=E8=BE=BE=E8=BF=99=E4=B8= =80=E4=BF=A1=E6=81=AF=EF=BC=8C=E5=B0=86=E8=BF=94=E5=9B=9E=E5=80=BC2=E3=80= =82=E7=84=B6=E5=90=8E=EF=BC=8C=E8=B0=83=E7=94=A8 -=E8=80=85=E8=A6=81=E8=B4=9F=E8=B4=A3=E4=BB=8E=E5=85=A8=E5=B1=80=E6=B1=A0= =E4=B8=AD=E8=8E=B7=E5=8F=96=E5=8F=A6=E5=A4=96=E4=B8=A4=E4=B8=AA=E9=A1=B5=E9= =9D=A2=E3=80=82 - +=E5=AE=83=E4=BB=AC=E8=B4=9F=E8=B4=A3=E6=89=80=E6=9C=89=E5=AD=90=E6=B1=A0= =E7=9A=84=E7=BB=9F=E8=AE=A1=E6=A0=B8=E7=AE=97=EF=BC=8C=E5=B9=B6=E8=B7=9F=E8= =B8=AA=E4=B8=8E=E5=AD=90=E6=B1=A0=E7=9B=B8=E5=85=B3=E8=81=94=E7=9A=84=E9=A2= =84=E7=95=99=E3=80=82 +hugepage_subpool_get/put_pages()=E5=87=BD=E6=95=B0=E4=BD=BF=E7=94=A8=E4=BC= =A0=E5=85=A5=E7=9A=84=E5=B7=A8=E9=A1=B5=E6=95=B0=E9=87=8F=E6=9D=A5=E8=B0=83= =E6=95=B4=E5=AD=90=E6=B1=A0=E7=9A=84=E2=80=9C=E5=B7=B2=E7=94=A8=E9=A1=B5=E9= =9D=A2=E2=80=9D=E8=AE=A1=E6=95=B0=E3=80=82 =20 COW=E5=92=8C=E9=A2=84=E7=95=99 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c index 7611a8470ea26..5113f743f6fc7 100644 --- a/fs/hugetlbfs/inode.c +++ b/fs/hugetlbfs/inode.c @@ -1109,8 +1109,12 @@ static int hugetlbfs_statfs(struct dentry *dentry, s= truct kstatfs *buf) =20 spin_lock_irq(&sbinfo->spool->lock); buf->f_blocks =3D sbinfo->spool->max_hpages; - free_pages =3D sbinfo->spool->max_hpages - - sbinfo->spool->used_hpages; + if (sbinfo->spool->max_hpages =3D=3D -1) { + free_pages =3D -1; + } else { + free_pages =3D sbinfo->spool->max_hpages - + sbinfo->spool->used_hpages; + } buf->f_bavail =3D buf->f_bfree =3D free_pages; spin_unlock_irq(&sbinfo->spool->lock); buf->f_files =3D sbinfo->max_inodes; diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h index 16c4c4caa126c..4551ff3023640 100644 --- a/include/linux/hugetlb.h +++ b/include/linux/hugetlb.h @@ -39,8 +39,8 @@ struct hugepage_subpool { spinlock_t lock; long count; long max_hpages; /* Maximum huge pages or -1 if no maximum. */ - long used_hpages; /* Used count against maximum, includes */ - /* both allocated and reserved pages. */ + long used_hpages; /* Used page count, includes both */ + /* allocated and reserved pages. */ struct hstate *hstate; long min_hpages; /* Minimum huge pages or -1 if no minimum. */ long rsv_hpages; /* Pages reserved against global pool to */ diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 7857728457952..66b6601abb069 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -130,12 +130,8 @@ static inline bool subpool_is_free(struct hugepage_sub= pool *spool) { if (spool->count) return false; - if (spool->max_hpages !=3D -1) - return spool->used_hpages =3D=3D 0; - if (spool->min_hpages !=3D -1) - return spool->rsv_hpages =3D=3D spool->min_hpages; =20 - return true; + return spool->used_hpages =3D=3D 0; } =20 static inline void unlock_or_release_subpool(struct hugepage_subpool *spoo= l, @@ -193,13 +189,18 @@ void hugepage_put_subpool(struct hugepage_subpool *sp= ool) unlock_or_release_subpool(spool, flags); } =20 -/* - * Subpool accounting for allocating and reserving pages. - * Return -ENOMEM if there are not enough resources to satisfy the - * request. Otherwise, return the number of pages by which the - * global pools must be adjusted (upward). The returned value may - * only be different than the passed value (delta) in the case where - * a subpool minimum size must be maintained. +/** + * hugepage_subpool_get_pages - Get pages from a subpool + * @spool: pointer to subpool structure (may be NULL) + * @delta: number of pages to allocate or reserve + * + * Check and update subpool page usage counts when allocating or + * reserving @delta hugepages. + * + * Context: Takes spool->lock using spin_lock_irq(). + * Return: Non-negative number of reservations that cannot be + * satisfied by the subpool, or -ENOMEM if the subpool maximum + * limit would be exceeded. */ static long hugepage_subpool_get_pages(struct hugepage_subpool *spool, long delta) @@ -211,15 +212,14 @@ static long hugepage_subpool_get_pages(struct hugepag= e_subpool *spool, =20 spin_lock_irq(&spool->lock); =20 - if (spool->max_hpages !=3D -1) { /* maximum size accounting */ - if ((spool->used_hpages + delta) <=3D spool->max_hpages) - spool->used_hpages +=3D delta; - else { - ret =3D -ENOMEM; - goto unlock_ret; - } + if (spool->max_hpages !=3D -1 && + spool->used_hpages + delta > spool->max_hpages) { + ret =3D -ENOMEM; + goto unlock_ret; } =20 + spool->used_hpages +=3D delta; + /* minimum size accounting */ if (spool->min_hpages !=3D -1 && spool->rsv_hpages) { if (delta > spool->rsv_hpages) { @@ -240,11 +240,19 @@ static long hugepage_subpool_get_pages(struct hugepag= e_subpool *spool, return ret; } =20 -/* - * Subpool accounting for freeing and unreserving pages. - * Return the number of global page reservations that must be dropped. - * The return value may only be different than the passed value (delta) - * in the case where a subpool minimum size must be maintained. +/** + * hugepage_subpool_put_pages - Release pages back to a subpool + * @spool: pointer to subpool structure (may be NULL) + * @delta: number of pages to free or unreserve + * + * Check and update subpool page usage counts when freeing or + * unreserving @delta hugepages. + * + * Context: Takes spool->lock using spin_lock_irqsave(). May release + * and free @spool if its usage count and references reach + * zero. + * Return: Non-negative number of reservations that the subpool cannot + * absorb. */ static long hugepage_subpool_put_pages(struct hugepage_subpool *spool, long delta) @@ -257,19 +265,24 @@ static long hugepage_subpool_put_pages(struct hugepag= e_subpool *spool, =20 spin_lock_irqsave(&spool->lock, flags); =20 - if (spool->max_hpages !=3D -1) /* maximum size accounting */ - spool->used_hpages -=3D delta; + spool->used_hpages -=3D delta; =20 /* minimum size accounting */ if (spool->min_hpages !=3D -1 && spool->used_hpages < spool->min_hpages) { - if (spool->rsv_hpages + delta <=3D spool->min_hpages) + /* + * limit is the maximum number of reservations that + * can be restored to this subpool. + */ + long limit =3D spool->min_hpages - spool->used_hpages; + + if (spool->rsv_hpages + delta <=3D limit) ret =3D 0; else - ret =3D spool->rsv_hpages + delta - spool->min_hpages; + ret =3D spool->rsv_hpages + delta - limit; =20 spool->rsv_hpages +=3D delta; - if (spool->rsv_hpages > spool->min_hpages) - spool->rsv_hpages =3D spool->min_hpages; + if (spool->rsv_hpages > limit) + spool->rsv_hpages =3D limit; } =20 /* --=20 2.55.0.970.g62bdec98f9-goog From nobody Sat Sep 26 09:20:36 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4123945562D; Wed, 2 Sep 2026 23:30:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788391852; cv=none; b=OP1ljOiwCzfW0TnlV/r4V8uycqOLjuafjNkBIxMITJoq0Fw5eSF6ljafcvAR5lIUDXRd0JdErmWIiCdVF2cHWyfz5Vm4nv/oyxlBlWGoIhm9o9fCi/LtdFJVBtS7TKYKvUacuSjTs2bxG1pqDuM4MK+3PESFQHspec1kEOVxLrs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788391852; c=relaxed/simple; bh=Ki955AuPcL8ptd7DA7YclqDVfMByL7PliZlA0BuzWms=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=kqYVergInM7dcOm91h1+I30t3J76LBZSOLcDRKW5DPlAdNSqxH8+/4NRiKMiyIWnmVWJ5J0nw4nW5dTVb0BDH4ndqq3zpVrliCO3CSZ9JdOrf9u2UZHeKfWfvLDH1tywba6l1uCmWtwtisMfeNXurYffX7Cn+Hs/bCYvtmtNUYs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ND/DOedc; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ND/DOedc" Received: by smtp.kernel.org (Postfix) with ESMTPS id C45B4C2BCFC; Wed, 2 Sep 2026 23:30:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1788391851; bh=Ki955AuPcL8ptd7DA7YclqDVfMByL7PliZlA0BuzWms=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=ND/DOedcrMFnCY8DfibfP9hDng7EM/361nNjI71Mf0DliHbjkIPxRVh2AfLVoPMnd AbmSFB6qHaq7ORwA9Sm46tCoz8VXHzx3r8KqAqbHyR3qi4Hh2gD8kz5zy5d6H474v9 p1gAuoCFI5dA1a8GPx3RsJZ0nR8LbTQ/wpKwOIzZrcg633GODwyQeVmJZFnmnbVQ6P HXsSLmssiEO7h3X9S2riqCtbIaeBhU2ByB6uhauITdLKWW7kdZ6g+UHPtvNvzLgDrs UBae/1LJKXGV69tj5EZvQnl/Usor0RN91bJJeTyoVH7iqbfm0IrpO96iOf8bbVmBgS rpBHM6ja5WI1g== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A8DDAC624DA; Wed, 2 Sep 2026 23:30:51 +0000 (UTC) From: Ackerley Tng via B4 Relay Date: Wed, 02 Sep 2026 16:30:48 -0700 Subject: [PATCH 2/3] mm: hugetlb: Fix out_put_pages subpool reserve calculation Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260902-hugetlb-subpool-always-track-used-v1-2-de1cd14bd713@google.com> References: <20260902-hugetlb-subpool-always-track-used-v1-0-de1cd14bd713@google.com> In-Reply-To: <20260902-hugetlb-subpool-always-track-used-v1-0-de1cd14bd713@google.com> To: Alex Shi , Andrew Morton , David Hildenbrand , Dongliang Mu , Hongxiang Lou , Johannes Weiner , Jonathan Corbet , Joshua Hahn , "Liam R. Howlett" , Lorenzo Stoakes , Miaohe Lin , Michal Hocko , Mike Rapoport , Muchun Song , Nhat Pham , Oscar Salvador , Peter Xu , Randy Dunlap , Roman Gushchin , Shakeel Butt , Shuah Khan , Suren Baghdasaryan , Usama Arif , Vlastimil Babka , Wupeng Ma , Yanteng Si , fvdl@google.com, jthoughton@google.com, rientjes@google.com, vannapurve@google.com Cc: linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, Ackerley Tng , stable@vger.kernel.org X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1788391851; l=5066; i=ackerleytng@google.com; s=20260225; h=from:subject:message-id; bh=WAOJFELA74ZYgV3pRllA7LgbuGP3A6AKBVLXZF1SPnM=; b=EvrECO8aOK8i8SdPmLnnbqA1aqPFmPt+mDbbQUb1DM/nBfqdJX4cMT23/J5MKT+VUWwKjNMa6 9CDPBG1/YNxDRRb2PM6VS+pRvMwSrcWckOcrsVb6nsXBqt40xL3f5DV X-Developer-Key: i=ackerleytng@google.com; a=ed25519; pk=sAZDYXdm6Iz8FHitpHeFlCMXwabodTm7p8/3/8xUxuU= X-Endpoint-Received: by B4 Relay for ackerleytng@google.com/20260225 with auth_id=649 X-Original-From: Ackerley Tng Reply-To: ackerleytng@google.com From: Ackerley Tng When reserving pages for a mapping fails during global accounting, the error path rolls back the adjustments made to the subpool. Currently, this rollback was performed in two separate steps: 1. Returning only the portion of reservations originally satisfied from the subpool 2. Separately adjusting the subpool used pages counter for the portion that was requested from the global pool. In (1.), because the used pages counter had not yet been decremented for the global portion, the subpool observed an inflated used pages count. If the mount was configured with both a minimum size and a maximum size, this inflated count prevented the subpool from recognizing that usage fell below the minimum size guarantee. As a result, the subpool failed to restore its reserved pages counter and instead returned that a global reservation should be dropped. The mount-time reservation is permanently destroyed, leaving global reservation counts depleted and causing an underflow when the filesystem is eventually unmounted. Additionally, if concurrent threads modified subpool usage during the reservation attempt, calculating the rollback amount using stale local variables could cause global reservation counts to diverge. Now that used pages are always tracked within the subpool, return the entire requested page count to the subpool in a single call. Global reservations are then adjusted using the difference between the reservations originally requested and those returned, fixing the issues described above. Fixes: 1d3f9bb4c8af ("mm/hugetlb: restore failed global reservations to sub= pool") Cc: stable@vger.kernel.org Signed-off-by: Ackerley Tng --- mm/hugetlb.c | 49 +++++++++++++++++++++++-------------------------- 1 file changed, 23 insertions(+), 26 deletions(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 66b6601abb069..d84ef044d1346 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -6674,12 +6674,14 @@ long hugetlb_reserve_pages(struct inode *inode, struct vm_area_struct *vma, vma_flags_t vma_flags) { - long chg =3D -1, add =3D -1, spool_resv, gbl_resv; + long chg =3D -1, add =3D -1; struct hstate *h =3D hstate_inode(inode); struct hugepage_subpool *spool =3D subpool_inode(inode); struct resv_map *resv_map; struct hugetlb_cgroup *h_cg =3D NULL; - long gbl_reserve, regions_needed =3D 0; + long regions_needed =3D 0; + long gbl_resv_get; + long gbl_resv_put; int err; =20 /* This should never happen */ @@ -6754,9 +6756,9 @@ long hugetlb_reserve_pages(struct inode *inode, * the subpool has a minimum size, there may be some global * reservations already in place (gbl_reserve). */ - gbl_reserve =3D hugepage_subpool_get_pages(spool, chg); - if (gbl_reserve < 0) { - err =3D gbl_reserve; + gbl_resv_get =3D hugepage_subpool_get_pages(spool, chg); + if (gbl_resv_get < 0) { + err =3D gbl_resv_get; goto out_uncharge_cgroup; } =20 @@ -6764,7 +6766,7 @@ long hugetlb_reserve_pages(struct inode *inode, * Check enough hugepages are available for the reservation. * Hand the pages back to the subpool if there are not */ - err =3D hugetlb_acct_memory(h, gbl_reserve); + err =3D hugetlb_acct_memory(h, gbl_resv_get); if (err < 0) goto out_put_pages; =20 @@ -6783,7 +6785,7 @@ long hugetlb_reserve_pages(struct inode *inode, add =3D region_add(resv_map, from, to, regions_needed, h, h_cg); =20 if (unlikely(add < 0)) { - hugetlb_acct_memory(h, -gbl_reserve); + hugetlb_acct_memory(h, -gbl_resv_get); err =3D add; goto out_put_pages; } else if (unlikely(chg > add)) { @@ -6819,26 +6821,21 @@ long hugetlb_reserve_pages(struct inode *inode, } return chg; =20 -out_put_pages: - spool_resv =3D chg - gbl_reserve; - if (spool_resv) { - /* put sub pool's reservation back, chg - gbl_reserve */ - gbl_resv =3D hugepage_subpool_put_pages(spool, spool_resv); - /* - * subpool's reserved pages can not be put back due to race, - * return to hstate. - */ - hugetlb_acct_memory(h, -gbl_resv); - } - /* Restore used_hpages for pages that failed global reservation */ - if (gbl_reserve && spool) { - unsigned long flags; + out_put_pages: + /* + * Return all that was requested from the subpool, let subpool + * tell us the new number of reservations that need to be + * returned to the global pool. + */ + gbl_resv_put =3D hugepage_subpool_put_pages(spool, chg); + /* + * There may be a difference between the number of + * reservations to consume and the number to restore now if + * there are multiple threads interacting with the subpool - + * restore the difference. + */ + hugetlb_acct_memory(h, gbl_resv_get - gbl_resv_put); =20 - spin_lock_irqsave(&spool->lock, flags); - if (spool->max_hpages !=3D -1) - spool->used_hpages -=3D gbl_reserve; - unlock_or_release_subpool(spool, flags); - } out_uncharge_cgroup: hugetlb_cgroup_uncharge_cgroup_rsvd(hstate_index(h), chg * pages_per_huge_page(h), h_cg); --=20 2.55.0.970.g62bdec98f9-goog From nobody Sat Sep 26 09:20:36 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 42A5D455636; Wed, 2 Sep 2026 23:30:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788391852; cv=none; b=UvCfATjJ2FQytT1j+u5iWH0IULTGs1Mi4NFvhmhYrMqgINCY/A5iwTFokEHOi/1kJjNngKTh07XyFbpLQ/liUNWxpNbJRBIWWzwyFSvCII17A5Rho9hOqZ+SRyY+ML/Q6zFnBMvOkc0oYGnACPIfBfbEEKUjzhRiwHQlfHARLtI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788391852; c=relaxed/simple; bh=oLR6Ku5sA1PLxnjgFaINq5dHEjo3Hkd8Pu3Eio5YYSM=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=GZgZJIlI4/22iM8gf/R6ZeMGI9P49DY7CpFSb5L1bOTayY9wGTaHqbTjRLWMfRHxG0eYLaHFGCBtwqu5mX/PBpGj3qu8wC6TNWdvd/xnhsy2XtmSPDkUF9ChJT/69s8y/y7nSuNPwuxAjckZ3c5TjeRCxn8v2+Y/yZtiYhTmcCg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Rno6fSfE; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Rno6fSfE" Received: by smtp.kernel.org (Postfix) with ESMTPS id CFB47C2BCFB; Wed, 2 Sep 2026 23:30:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1788391851; bh=oLR6Ku5sA1PLxnjgFaINq5dHEjo3Hkd8Pu3Eio5YYSM=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=Rno6fSfEq5GMtAWQldGkAOdgGvP86M8o814pKhaHuGbEcFJRyvCVuzd0aYDfp7UbM lBEbwJMOTh9VzoEwh0NQkyj5suoHeU20T4FTUqFupbQ6+xvWcZyruvmPDat4J6h3ex pgAvsyFT1qPaVjrvgQOA0eknXut5lfmbB1RDyUupXTryILYKy5JVJk4rPgE1DqvobQ mvZWjKmfVuHhhSlsw8M+P7xBgB+LODN/geScKQ/aRZUVSIe4Uwvu12v0QuIoY8swkZ rOl8ZowG2qPXdvL5y0aVjG92wBDWaQbfBKO9XifFu0yXScgfD+HV1hsfOI5d51o5X6 fA0XecuD3W/9g== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id BADA4C624D4; Wed, 2 Sep 2026 23:30:51 +0000 (UTC) From: Ackerley Tng via B4 Relay Date: Wed, 02 Sep 2026 16:30:49 -0700 Subject: [PATCH 3/3] mm: hugetlb: Fix subpool usage leak on allocation failure Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260902-hugetlb-subpool-always-track-used-v1-3-de1cd14bd713@google.com> References: <20260902-hugetlb-subpool-always-track-used-v1-0-de1cd14bd713@google.com> In-Reply-To: <20260902-hugetlb-subpool-always-track-used-v1-0-de1cd14bd713@google.com> To: Alex Shi , Andrew Morton , David Hildenbrand , Dongliang Mu , Hongxiang Lou , Johannes Weiner , Jonathan Corbet , Joshua Hahn , "Liam R. Howlett" , Lorenzo Stoakes , Miaohe Lin , Michal Hocko , Mike Rapoport , Muchun Song , Nhat Pham , Oscar Salvador , Peter Xu , Randy Dunlap , Roman Gushchin , Shakeel Butt , Shuah Khan , Suren Baghdasaryan , Usama Arif , Vlastimil Babka , Wupeng Ma , Yanteng Si , fvdl@google.com, jthoughton@google.com, rientjes@google.com, vannapurve@google.com Cc: linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, Ackerley Tng , stable@vger.kernel.org X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1788391851; l=3568; i=ackerleytng@google.com; s=20260225; h=from:subject:message-id; bh=tOiKIJk4lCf4MxbAJGBewXo+Umkms5osEmNl/iOM9Fg=; b=k/ppmJwUIxnr7mkxBDZiMKZAiR+XSgPaNyo312BYQpvGcs049LcEqLMitF0MLO+p5YCizSbZh W0d7UofDCOSAEq9m0a7EZnsZBaNFaQkP35qjQzRIgkV5WdzV7I9j3Ol X-Developer-Key: i=ackerleytng@google.com; a=ed25519; pk=sAZDYXdm6Iz8FHitpHeFlCMXwabodTm7p8/3/8xUxuU= X-Endpoint-Received: by B4 Relay for ackerleytng@google.com/20260225 with auth_id=649 X-Original-From: Ackerley Tng Reply-To: ackerleytng@google.com From: Ackerley Tng When folio allocation fails early (e.g. buddy allocation failure or cgroup charging failure) and a reservation was not used (meaning an unreserved global page was needed), the subpool page acquired during the allocation attempt must still be returned. Currently, the subpool cleanup error path only returns the page to the subpool if a reservation was used. If no reservation was used, it skips releasing the page back to the subpool, permanently leaking the subpool's used pages counter. With subpools now always tracking used pages, always release the page back to the subpool whenever a subpool page was acquired. Opportunistically rename the local variables tracking global reservations needed and global reservations returned. This clarifies the accounting: a value of zero for needed global reservations indicates an existing reservation satisfies the allocation, while a non-zero value indicates new global pages are required. Adjust global reservations using the difference between reservations needed and reservations returned to properly handle races where concurrent threads interact with the same subpool. Fixes: a833a693a490 ("mm: hugetlb: fix incorrect fallback for subpool") Cc: stable@vger.kernel.org Signed-off-by: Ackerley Tng --- mm/hugetlb.c | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index d84ef044d1346..e24f856c949c3 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -2955,7 +2955,7 @@ struct folio *alloc_hugetlb_folio(struct vm_area_stru= ct *vma, struct hugepage_subpool *spool =3D subpool_vma(vma); struct hstate *h =3D hstate_vma(vma); struct folio *folio; - long retval, gbl_chg, gbl_reserve; + long retval, gbl_resv_get; map_chg_state map_chg; struct mempolicy_interpreted mpoli; gfp_t gfp =3D htlb_alloc_mask(h); @@ -2994,8 +2994,8 @@ struct folio *alloc_hugetlb_folio(struct vm_area_stru= ct *vma, * Or if it can get one from the pool reservation directly. */ if (map_chg) { - gbl_chg =3D hugepage_subpool_get_pages(spool, 1); - if (gbl_chg < 0) { + gbl_resv_get =3D hugepage_subpool_get_pages(spool, 1); + if (gbl_resv_get < 0) { ret =3D -ENOSPC; goto out_end_reservation; } @@ -3004,7 +3004,7 @@ struct folio *alloc_hugetlb_folio(struct vm_area_stru= ct *vma, * If we have the vma reservation ready, no need for extra * global reservation. */ - gbl_chg =3D 0; + gbl_resv_get =3D 0; } =20 /* @@ -3015,10 +3015,10 @@ struct folio *alloc_hugetlb_folio(struct vm_area_st= ruct *vma, alloc_flags |=3D HUGETLB_ALLOC_CHARG_CGROUP_RSVD; =20 /* - * gbl_chg =3D=3D 0 indicates a reservation exists for this + * gbl_resv_get =3D=3D 0 indicates a reservation exists for this * allocation, so try to use it. */ - if (gbl_chg =3D=3D 0) + if (gbl_resv_get =3D=3D 0) alloc_flags |=3D HUGETLB_ALLOC_USE_GLOBAL_RESERVATIONS; =20 /* Takes reference on mpol. */ @@ -3072,13 +3072,10 @@ struct folio *alloc_hugetlb_folio(struct vm_area_st= ruct *vma, return folio; =20 out_subpool_put: - /* - * put page to subpool iff the quota of subpool's rsv_hpages is used - * during hugepage_subpool_get_pages. - */ - if (map_chg && !gbl_chg) { - gbl_reserve =3D hugepage_subpool_put_pages(spool, 1); - hugetlb_acct_memory(h, -gbl_reserve); + if (map_chg) { + long gbl_resv_put =3D hugepage_subpool_put_pages(spool, 1); + + hugetlb_acct_memory(h, gbl_resv_get - gbl_resv_put); } =20 out_end_reservation: --=20 2.55.0.970.g62bdec98f9-goog