[PATCH] mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch

[PATCH] mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch

[Deepanshu Kartikey]

In alloc_hugetlb_folio(), a single h_cg pointer is used for both
the rsvd and non-rsvd hugetlb cgroup charges. When map_chg is set,
hugetlb_cgroup_charge_cgroup_rsvd() stores the charged cgroup in
h_cg, but the immediately following hugetlb_cgroup_charge_cgroup()
overwrites h_cg with the non-rsvd cgroup pointer.

As a result, hugetlb_cgroup_commit_charge_rsvd() stores the wrong
(non-rsvd) cgroup pointer into the folio's rsvd slot.

When the folio is later freed, free_huge_folio() unconditionally
calls both hugetlb_cgroup_uncharge_folio() and
hugetlb_cgroup_uncharge_folio_rsvd(). The rsvd uncharge reads back
the wrong cgroup from the folio and decrements a counter that was
never charged for that cgroup, causing a page_counter underflow:

  page_counter underflow: -512 nr_pages=512
  WARNING: mm/page_counter.c:61 at page_counter_cancel

Fix this by introducing a separate h_cg_rsvd pointer exclusively
for the rsvd charge path, keeping the rsvd and non-rsvd charges
fully independent through their charge, commit, and error uncharge
paths.

Fixes: 08cf9faf7558 ("hugetlb_cgroup: support noreserve mappings")
Reported-by: syzbot+226c1f947186f8fef796@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=226c1f947186f8fef796
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 mm/hugetlb.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 327eaa4074d3..5be36a888e70 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2915,6 +2915,7 @@ struct folio *alloc_hugetlb_folio(struct vm_area_struct *vma,
 	map_chg_state map_chg;
 	int ret, idx;
 	struct hugetlb_cgroup *h_cg = NULL;
+	struct hugetlb_cgroup *h_cg_rsvd = NULL;
 	gfp_t gfp = htlb_alloc_mask(h) | __GFP_RETRY_MAYFAIL;
 
 	idx = hstate_index(h);
@@ -2965,7 +2966,7 @@ struct folio *alloc_hugetlb_folio(struct vm_area_struct *vma,
 	 */
 	if (map_chg) {
 		ret = hugetlb_cgroup_charge_cgroup_rsvd(
-			idx, pages_per_huge_page(h), &h_cg);
+			idx, pages_per_huge_page(h), &h_cg_rsvd);
 		if (ret)
 			goto out_subpool_put;
 	}
@@ -3007,7 +3008,7 @@ struct folio *alloc_hugetlb_folio(struct vm_area_struct *vma,
 	 */
 	if (map_chg) {
 		hugetlb_cgroup_commit_charge_rsvd(idx, pages_per_huge_page(h),
-						  h_cg, folio);
+						  h_cg_rsvd, folio);
 	}
 
 	spin_unlock_irq(&hugetlb_lock);
@@ -3059,7 +3060,7 @@ struct folio *alloc_hugetlb_folio(struct vm_area_struct *vma,
 out_uncharge_cgroup_reservation:
 	if (map_chg)
 		hugetlb_cgroup_uncharge_cgroup_rsvd(idx, pages_per_huge_page(h),
-						    h_cg);
+						    h_cg_rsvd);
 out_subpool_put:
 	/*
 	 * put page to subpool iff the quota of subpool's rsv_hpages is used
-- 
2.43.0

Re: [PATCH] mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch

[Andrew Morton]

On Sat, 28 Mar 2026 12:25:34 +0530 Deepanshu Kartikey <kartikey406@gmail.com> wrote:

> In alloc_hugetlb_folio(), a single h_cg pointer is used for both
> the rsvd and non-rsvd hugetlb cgroup charges. When map_chg is set,
> hugetlb_cgroup_charge_cgroup_rsvd() stores the charged cgroup in
> h_cg, but the immediately following hugetlb_cgroup_charge_cgroup()
> overwrites h_cg with the non-rsvd cgroup pointer.
> 
> As a result, hugetlb_cgroup_commit_charge_rsvd() stores the wrong
> (non-rsvd) cgroup pointer into the folio's rsvd slot.
> 
> When the folio is later freed, free_huge_folio() unconditionally
> calls both hugetlb_cgroup_uncharge_folio() and
> hugetlb_cgroup_uncharge_folio_rsvd(). The rsvd uncharge reads back
> the wrong cgroup from the folio and decrements a counter that was
> never charged for that cgroup, causing a page_counter underflow:
> 
>   page_counter underflow: -512 nr_pages=512
>   WARNING: mm/page_counter.c:61 at page_counter_cancel
> 
> Fix this by introducing a separate h_cg_rsvd pointer exclusively
> for the rsvd charge path, keeping the rsvd and non-rsvd charges
> fully independent through their charge, commit, and error uncharge
> paths.

Thanks.

> Fixes: 08cf9faf7558 ("hugetlb_cgroup: support noreserve mappings")

Merged in 2020!

Could reviewers please give consideration to whether we should backport
this?

> Reported-by: syzbot+226c1f947186f8fef796@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=226c1f947186f8fef796
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>

This doesn't seem super-urgent so for now I'll park it in my pile to
revisit after 7.1-rc1.

Re: [PATCH] mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch

[Andrew Morton]

On Mon, 30 Mar 2026 13:15:25 -0700 Andrew Morton <akpm@linux-foundation.org> wrote:

> On Sat, 28 Mar 2026 12:25:34 +0530 Deepanshu Kartikey <kartikey406@gmail.com> wrote:
> 
> > In alloc_hugetlb_folio(), a single h_cg pointer is used for both
> > the rsvd and non-rsvd hugetlb cgroup charges. When map_chg is set,
> > hugetlb_cgroup_charge_cgroup_rsvd() stores the charged cgroup in
> > h_cg, but the immediately following hugetlb_cgroup_charge_cgroup()
> > overwrites h_cg with the non-rsvd cgroup pointer.
> > 
> > As a result, hugetlb_cgroup_commit_charge_rsvd() stores the wrong
> > (non-rsvd) cgroup pointer into the folio's rsvd slot.
> > 
> > When the folio is later freed, free_huge_folio() unconditionally
> > calls both hugetlb_cgroup_uncharge_folio() and
> > hugetlb_cgroup_uncharge_folio_rsvd(). The rsvd uncharge reads back
> > the wrong cgroup from the folio and decrements a counter that was
> > never charged for that cgroup, causing a page_counter underflow:
> > 
> >   page_counter underflow: -512 nr_pages=512
> >   WARNING: mm/page_counter.c:61 at page_counter_cancel
> > 
> > Fix this by introducing a separate h_cg_rsvd pointer exclusively
> > for the rsvd charge path, keeping the rsvd and non-rsvd charges
> > fully independent through their charge, commit, and error uncharge
> > paths.
> 
> Thanks.
> 
> > Fixes: 08cf9faf7558 ("hugetlb_cgroup: support noreserve mappings")
> 
> Merged in 2020!
> 
> Could reviewers please give consideration to whether we should backport
> this?
> 

OK, then ;)


I'll queue this up and shall add the cc:stable - that underflow warning
needs to be addressed.

I'll add a needs-review note-to-self.


From: Deepanshu Kartikey <kartikey406@gmail.com>
Subject: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch
Date: Sat, 28 Mar 2026 12:25:34 +0530

In alloc_hugetlb_folio(), a single h_cg pointer is used for both the rsvd
and non-rsvd hugetlb cgroup charges.  When map_chg is set,
hugetlb_cgroup_charge_cgroup_rsvd() stores the charged cgroup in h_cg, but
the immediately following hugetlb_cgroup_charge_cgroup() overwrites h_cg
with the non-rsvd cgroup pointer.

As a result, hugetlb_cgroup_commit_charge_rsvd() stores the wrong
(non-rsvd) cgroup pointer into the folio's rsvd slot.

When the folio is later freed, free_huge_folio() unconditionally calls
both hugetlb_cgroup_uncharge_folio() and
hugetlb_cgroup_uncharge_folio_rsvd().  The rsvd uncharge reads back the
wrong cgroup from the folio and decrements a counter that was never
charged for that cgroup, causing a page_counter underflow:

  page_counter underflow: -512 nr_pages=512
  WARNING: mm/page_counter.c:61 at page_counter_cancel

Fix this by introducing a separate h_cg_rsvd pointer exclusively for the
rsvd charge path, keeping the rsvd and non-rsvd charges fully independent
through their charge, commit, and error uncharge paths.

Link: https://lore.kernel.org/20260328065534.346053-1-kartikey406@gmail.com
Fixes: 08cf9faf7558 ("hugetlb_cgroup: support noreserve mappings")
Reported-by: syzbot+226c1f947186f8fef796@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=226c1f947186f8fef796
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Mina Almasry <almasrymina@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/hugetlb.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

--- a/mm/hugetlb.c~mm-hugetlb-fix-hugetlb-cgroup-rsvd-charge-uncharge-mismatch
+++ a/mm/hugetlb.c
@@ -2879,6 +2879,7 @@ struct folio *alloc_hugetlb_folio(struct
 	map_chg_state map_chg;
 	int ret, idx;
 	struct hugetlb_cgroup *h_cg = NULL;
+	struct hugetlb_cgroup *h_cg_rsvd = NULL;
 	gfp_t gfp = htlb_alloc_mask(h) | __GFP_RETRY_MAYFAIL;
 
 	idx = hstate_index(h);
@@ -2929,7 +2930,7 @@ struct folio *alloc_hugetlb_folio(struct
 	 */
 	if (map_chg) {
 		ret = hugetlb_cgroup_charge_cgroup_rsvd(
-			idx, pages_per_huge_page(h), &h_cg);
+			idx, pages_per_huge_page(h), &h_cg_rsvd);
 		if (ret)
 			goto out_subpool_put;
 	}
@@ -2971,7 +2972,7 @@ struct folio *alloc_hugetlb_folio(struct
 	 */
 	if (map_chg) {
 		hugetlb_cgroup_commit_charge_rsvd(idx, pages_per_huge_page(h),
-						  h_cg, folio);
+						  h_cg_rsvd, folio);
 	}
 
 	spin_unlock_irq(&hugetlb_lock);
@@ -3023,7 +3024,7 @@ out_uncharge_cgroup:
 out_uncharge_cgroup_reservation:
 	if (map_chg)
 		hugetlb_cgroup_uncharge_cgroup_rsvd(idx, pages_per_huge_page(h),
-						    h_cg);
+						    h_cg_rsvd);
 out_subpool_put:
 	/*
 	 * put page to subpool iff the quota of subpool's rsv_hpages is used
_

Re: [PATCH] mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch

[Muchun Song]

> On Mar 28, 2026, at 14:55, Deepanshu Kartikey <kartikey406@gmail.com> wrote:
> 
> In alloc_hugetlb_folio(), a single h_cg pointer is used for both
> the rsvd and non-rsvd hugetlb cgroup charges. When map_chg is set,
> hugetlb_cgroup_charge_cgroup_rsvd() stores the charged cgroup in
> h_cg, but the immediately following hugetlb_cgroup_charge_cgroup()
> overwrites h_cg with the non-rsvd cgroup pointer.
> 
> As a result, hugetlb_cgroup_commit_charge_rsvd() stores the wrong
> (non-rsvd) cgroup pointer into the folio's rsvd slot.
> 
> When the folio is later freed, free_huge_folio() unconditionally
> calls both hugetlb_cgroup_uncharge_folio() and
> hugetlb_cgroup_uncharge_folio_rsvd(). The rsvd uncharge reads back
> the wrong cgroup from the folio and decrements a counter that was
> never charged for that cgroup, causing a page_counter underflow:
> 
>  page_counter underflow: -512 nr_pages=512
>  WARNING: mm/page_counter.c:61 at page_counter_cancel
> 
> Fix this by introducing a separate h_cg_rsvd pointer exclusively
> for the rsvd charge path, keeping the rsvd and non-rsvd charges
> fully independent through their charge, commit, and error uncharge
> paths.
> 
> Fixes: 08cf9faf7558 ("hugetlb_cgroup: support noreserve mappings")
> Reported-by: syzbot+226c1f947186f8fef796@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=226c1f947186f8fef796
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>

Reviewed-by: Muchun Song <muchun.song@linux.dev>

Thanks.