[merged mm-stable] mm-hugetlb-fix-resv_huge_pages-double-decrement-in-memfd-error-path.patch removed from -mm tree

[merged mm-stable] mm-hugetlb-fix-resv_huge_pages-double-decrement-in-memfd-error-path.patch removed from -mm tree

[Andrew Morton]

The quilt patch titled
     Subject: mm/hugetlb: fix resv_huge_pages double decrement in memfd error path
has been removed from the -mm tree.  Its filename was
     mm-hugetlb-fix-resv_huge_pages-double-decrement-in-memfd-error-path.patch

This patch was dropped because it was merged into the mm-stable branch
of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

------------------------------------------------------
From: Hongfu Li <lihongfu@kylinos.cn>
Subject: mm/hugetlb: fix resv_huge_pages double decrement in memfd error path
Date: Tue, 25 Aug 2026 10:10:13 +0800

alloc_hugetlb_folio_reserve() decrements h->resv_huge_pages when dequeuing
a folio, but unlike the use_global_reservation handling in
hugetlb_alloc_folio(), it does not set HPageRestoreReserve on the folio.

Its sole caller memfd_alloc_folio() pre-allocates a reservation via
hugetlb_reserve_pages() before allocating.  When
hugetlb_add_to_page_cache() fails, folio_put() drops the folio without
HPageRestoreReserve set, so free_huge_folio() does not restore the
reservation.  The subsequent hugetlb_unreserve_pages() on the err_unresv
path decrements the counter a second time, leaving resv_huge_pages off by
one for every failed allocation.

Set HPageRestoreReserve when consuming the reservation in
alloc_hugetlb_folio_reserve().  On the error path, free_huge_folio() then
restores the reservation before hugetlb_unreserve_pages() releases it. 
The success path is unaffected, as hugetlb_add_to_page_cache() clears the
flag once the folio is added to the page cache.

Link: https://lore.kernel.org/20260825021013.25672-1-hongfu.li@linux.dev
Fixes: 26a8ea80929c ("mm/hugetlb: fix memfd_pin_folios resv_huge_pages leak")
Signed-off-by: Hongfu Li <lihongfu@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Muchun Song <muchun.song@linux.dev>
Cc: David Hildenbrand <david@kernel.org>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Steven Sistare <steven.sistare@oracle.com>
Cc: Vivek Kasireddy <vivek.kasireddy@intel.com>
---

 mm/hugetlb.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/mm/hugetlb.c~mm-hugetlb-fix-resv_huge_pages-double-decrement-in-memfd-error-path
+++ a/mm/hugetlb.c
@@ -2187,8 +2187,10 @@ struct folio *alloc_hugetlb_folio_reserv
 
 	folio = dequeue_hugetlb_folio_nodemask(h, gfp_mask, preferred_nid,
 					       nmask);
-	if (folio)
+	if (folio) {
+		folio_set_hugetlb_restore_reserve(folio);
 		h->resv_huge_pages--;
+	}
 
 	spin_unlock_irq(&hugetlb_lock);
 	return folio;
_

Patches currently in -mm which might be from lihongfu@kylinos.cn are

mm-page_owner-preserve-original-free_pid-free_tgid-during-folio-migration.patch
mm-memfd-fix-hugetlb-reservation-accounting-in-error-paths.patch
selftests-mm-fix-ptrace-peekdata-check-in-memfd_secret-test.patch
mm-hugetlb_cgroup-move-per-node-usage-on-cross-node-migration.patch
mm-hugetlb_cgroup-move-per-node-usage-on-cgroup-reparenting.patch
mm-hugetlb-account-migration-target-folio-in-per-node-nr_hugetlb-vmstat.patch
mm-memcg-migrate-per-node-hugetlb-lruvec-stat-together-with-hugetlb-folio.patch