[PATCH] mm/hugetlb: restore reservation on error in hugetlb_mfill_atomic_pte() resubmission path

David Carlier
2026-03-22T05:21:30Z

When the resubmission path in hugetlb_mfill_atomic_pte() allocates a new
hugetlb folio via alloc_hugetlb_folio(), a VMA reservation is consumed. If
copy_user_large_folio() subsequently fails, folio_put() restores the global
hugetlb pool count through free_huge_folio(), but the per-VMA reservation
map entry is left in an inconsistent state.

Add the missing restore_reserve_on_error() call before folio_put(), matching
the first-attempt error path which already handles this correctly.

Fixes: 8cc5fcbb5be8 ("mm, hugetlb: fix racy resv_huge_pages underflow on UFFDIO_COPY")
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
---
mm/hugetlb.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 88009cd2a846..d6ea11113f1d 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -6295,6 +6295,7 @@ int hugetlb_mfill_atomic_pte(pte_t *dst_pte,
folio_put(*foliop);
*foliop = NULL;
if (ret) {
+ restore_reserve_on_error(h, dst_vma, dst_addr, folio);
folio_put(folio);
goto out;
}
--
2.53.0