From nobody Fri Sep 25 04:09:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 94D374963CF; Wed, 16 Sep 2026 23:39:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789601946; cv=none; b=AsBJU5gK91apn4trHkk/Fnpb1RCC9hq8bxxAooKYw1htUWhwmEFgGW4Aet0EKCsMR3OqSxX7wN3MBGwOrQzrptX7ASo9GLzVnudg4B44+2F0FC7Lp3lA2Wsv0C1Gc9djXeEUSyxJcckhVAJiuXKWMdTusTPiLLFpIPWgcgqaS2o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789601946; c=relaxed/simple; bh=n3E3ITbJt2F0ATINujb758jtbhACRD+OXMDt7pKPpxw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=X/JHWRR6rfidTdd+HRP+JSYQsSWBlb2IQXPYDSz/Vv4pJWKB9HqVkioYSTtSy8bpAJCkWNNu6bYdANpdP2Jf2kYVmR3dnN/Fh8dgHZakg2Ln0WvFlyCN3kRciTwMnbvgaCwomuCjjiv7L4XlyuANAK+ul4TkvRAIpGImx+WSmdM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=f1z5CZls; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="f1z5CZls" Received: by smtp.kernel.org (Postfix) with ESMTPS id 218FCC2BCF7; Wed, 16 Sep 2026 23:39:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1789601946; bh=n3E3ITbJt2F0ATINujb758jtbhACRD+OXMDt7pKPpxw=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=f1z5CZlsEaFnb82imS3fpFJauY49vm5e300pO6TQjgFW0A85lvsjfcechGUmyMF3h uOB472mB4K3fKPGHDK+GbclXgxrV+BRPzjgFhj+RLHViIN1uZlIYM+q6UXZbIBJURa g8zUxCL6XxqTka+WQxLW9Lal7YEpSUGw0znmjArqDmLolt6nla5Q5fEUu7ezp1/LxO JFv3SkHo1r3xgDL2sLKPmVDQZb7p1kaTsYQUPl5A2v8oY434klCRRR5hCRS49chlnk /047LxEDeGNiZYvkynCA/s7/XD3MksoZ8mGAXFg0u088uqLHj5wtSGTH7gTp1rXNOw cNqS92g1G5cow== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id F2F98C982C1; Wed, 16 Sep 2026 23:39:05 +0000 (UTC) From: Ackerley Tng via B4 Relay Date: Wed, 16 Sep 2026 16:39:01 -0700 Subject: [PATCH v3 1/4] mm: hugetlb: Track used_hpages when getting/putting pages from subpool Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260916-hugetlb-subpool-always-track-used-v3-1-38aae9b5ccdd@google.com> References: <20260916-hugetlb-subpool-always-track-used-v3-0-38aae9b5ccdd@google.com> In-Reply-To: <20260916-hugetlb-subpool-always-track-used-v3-0-38aae9b5ccdd@google.com> To: Alex Shi , Andrew Morton , David Hildenbrand , Dongliang Mu , Hongxiang Lou , Johannes Weiner , Jonathan Corbet , Joshua Hahn , "Liam R. Howlett" , Lorenzo Stoakes , Miaohe Lin , Michal Hocko , Mike Rapoport , Muchun Song , Nhat Pham , Oscar Salvador , Peter Xu , Randy Dunlap , Roman Gushchin , Shakeel Butt , Shuah Khan , Suren Baghdasaryan , Usama Arif , Vlastimil Babka , Wupeng Ma , Yanteng Si , Naoya Horiguchi , fvdl@google.com, jthoughton@google.com, rientjes@google.com, vannapurve@google.com Cc: linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, Ackerley Tng , stable@vger.kernel.org X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1789601945; l=14450; i=ackerleytng@google.com; s=20260225; h=from:subject:message-id; bh=1rJLxc1vQs+7R3iQxLs6DJhbnCNS1veJoZJ6u64m6UE=; b=p+Y+YmKHxOPhydDivUi3pXAIbjicZ4mIXrvwEKxw0Fz1syw4o01FWso8Z2ePGDeUQ0DBDIsjE 0lOb3CkL9W7BuoI2stEDqkMEkocf5UjhQU7MGeTr89mBx7yICqXut+/ X-Developer-Key: i=ackerleytng@google.com; a=ed25519; pk=sAZDYXdm6Iz8FHitpHeFlCMXwabodTm7p8/3/8xUxuU= X-Endpoint-Received: by B4 Relay for ackerleytng@google.com/20260225 with auth_id=649 X-Original-From: Ackerley Tng Reply-To: ackerleytng@google.com From: Ackerley Tng HugeTLB subpools currently only track used pages (used_hpages) when a maximum size limit (max_hpages) is configured. This breaks minimum size (min_hpages) guarantees. The subpool guarantee requires that the sum of used pages and remaining subpool reserves satisfies the configured minimum: used_hpages + rsv_hpages >=3D min_hpages where used_hpages includes both allocated folios and active reservations. Therefore, when pages or reservations are released, the maximum number of reservations the subpool can absorb is: limit =3D max(0, min_hpages - used_hpages) When used_hpages is untracked and remains zero, hugepage_subpool_put_pages() assumes limit =3D=3D min_hpages. It falsely restores reservations to the subpool even when existing allocations already satisfy the guarantee. This false restoration leads to: 1. Leaked global reservations: resv_huge_pages is not decremented, reducing the huge pages available for use across the host. 2. Premature freeing: the subpool considers itself unreferenced on unmount (rsv_hpages =3D=3D min_hpages), freeing the subpool while folios are still active in page cache and leading to a use-after-free. Fix this by unconditionally tracking used_hpages in the subpool, and capping the reservations the subpool can absorb to (min_hpages - used_hpages). With used_hpages always tracked: - subpool_is_free() is simplified to check whether used_hpages is zero. - hugetlbfs_statfs() is updated to explicitly check for max_hpages =3D=3D -= 1; previously it relied on (-1 - 0) evaluating to -1, which would now underflow and report negative free block counts. Trace of a false restoration: 1. Mount time: + spool->min_hpages =3D 1 (user requested min_size=3D2M) + spool->max_hpages =3D -1 (no maximum size specified) + spool->rsv_hpages =3D 1 (reserve min_hpages) + spool->used_hpages =3D 0 (untracked when max_hpages =3D=3D -1) + h->resv_huge_pages =3D 1 (reserved by hugetlb_acct_memory(h, 1)) 2. Shared mapping of 4MB (2 pages) created (mmap with MAP_SHARED): + In hugetlb_reserve_pages(), region_chg() finds chg =3D 2 (pages 0 and 1 need reservations) + hugepage_subpool_get_pages(spool, 2): + spool->rsv_hpages =3D 0 (consumed the 1 subpool reservation) + Returns 1 (since this subpool only had 1 reservation) + hugetlb_acct_memory(h, 1): + h->resv_huge_pages =3D 2 (incremented from 1 to 2 for the global reservation) + region_add() records reservations for pages 0 and 1 in resv_map 3. Process touches and populates Page 0: + hugetlb_no_page() calls alloc_hugetlb_folio() + Page 0 reuses the existing reservation (vma_needs_reservation() returns 0 =3D> map_chg =3D MAP_CHG_REUSE =3D 0) + hugepage_subpool_get_pages() is not called (map_chg =3D=3D 0) + dequeue_hugetlb_folio_nodemask() consumes 1 reservation: h->resv_huge_pages =3D 1 (decremented from 2 to 1) 4. Process closes the file and exits: + For MAP_SHARED mappings, reservations persist in inode resv_map + Page 1 reservation remains active + h->resv_huge_pages =3D 1 (retained for Page 1) 5. File is truncated to 2MB (truncate -s 2M): + Truncation invokes remove_inode_hugepages() for range [1, LONG_MAX) + Page 1 was never faulted into page cache =3D> freed =3D 0 + Calls hugetlb_unreserve_pages(inode, 1, LONG_MAX, freed =3D 0) + region_del() removes Page 1 from resv_map =3D> chg =3D 1 6. Inside hugetlb_unreserve_pages(): hugepage_subpool_put_pages(1): + delta =3D chg - freed =3D 1 - 0 =3D 1 + Because spool->max_hpages =3D=3D -1, spool->used_hpages always =3D 0 + spool->used_hpages < spool->min_hpages (0 < 1 =3D> true) <<=3D=3D subpool assumes 0 pages are in use, ignoring allocated Page 0 + spool->rsv_hpages + delta <=3D spool->min_hpages (0 + 1 <=3D 1 =3D> t= rue) + spool->rsv_hpages +=3D 1 =3D> spool->rsv_hpages =3D 1 <<=3D=3D false reservation restored to subpool + Returns 0 (subpool absorbed the reservation) 7. Back in hugetlb_unreserve_pages(): hugetlb_acct_memory(): + hugetlb_acct_memory(h, -0) does nothing + h->resv_huge_pages remains stuck at 1 even though both reservations have ended (Page 0 allocated, Page 1 truncated) 8. Later during unmounting: + subpool_is_free() checks spool->rsv_hpages =3D=3D spool->min_hpages (1 =3D=3D 1 =3D> true) + The subpool is erroneously considered completely free + hugetlb_acct_memory(spool->hstate, -spool->min_hpages) decrements h->resv_huge_pages by 1 (1 - 1 =3D 0), masking the leak on unmount 9. If the folio outlives the inode: + When Page 0 is freed, free_huge_folio() attempts to access the freed subpool pointer, leading to a use-after-free and double-free. Fixes: 09a95e29cb30 ("mm/hugetlb: optimize minimum size (min_size) accounti= ng") Fixes: 1c5ecae3a93fa ("hugetlbfs: add minimum size accounting to subpools") Signed-off-by: Ackerley Tng Reviewed-by: Joshua Hahn Cc: stable@vger.kernel.org --- Documentation/mm/hugetlbfs_reserv.rst | 17 +---- .../translations/zh_CN/mm/hugetlbfs_reserv.rst | 11 +--- fs/hugetlbfs/inode.c | 8 ++- include/linux/hugetlb.h | 4 +- mm/hugetlb.c | 73 +++++++++++++-----= ---- 5 files changed, 55 insertions(+), 58 deletions(-) diff --git a/Documentation/mm/hugetlbfs_reserv.rst b/Documentation/mm/huget= lbfs_reserv.rst index a49115db18c76..d244583fdcbc3 100644 --- a/Documentation/mm/hugetlbfs_reserv.rst +++ b/Documentation/mm/hugetlbfs_reserv.rst @@ -314,21 +314,8 @@ huge pages. If they can not be reserved, the mount fa= ils. The routines hugepage_subpool_get/put_pages() are called when pages are obtained from or released back to a subpool. They perform all subpool accounting, and track any reservations associated with the subpool. -hugepage_subpool_get/put_pages are passed the number of huge pages by which -to adjust the subpool 'used page' count (down for get, up for put). Norma= lly, -they return the same value that was passed or an error if not enough pages -exist in the subpool. - -However, if reserves are associated with the subpool a return value less -than the passed value may be returned. This return value indicates the -number of additional global pool adjustments which must be made. For exam= ple, -suppose a subpool contains 3 reserved huge pages and someone asks for 5. -The 3 reserved pages associated with the subpool can be used to satisfy pa= rt -of the request. But, 2 pages must be obtained from the global pools. To -relay this information to the caller, the value 2 is returned. The caller -is then responsible for attempting to obtain the additional two pages from -the global pools. - +hugepage_subpool_get/put_pages() use the number of huge pages passed to ad= just +the subpool 'used page' count. =20 COW and Reservations =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D diff --git a/Documentation/translations/zh_CN/mm/hugetlbfs_reserv.rst b/Doc= umentation/translations/zh_CN/mm/hugetlbfs_reserv.rst index 20947f8bd0654..ae1f1f31477fc 100644 --- a/Documentation/translations/zh_CN/mm/hugetlbfs_reserv.rst +++ b/Documentation/translations/zh_CN/mm/hugetlbfs_reserv.rst @@ -246,15 +246,8 @@ hugepage_subpool=E7=9A=84min_hpages=E5=AD=97=E6=AE=B5= =E4=B8=AD=E8=A2=AB=E8=B7=9F=E8=B8=AA=E3=80=82=E5=9C=A8=E6=8C=82=E8=BD=BD=E6= =97=B6=EF=BC=8Chugetlb_acct_me =E8=A2=AB=E8=B0=83=E7=94=A8=E4=BB=A5=E9=A2=84=E7=95=99=E6=8C=87=E5=AE=9A= =E6=95=B0=E9=87=8F=E7=9A=84=E5=B7=A8=E9=A1=B5=E3=80=82=E5=A6=82=E6=9E=9C=E5= =AE=83=E4=BB=AC=E4=B8=8D=E8=83=BD=E8=A2=AB=E9=A2=84=E7=95=99=EF=BC=8C=E6=8C= =82=E8=BD=BD=E5=B0=B1=E4=BC=9A=E5=A4=B1=E8=B4=A5=E3=80=82 =20 =E5=BD=93=E4=BB=8E=E5=AD=90=E6=B1=A0=E4=B8=AD=E8=8E=B7=E5=8F=96=E6=88=96= =E9=87=8A=E6=94=BE=E9=A1=B5=E9=9D=A2=E6=97=B6=EF=BC=8C=E4=BC=9A=E8=B0=83=E7= =94=A8hugepage_subpool_get/put_pages()=E5=87=BD=E6=95=B0=E3=80=82 -hugepage_subpool_get/put_pages=E8=A2=AB=E4=BC=A0=E9=80=92=E7=BB=99=E5=B7= =A8=E9=A1=B5=E6=95=B0=E9=87=8F=EF=BC=8C=E4=BB=A5=E6=AD=A4=E6=9D=A5=E8=B0=83= =E6=95=B4=E5=AD=90=E6=B1=A0=E7=9A=84 =E2=80=9C=E5=B7=B2=E7=94=A8=E9=A1=B5= =E9=9D=A2=E2=80=9D =E8=AE=A1=E6=95=B0 -=EF=BC=88get=E4=B8=BA=E4=B8=8B=E9=99=8D=EF=BC=8Cput=E4=B8=BA=E4=B8=8A=E5= =8D=87=EF=BC=89=E3=80=82=E9=80=9A=E5=B8=B8=E6=83=85=E5=86=B5=E4=B8=8B=EF=BC= =8C=E5=A6=82=E6=9E=9C=E5=AD=90=E6=B1=A0=E4=B8=AD=E6=B2=A1=E6=9C=89=E8=B6=B3= =E5=A4=9F=E7=9A=84=E9=A1=B5=E9=9D=A2=EF=BC=8C=E5=AE=83=E4=BB=AC=E4=BC=9A=E8= =BF=94=E5=9B=9E=E4=B8=8E=E4=BC=A0=E9=80=92=E7=9A=84=E7=9B=B8=E5=90=8C=E7=9A= =84=E5=80=BC=E6=88=96 -=E4=B8=80=E4=B8=AA=E9=94=99=E8=AF=AF=E3=80=82 - -=E7=84=B6=E8=80=8C=EF=BC=8C=E5=A6=82=E6=9E=9C=E9=A2=84=E7=95=99=E4=B8=8E= =E5=AD=90=E6=B1=A0=E7=9B=B8=E5=85=B3=E8=81=94=EF=BC=8C=E5=8F=AF=E8=83=BD=E4= =BC=9A=E8=BF=94=E5=9B=9E=E4=B8=80=E4=B8=AA=E5=B0=8F=E4=BA=8E=E4=BC=A0=E9=80= =92=E5=80=BC=E7=9A=84=E8=BF=94=E5=9B=9E=E5=80=BC=E3=80=82=E8=BF=99=E4=B8=AA= =E8=BF=94=E5=9B=9E=E5=80=BC=E8=A1=A8=E7=A4=BA=E5=BF=85=E9=A1=BB=E8=BF=9B=E8= =A1=8C=E7=9A=84=E9=A2=9D=E5=A4=96=E5=85=A8=E5=B1=80 -=E6=B1=A0=E8=B0=83=E6=95=B4=E7=9A=84=E6=95=B0=E9=87=8F=E3=80=82=E4=BE=8B= =E5=A6=82=EF=BC=8C=E5=81=87=E8=AE=BE=E4=B8=80=E4=B8=AA=E5=AD=90=E6=B1=A0=E5= =8C=85=E5=90=AB3=E4=B8=AA=E9=A2=84=E7=95=99=E7=9A=84=E5=B7=A8=E9=A1=B5=EF= =BC=8C=E6=9C=89=E4=BA=BA=E8=A6=81=E6=B1=825=E4=B8=AA=E3=80=82=E4=B8=8E=E5= =AD=90=E6=B1=A0=E7=9B=B8=E5=85=B3=E7=9A=843=E4=B8=AA=E9=A2=84=E7=95=99=E9= =A1=B5=E5=8F=AF=E4=BB=A5=E7=94=A8=E6=9D=A5 -=E6=BB=A1=E8=B6=B3=E9=83=A8=E5=88=86=E8=AF=B7=E6=B1=82=E3=80=82=E4=BD=86= =E6=98=AF=EF=BC=8C=E5=BF=85=E9=A1=BB=E4=BB=8E=E5=85=A8=E5=B1=80=E6=B1=A0=E4= =B8=AD=E8=8E=B7=E5=BE=972=E4=B8=AA=E9=A1=B5=E9=9D=A2=E3=80=82=E4=B8=BA=E4= =BA=86=E5=90=91=E8=B0=83=E7=94=A8=E8=80=85=E8=BD=AC=E8=BE=BE=E8=BF=99=E4=B8= =80=E4=BF=A1=E6=81=AF=EF=BC=8C=E5=B0=86=E8=BF=94=E5=9B=9E=E5=80=BC2=E3=80= =82=E7=84=B6=E5=90=8E=EF=BC=8C=E8=B0=83=E7=94=A8 -=E8=80=85=E8=A6=81=E8=B4=9F=E8=B4=A3=E4=BB=8E=E5=85=A8=E5=B1=80=E6=B1=A0= =E4=B8=AD=E8=8E=B7=E5=8F=96=E5=8F=A6=E5=A4=96=E4=B8=A4=E4=B8=AA=E9=A1=B5=E9= =9D=A2=E3=80=82 - +=E5=AE=83=E4=BB=AC=E8=B4=9F=E8=B4=A3=E6=89=80=E6=9C=89=E5=AD=90=E6=B1=A0= =E7=9A=84=E7=BB=9F=E8=AE=A1=E6=A0=B8=E7=AE=97=EF=BC=8C=E5=B9=B6=E8=B7=9F=E8= =B8=AA=E4=B8=8E=E5=AD=90=E6=B1=A0=E7=9B=B8=E5=85=B3=E8=81=94=E7=9A=84=E9=A2= =84=E7=95=99=E3=80=82 +hugepage_subpool_get/put_pages()=E5=87=BD=E6=95=B0=E4=BD=BF=E7=94=A8=E4=BC= =A0=E5=85=A5=E7=9A=84=E5=B7=A8=E9=A1=B5=E6=95=B0=E9=87=8F=E6=9D=A5=E8=B0=83= =E6=95=B4=E5=AD=90=E6=B1=A0=E7=9A=84=E2=80=9C=E5=B7=B2=E7=94=A8=E9=A1=B5=E9= =9D=A2=E2=80=9D=E8=AE=A1=E6=95=B0=E3=80=82 =20 COW=E5=92=8C=E9=A2=84=E7=95=99 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c index 7611a8470ea26..5113f743f6fc7 100644 --- a/fs/hugetlbfs/inode.c +++ b/fs/hugetlbfs/inode.c @@ -1109,8 +1109,12 @@ static int hugetlbfs_statfs(struct dentry *dentry, s= truct kstatfs *buf) =20 spin_lock_irq(&sbinfo->spool->lock); buf->f_blocks =3D sbinfo->spool->max_hpages; - free_pages =3D sbinfo->spool->max_hpages - - sbinfo->spool->used_hpages; + if (sbinfo->spool->max_hpages =3D=3D -1) { + free_pages =3D -1; + } else { + free_pages =3D sbinfo->spool->max_hpages - + sbinfo->spool->used_hpages; + } buf->f_bavail =3D buf->f_bfree =3D free_pages; spin_unlock_irq(&sbinfo->spool->lock); buf->f_files =3D sbinfo->max_inodes; diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h index 16c4c4caa126c..4551ff3023640 100644 --- a/include/linux/hugetlb.h +++ b/include/linux/hugetlb.h @@ -39,8 +39,8 @@ struct hugepage_subpool { spinlock_t lock; long count; long max_hpages; /* Maximum huge pages or -1 if no maximum. */ - long used_hpages; /* Used count against maximum, includes */ - /* both allocated and reserved pages. */ + long used_hpages; /* Used page count, includes both */ + /* allocated and reserved pages. */ struct hstate *hstate; long min_hpages; /* Minimum huge pages or -1 if no minimum. */ long rsv_hpages; /* Pages reserved against global pool to */ diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 4f6f58bf3db6c..e72e22f887478 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -130,12 +130,8 @@ static inline bool subpool_is_free(struct hugepage_sub= pool *spool) { if (spool->count) return false; - if (spool->max_hpages !=3D -1) - return spool->used_hpages =3D=3D 0; - if (spool->min_hpages !=3D -1) - return spool->rsv_hpages =3D=3D spool->min_hpages; =20 - return true; + return spool->used_hpages =3D=3D 0; } =20 static inline void unlock_or_release_subpool(struct hugepage_subpool *spoo= l, @@ -193,13 +189,18 @@ void hugepage_put_subpool(struct hugepage_subpool *sp= ool) unlock_or_release_subpool(spool, flags); } =20 -/* - * Subpool accounting for allocating and reserving pages. - * Return -ENOMEM if there are not enough resources to satisfy the - * request. Otherwise, return the number of pages by which the - * global pools must be adjusted (upward). The returned value may - * only be different than the passed value (delta) in the case where - * a subpool minimum size must be maintained. +/** + * hugepage_subpool_get_pages - Get pages from a subpool + * @spool: pointer to subpool structure (may be NULL) + * @delta: number of pages to allocate or reserve + * + * Check and update subpool page usage counts when allocating or + * reserving @delta hugepages. + * + * Context: Takes spool->lock using spin_lock_irq(). + * Return: Non-negative number of reservations that cannot be + * satisfied by the subpool, or -ENOMEM if the subpool maximum + * limit would be exceeded. */ static long hugepage_subpool_get_pages(struct hugepage_subpool *spool, long delta) @@ -211,15 +212,14 @@ static long hugepage_subpool_get_pages(struct hugepag= e_subpool *spool, =20 spin_lock_irq(&spool->lock); =20 - if (spool->max_hpages !=3D -1) { /* maximum size accounting */ - if ((spool->used_hpages + delta) <=3D spool->max_hpages) - spool->used_hpages +=3D delta; - else { - ret =3D -ENOMEM; - goto unlock_ret; - } + if (spool->max_hpages !=3D -1 && + spool->used_hpages + delta > spool->max_hpages) { + ret =3D -ENOMEM; + goto unlock_ret; } =20 + spool->used_hpages +=3D delta; + /* minimum size accounting */ if (spool->min_hpages !=3D -1 && spool->rsv_hpages) { if (delta > spool->rsv_hpages) { @@ -240,11 +240,19 @@ static long hugepage_subpool_get_pages(struct hugepag= e_subpool *spool, return ret; } =20 -/* - * Subpool accounting for freeing and unreserving pages. - * Return the number of global page reservations that must be dropped. - * The return value may only be different than the passed value (delta) - * in the case where a subpool minimum size must be maintained. +/** + * hugepage_subpool_put_pages - Release pages back to a subpool + * @spool: pointer to subpool structure (may be NULL) + * @delta: number of pages to free or unreserve + * + * Check and update subpool page usage counts when freeing or + * unreserving @delta hugepages. + * + * Context: Takes spool->lock using spin_lock_irqsave(). May release + * and free @spool if its usage count and references reach + * zero. + * Return: Non-negative number of reservations that the subpool cannot + * absorb. */ static long hugepage_subpool_put_pages(struct hugepage_subpool *spool, long delta) @@ -257,19 +265,24 @@ static long hugepage_subpool_put_pages(struct hugepag= e_subpool *spool, =20 spin_lock_irqsave(&spool->lock, flags); =20 - if (spool->max_hpages !=3D -1) /* maximum size accounting */ - spool->used_hpages -=3D delta; + spool->used_hpages -=3D delta; =20 /* minimum size accounting */ if (spool->min_hpages !=3D -1 && spool->used_hpages < spool->min_hpages) { - if (spool->rsv_hpages + delta <=3D spool->min_hpages) + /* + * limit is the maximum number of reservations that + * can be restored to this subpool. + */ + long limit =3D spool->min_hpages - spool->used_hpages; + + if (spool->rsv_hpages + delta <=3D limit) ret =3D 0; else - ret =3D spool->rsv_hpages + delta - spool->min_hpages; + ret =3D spool->rsv_hpages + delta - limit; =20 spool->rsv_hpages +=3D delta; - if (spool->rsv_hpages > spool->min_hpages) - spool->rsv_hpages =3D spool->min_hpages; + if (spool->rsv_hpages > limit) + spool->rsv_hpages =3D limit; } =20 /* --=20 2.55.0.1082.g2b9226bbc0-goog From nobody Fri Sep 25 04:09:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A46FD4B5150; Wed, 16 Sep 2026 23:39:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789601946; cv=none; b=MO7a9nfhfnXR2H3w57007xArbCmH/Nv1UyAbyNQuk5PLqE5njDplaYFue6L3qk0xft3bN4cpLQaD+R0rfb9FmYOQJ7Ivd142i5CqrH0MR7Nd+CuhhwD5qzQlm4HGOdSrpIIlxdJVPycGPKuaFTiT+qEfRDX5lhAkcd++sfjV2mM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789601946; c=relaxed/simple; bh=tsqf0aWLMOSwHnXHAdTX02Wxeb0NHizwCLMEWz/sUuI=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=ZOTRisvEwGFAW9o92dlvLTra/+wl2KZtLEMEnS52d2m3BV+D3Kcmkl6i98MumlMM9/ts5K6p/utVJPiqhJt15QloFC5e8n90iBm2yNkfJkF4diWCl6t9CXKH4MO0Wg+wryPdb3Yv+PU4kCftUWjjUm4pg+o1YYepgq/GhxrsqJ0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=e92l7mcC; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="e92l7mcC" Received: by smtp.kernel.org (Postfix) with ESMTPS id 328D0C2BCF5; Wed, 16 Sep 2026 23:39:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1789601946; bh=tsqf0aWLMOSwHnXHAdTX02Wxeb0NHizwCLMEWz/sUuI=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=e92l7mcCyLvFCvSdP+gQOJGEpnIArr3QpQLdShF+6mqjzhvhG7dyJYo0nPWI2zL0M bE3hENv4WBhfgLnfFiajWk9V3kgN6N2L+e42zVmOesaS8UcRfnp/3ekRtRlMUaIqJG TxPDKZpDXuSvljbtBHKnkiqNDEhfPoWdTyscHw9NDLBCRJQicIii0jO4cJiPs3q5ar UYmNPPUx6FitppsoLhBTUjhVLcXGvBMREvbKyW8CG6f7tTA8z0C8HvBr8ffG3Wkcje piG87SJxjRFcvJBtMNX0Y+TrbRXq0JAlgL1zK58qdkXI6EwmwDr+LUa2cgLzG+UGiO oHFLldgU0ujHw== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 111E0C982D1; Wed, 16 Sep 2026 23:39:06 +0000 (UTC) From: Ackerley Tng via B4 Relay Date: Wed, 16 Sep 2026 16:39:02 -0700 Subject: [PATCH v3 2/4] mm: hugetlb: Fix out_put_pages subpool reserve calculation Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260916-hugetlb-subpool-always-track-used-v3-2-38aae9b5ccdd@google.com> References: <20260916-hugetlb-subpool-always-track-used-v3-0-38aae9b5ccdd@google.com> In-Reply-To: <20260916-hugetlb-subpool-always-track-used-v3-0-38aae9b5ccdd@google.com> To: Alex Shi , Andrew Morton , David Hildenbrand , Dongliang Mu , Hongxiang Lou , Johannes Weiner , Jonathan Corbet , Joshua Hahn , "Liam R. Howlett" , Lorenzo Stoakes , Miaohe Lin , Michal Hocko , Mike Rapoport , Muchun Song , Nhat Pham , Oscar Salvador , Peter Xu , Randy Dunlap , Roman Gushchin , Shakeel Butt , Shuah Khan , Suren Baghdasaryan , Usama Arif , Vlastimil Babka , Wupeng Ma , Yanteng Si , Naoya Horiguchi , fvdl@google.com, jthoughton@google.com, rientjes@google.com, vannapurve@google.com Cc: linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, Ackerley Tng , stable@vger.kernel.org X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1789601945; l=4939; i=ackerleytng@google.com; s=20260225; h=from:subject:message-id; bh=hbCc1VLcSxFYUMlKbRMMvbXITCMyD6a9EHSLeup8DNs=; b=MH2U3Qi7wREMFL0fYx06ravkLlUdpLhlZGfCa/VY1ZApR995ImjP5LngSVOH3zHCLQXF1LY/w QoBsu4M7/krCg4sUbpsZ26aXy80XwK6XqvfTmoAoynkMZqkEAX6m0n7 X-Developer-Key: i=ackerleytng@google.com; a=ed25519; pk=sAZDYXdm6Iz8FHitpHeFlCMXwabodTm7p8/3/8xUxuU= X-Endpoint-Received: by B4 Relay for ackerleytng@google.com/20260225 with auth_id=649 X-Original-From: Ackerley Tng Reply-To: ackerleytng@google.com From: Ackerley Tng When reserving pages for a mapping fails during global accounting, the error path rolls back the adjustments made to the subpool. Currently, this rollback was performed in two separate steps: 1. Returning only the portion of reservations originally satisfied from the subpool 2. Separately adjusting the subpool used pages counter for the portion that was requested from the global pool. In (1.), because the used pages counter had not yet been decremented for the global portion, the subpool observed an inflated used pages count. If the mount was configured with both a minimum size and a maximum size, this inflated count prevented the subpool from recognizing that usage fell below the minimum size guarantee. As a result, the subpool failed to restore its reserved pages counter and instead returned that a global reservation should be dropped. The mount-time reservation is permanently destroyed, leaving global reservation counts depleted and causing an underflow when the filesystem is eventually unmounted. Additionally, if concurrent threads modified subpool usage during the reservation attempt, calculating the rollback amount using stale local variables could cause global reservation counts to diverge. Now that used pages are always tracked within the subpool, return the entire requested page count to the subpool in a single call. Global reservations are then adjusted using the difference between the reservations originally requested and those returned, fixing the issues described above. Fixes: 1d3f9bb4c8af ("mm/hugetlb: restore failed global reservations to sub= pool") Signed-off-by: Ackerley Tng Reviewed-by: Joshua Hahn Cc: stable@vger.kernel.org --- mm/hugetlb.c | 44 ++++++++++++++++++-------------------------- 1 file changed, 18 insertions(+), 26 deletions(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index e72e22f887478..faa799634822e 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -6676,12 +6676,14 @@ long hugetlb_reserve_pages(struct inode *inode, struct vm_area_struct *vma, vma_flags_t vma_flags) { - long chg =3D -1, add =3D -1, spool_resv, gbl_resv; + long chg =3D -1, add =3D -1; struct hstate *h =3D hstate_inode(inode); struct hugepage_subpool *spool =3D subpool_inode(inode); struct resv_map *resv_map; struct hugetlb_cgroup *h_cg =3D NULL; - long gbl_reserve, regions_needed =3D 0; + long regions_needed =3D 0; + long gbl_resv_get; + long gbl_resv_put; int err; =20 /* This should never happen */ @@ -6756,9 +6758,9 @@ long hugetlb_reserve_pages(struct inode *inode, * the subpool has a minimum size, there may be some global * reservations already in place (gbl_reserve). */ - gbl_reserve =3D hugepage_subpool_get_pages(spool, chg); - if (gbl_reserve < 0) { - err =3D gbl_reserve; + gbl_resv_get =3D hugepage_subpool_get_pages(spool, chg); + if (gbl_resv_get < 0) { + err =3D gbl_resv_get; goto out_uncharge_cgroup; } =20 @@ -6766,7 +6768,7 @@ long hugetlb_reserve_pages(struct inode *inode, * Check enough hugepages are available for the reservation. * Hand the pages back to the subpool if there are not */ - err =3D hugetlb_acct_memory(h, gbl_reserve); + err =3D hugetlb_acct_memory(h, gbl_resv_get); if (err < 0) goto out_put_pages; =20 @@ -6785,7 +6787,7 @@ long hugetlb_reserve_pages(struct inode *inode, add =3D region_add(resv_map, from, to, regions_needed, h, h_cg); =20 if (unlikely(add < 0)) { - hugetlb_acct_memory(h, -gbl_reserve); + hugetlb_acct_memory(h, -gbl_resv_get); err =3D add; goto out_put_pages; } else if (unlikely(chg > add)) { @@ -6821,26 +6823,16 @@ long hugetlb_reserve_pages(struct inode *inode, } return chg; =20 -out_put_pages: - spool_resv =3D chg - gbl_reserve; - if (spool_resv) { - /* put sub pool's reservation back, chg - gbl_reserve */ - gbl_resv =3D hugepage_subpool_put_pages(spool, spool_resv); - /* - * subpool's reserved pages can not be put back due to race, - * return to hstate. - */ - hugetlb_acct_memory(h, -gbl_resv); - } - /* Restore used_hpages for pages that failed global reservation */ - if (gbl_reserve && spool) { - unsigned long flags; + out_put_pages: + gbl_resv_put =3D hugepage_subpool_put_pages(spool, chg); + /* + * There may be a difference between the number of + * reservations to consume and the number to restore now if + * there are multiple threads interacting with the subpool - + * restore the difference. + */ + hugetlb_acct_memory(h, gbl_resv_get - gbl_resv_put); =20 - spin_lock_irqsave(&spool->lock, flags); - if (spool->max_hpages !=3D -1) - spool->used_hpages -=3D gbl_reserve; - unlock_or_release_subpool(spool, flags); - } out_uncharge_cgroup: hugetlb_cgroup_uncharge_cgroup_rsvd(hstate_index(h), chg * pages_per_huge_page(h), h_cg); --=20 2.55.0.1082.g2b9226bbc0-goog From nobody Fri Sep 25 04:09:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 957CE4AB3C3; Wed, 16 Sep 2026 23:39:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789601946; cv=none; b=jQGquShupWCJ5Wisrj9Hc6lqgjRBXboT65UWRfW/rc4SCTBexpjd12BrAYkKopUr87KKSkLwSLs7MOPBH4VzufH839B2HpizaUdW3rl/W835fPkyPQczqUSG9UvNbPxpXi6Yh5FsUHQDhRlV4DLB01JMhFEdepx/EA5YKN7GSfg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789601946; c=relaxed/simple; bh=RGoRX1RDyrSAPSAqGKaUAGbiwsMYJA9HpHkYiWFLIp8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=eS4M4xQqrhmbOUEgI2+VlwYN1QsQzyF85XnxOSHXSPgpmXkPFM7J5wwz/PPB1j61EnVPLpGBKxlX+1gsvSNGp40YI4pbI8TpXPVAnTa2lto7MJ0lER3+B2Uhi/2veRBCq4Sc6gGJF+VYIzvalQodbacb+TY3Btm6Y1s698nmbOY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=VXBnIcOa; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="VXBnIcOa" Received: by smtp.kernel.org (Postfix) with ESMTPS id 3E688C2BCFA; Wed, 16 Sep 2026 23:39:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1789601946; bh=RGoRX1RDyrSAPSAqGKaUAGbiwsMYJA9HpHkYiWFLIp8=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=VXBnIcOa9tsXw8aHWRjOcbObRrWnEoV+7dOdai+IBlx73005Ws5kQ/ZcfB16tQbBc r3drVeslTSqakRX2N4AN478pEz31lC0MDvaWQMav/oG70t/k80gd8ZKto/gDbX4KyM nVVryMu/4tX3kUheTgsfAPFbnfXdcHpdimnX27+JDDdpnt5rVxQ6MmcbZCEBewqD+H oX6IbBtNlQOYm6Ye7gReFpSrXOZ6KD1JhfNOFxvbTBhGz9xxLE0+DFdFVM+xxxk3Qa OAsM3dHKXlOPoakqq71njd9+4zAAUBR5IgLjXFBkQBuLlC+d+M36UvCypgO0Qe/ooF p80FGDaLrPSeg== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2370FC982D2; Wed, 16 Sep 2026 23:39:06 +0000 (UTC) From: Ackerley Tng via B4 Relay Date: Wed, 16 Sep 2026 16:39:03 -0700 Subject: [PATCH v3 3/4] mm: hugetlb: Fix subpool usage leak on allocation failure Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260916-hugetlb-subpool-always-track-used-v3-3-38aae9b5ccdd@google.com> References: <20260916-hugetlb-subpool-always-track-used-v3-0-38aae9b5ccdd@google.com> In-Reply-To: <20260916-hugetlb-subpool-always-track-used-v3-0-38aae9b5ccdd@google.com> To: Alex Shi , Andrew Morton , David Hildenbrand , Dongliang Mu , Hongxiang Lou , Johannes Weiner , Jonathan Corbet , Joshua Hahn , "Liam R. Howlett" , Lorenzo Stoakes , Miaohe Lin , Michal Hocko , Mike Rapoport , Muchun Song , Nhat Pham , Oscar Salvador , Peter Xu , Randy Dunlap , Roman Gushchin , Shakeel Butt , Shuah Khan , Suren Baghdasaryan , Usama Arif , Vlastimil Babka , Wupeng Ma , Yanteng Si , Naoya Horiguchi , fvdl@google.com, jthoughton@google.com, rientjes@google.com, vannapurve@google.com Cc: linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, Ackerley Tng , stable@vger.kernel.org X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1789601945; l=3621; i=ackerleytng@google.com; s=20260225; h=from:subject:message-id; bh=1huVTinJruMQqQrtxBHElgZ+G6QNS+uaPq2+mFiRl/Q=; b=3mwwcE8a0BxYqRtSkWGRir/QHbTfDAED/i3HhrT7HUL1zYfOt5B89NB41OlUu2HPPCHanEBUD yffVJCwwRoMC69yYDdiL0ZgGJdhEae4goGRkqNDknm0g/R51C1ZMoxI X-Developer-Key: i=ackerleytng@google.com; a=ed25519; pk=sAZDYXdm6Iz8FHitpHeFlCMXwabodTm7p8/3/8xUxuU= X-Endpoint-Received: by B4 Relay for ackerleytng@google.com/20260225 with auth_id=649 X-Original-From: Ackerley Tng Reply-To: ackerleytng@google.com From: Ackerley Tng When folio allocation fails early (e.g. buddy allocation failure or cgroup charging failure) and a reservation was not used (meaning an unreserved global page was needed), the subpool page acquired during the allocation attempt must still be returned. Currently, the subpool cleanup error path only returns the page to the subpool if a reservation was used. If no reservation was used, it skips releasing the page back to the subpool, permanently leaking the subpool's used pages counter. With subpools now always tracking used pages, always release the page back to the subpool whenever a subpool page was acquired. Opportunistically rename the local variables tracking global reservations needed and global reservations returned. This clarifies the accounting: a value of zero for needed global reservations indicates an existing reservation satisfies the allocation, while a non-zero value indicates new global pages are required. Adjust global reservations using the difference between reservations needed and reservations returned to properly handle races where concurrent threads interact with the same subpool. Fixes: a833a693a490 ("mm: hugetlb: fix incorrect fallback for subpool") Signed-off-by: Ackerley Tng Reviewed-by: Joshua Hahn Cc: stable@vger.kernel.org --- mm/hugetlb.c | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index faa799634822e..6589b188cf657 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -2957,7 +2957,7 @@ struct folio *alloc_hugetlb_folio(struct vm_area_stru= ct *vma, struct hugepage_subpool *spool =3D subpool_vma(vma); struct hstate *h =3D hstate_vma(vma); struct folio *folio; - long retval, gbl_chg, gbl_reserve; + long retval, gbl_resv_get; map_chg_state map_chg; struct mempolicy_interpreted mpoli; gfp_t gfp =3D htlb_alloc_mask(h); @@ -2996,8 +2996,8 @@ struct folio *alloc_hugetlb_folio(struct vm_area_stru= ct *vma, * Or if it can get one from the pool reservation directly. */ if (map_chg) { - gbl_chg =3D hugepage_subpool_get_pages(spool, 1); - if (gbl_chg < 0) { + gbl_resv_get =3D hugepage_subpool_get_pages(spool, 1); + if (gbl_resv_get < 0) { ret =3D -ENOSPC; goto out_end_reservation; } @@ -3006,7 +3006,7 @@ struct folio *alloc_hugetlb_folio(struct vm_area_stru= ct *vma, * If we have the vma reservation ready, no need for extra * global reservation. */ - gbl_chg =3D 0; + gbl_resv_get =3D 0; } =20 /* @@ -3017,10 +3017,10 @@ struct folio *alloc_hugetlb_folio(struct vm_area_st= ruct *vma, alloc_flags |=3D HUGETLB_ALLOC_CHARG_CGROUP_RSVD; =20 /* - * gbl_chg =3D=3D 0 indicates a reservation exists for this + * gbl_resv_get =3D=3D 0 indicates a reservation exists for this * allocation, so try to use it. */ - if (gbl_chg =3D=3D 0) + if (gbl_resv_get =3D=3D 0) alloc_flags |=3D HUGETLB_ALLOC_USE_GLOBAL_RESERVATIONS; =20 /* Takes reference on mpol. */ @@ -3074,13 +3074,10 @@ struct folio *alloc_hugetlb_folio(struct vm_area_st= ruct *vma, return folio; =20 out_subpool_put: - /* - * put page to subpool iff the quota of subpool's rsv_hpages is used - * during hugepage_subpool_get_pages. - */ - if (map_chg && !gbl_chg) { - gbl_reserve =3D hugepage_subpool_put_pages(spool, 1); - hugetlb_acct_memory(h, -gbl_reserve); + if (map_chg) { + long gbl_resv_put =3D hugepage_subpool_put_pages(spool, 1); + + hugetlb_acct_memory(h, gbl_resv_get - gbl_resv_put); } =20 out_end_reservation: --=20 2.55.0.1082.g2b9226bbc0-goog From nobody Fri Sep 25 04:09:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B025A4CC60D; Wed, 16 Sep 2026 23:39:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789601946; cv=none; b=lzOnuYDSiKML8zQlGaWQbIYmsQEc06qpJ/VNHzMOKO8gMdlsHg8qqMnOe4ir2HgmjW42J7xvez/RpMRTbZpI3iolsU8LKEIY9egMqUOpTbNjz4hjufQFb2sL1cXjxxADm5iGdnZJs3/GKzWKMU5WLub1vJdAkSIhjaf/4e0Kujo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789601946; c=relaxed/simple; bh=IhwjyvHVYrWOfbhr0n4oozYGOJcvz2hx+di9cgmtNYg=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=m+LZhQAKCUB1vf8li+vrA4N8Vgj0bOBXefLuUpo2bKg8dhIjwaas4y2o9LFCJBoNQW3/906BvVrJDB4Wkmwtp06I5mvVoVomr/fWboArg4bo6WfC8TQvY9chpaH+zFcy3RWlpy1NgbbHnf1meSASDhZ/Y0ZRIchZ8Kjn/jdiZqQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=t+vbu/xV; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="t+vbu/xV" Received: by smtp.kernel.org (Postfix) with ESMTPS id 52018C4AF0B; Wed, 16 Sep 2026 23:39:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1789601946; bh=IhwjyvHVYrWOfbhr0n4oozYGOJcvz2hx+di9cgmtNYg=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=t+vbu/xV4Az10BSHzR73caqmy/wBkXx3tIkkVUjEhANYrWxpMA/fCZ07XyRG+QHAK nOOpXPVJkK2KsyVy0jNiYCvMjd1FwitMD3zDq8RmBZwGV9psX1lJ14jutLj+3KPSBx TH1fj2bcXKJtCGNL+TT+nh17rDG6+9HkCyDBgiPAs6J0A0Fk2FxBz9leRgks0WeDv9 6T2xjIzwoC8FsNJCweaoIpUPl6RlFR1uvvPySh8H/72rhH+PlKoUGRy0wPzFCjgOnQ E05tQse1Whw7GaLjef2mvHsTUARlP469a64PlelsaXq3BdtFPU2MtNdgTPudk/9I4Q rZZ678mabB5pw== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 35B3FC982CC; Wed, 16 Sep 2026 23:39:06 +0000 (UTC) From: Ackerley Tng via B4 Relay Date: Wed, 16 Sep 2026 16:39:04 -0700 Subject: [PATCH v3 4/4] mm: hugetlb: Avoid re-allocating global reservations on region add failure Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260916-hugetlb-subpool-always-track-used-v3-4-38aae9b5ccdd@google.com> References: <20260916-hugetlb-subpool-always-track-used-v3-0-38aae9b5ccdd@google.com> In-Reply-To: <20260916-hugetlb-subpool-always-track-used-v3-0-38aae9b5ccdd@google.com> To: Alex Shi , Andrew Morton , David Hildenbrand , Dongliang Mu , Hongxiang Lou , Johannes Weiner , Jonathan Corbet , Joshua Hahn , "Liam R. Howlett" , Lorenzo Stoakes , Miaohe Lin , Michal Hocko , Mike Rapoport , Muchun Song , Nhat Pham , Oscar Salvador , Peter Xu , Randy Dunlap , Roman Gushchin , Shakeel Butt , Shuah Khan , Suren Baghdasaryan , Usama Arif , Vlastimil Babka , Wupeng Ma , Yanteng Si , Naoya Horiguchi , fvdl@google.com, jthoughton@google.com, rientjes@google.com, vannapurve@google.com Cc: linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, Ackerley Tng , stable@vger.kernel.org X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1789601945; l=3236; i=ackerleytng@google.com; s=20260225; h=from:subject:message-id; bh=9bkEGkyOV+QSeVMa/iDk/E1YpKwvqaT90NhqaQIG64M=; b=1XGNWUGnRvXVj0bMgtwgkbvJCSRj9qFIRHBreCl+e2AgqRTZkDsOM2OSA2gB1BLKbsz15xSmP MfrGwkkqi1VAaqqDTOsiY3A1fVam18S8s0W1iW3z5Y1JgHhB6P7b5hR X-Developer-Key: i=ackerleytng@google.com; a=ed25519; pk=sAZDYXdm6Iz8FHitpHeFlCMXwabodTm7p8/3/8xUxuU= X-Endpoint-Received: by B4 Relay for ackerleytng@google.com/20260225 with auth_id=649 X-Original-From: Ackerley Tng Reply-To: ackerleytng@google.com From: Ackerley Tng When reserving huge pages for a shared mapping, reservations are first requested from the subpool, and any remainder is accounted in global reservations. When adding the file region entries fails later in the process, the reservation attempt must be rolled back. Previously, this error path explicitly dropped the global reservations that were just acquired before jumping to the cleanup label. The cleanup label then returned the pages to the subpool. If concurrent activity in the subpool allowed the subpool to absorb more reservations upon return than it supplied initially, the cleanup label calculated a positive difference and attempted to allocate new global reservations from scratch. This premature release was completely unnecessary because all requested pages were already backed globally: partly by the mount guarantee and partly by the global reservations just acquired. Prematurely dissolving those reservations forced the cleanup path to attempt fresh buddy allocations that could fail under memory pressure. Instead, track the number of global reservations actually accounted so far. In the cleanup label, subtract the already-accounted amount from the difference between requested and returned reservations. This ensures that when global reservations were already acquired, the adjustment is purely non-positive, dropping excess reservations without ever attempting fresh allocations. Signed-off-by: Ackerley Tng Cc: stable@vger.kernel.org Reviewed-by: Joshua Hahn --- mm/hugetlb.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 6589b188cf657..ee1ba9ded0ec7 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -6678,6 +6678,7 @@ long hugetlb_reserve_pages(struct inode *inode, struct hugepage_subpool *spool =3D subpool_inode(inode); struct resv_map *resv_map; struct hugetlb_cgroup *h_cg =3D NULL; + long gbl_resv_accounted =3D 0; long regions_needed =3D 0; long gbl_resv_get; long gbl_resv_put; @@ -6768,6 +6769,7 @@ long hugetlb_reserve_pages(struct inode *inode, err =3D hugetlb_acct_memory(h, gbl_resv_get); if (err < 0) goto out_put_pages; + gbl_resv_accounted =3D gbl_resv_get; =20 /* * Account for the reservations made. Shared mappings record regions @@ -6784,7 +6786,6 @@ long hugetlb_reserve_pages(struct inode *inode, add =3D region_add(resv_map, from, to, regions_needed, h, h_cg); =20 if (unlikely(add < 0)) { - hugetlb_acct_memory(h, -gbl_resv_get); err =3D add; goto out_put_pages; } else if (unlikely(chg > add)) { @@ -6826,9 +6827,10 @@ long hugetlb_reserve_pages(struct inode *inode, * There may be a difference between the number of * reservations to consume and the number to restore now if * there are multiple threads interacting with the subpool - - * restore the difference. + * restore the difference, taking into account any global + * reservations already acquired. */ - hugetlb_acct_memory(h, gbl_resv_get - gbl_resv_put); + hugetlb_acct_memory(h, gbl_resv_get - gbl_resv_put - gbl_resv_accounted); =20 out_uncharge_cgroup: hugetlb_cgroup_uncharge_cgroup_rsvd(hstate_index(h), --=20 2.55.0.1082.g2b9226bbc0-goog