[PATCH] PM: hibernate: Fix memory leak in snapshot_write_next() error path

[PATCH] PM: hibernate: Fix memory leak in snapshot_write_next() error path

[Malaya Kumar Rout]

When memory_bm_create() succeeds for copy_bm but fails for zero_bm,
the function returns without freeing the resources allocated for
copy_bm. This results in a memory leak that includes radix tree nodes,
zone structures, and page lists.

Fix this by calling memory_bm_free() to release copy_bm's resources
before returning the error code when zero_bm allocation fails.

Fixes: 005e8dddd497 ("PM: hibernate: don't store zero pages in the image file")
Signed-off-by: Malaya Kumar Rout <malayarout91@gmail.com>
---
 kernel/power/snapshot.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index d933b5b2c05d..4a73927cc55b 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -2797,9 +2797,10 @@ int snapshot_write_next(struct snapshot_handle *handle)
 			return error;
 
 		error = memory_bm_create(&zero_bm, GFP_ATOMIC, PG_ANY);
-		if (error)
+		if (error) {
+			memory_bm_free(&copy_bm, PG_UNSAFE_CLEAR);
 			return error;
-
+		}
 		nr_zero_pages = 0;
 
 		hibernate_restore_protection_begin();
-- 
2.54.0

Re: [PATCH] PM: hibernate: Fix memory leak in snapshot_write_next() error path

[Brian Geffon]

On Sat, Jul 11, 2026 at 10:53 AM Malaya Kumar Rout
<malayarout91@gmail.com> wrote:
>
> When memory_bm_create() succeeds for copy_bm but fails for zero_bm,
> the function returns without freeing the resources allocated for
> copy_bm. This results in a memory leak that includes radix tree nodes,
> zone structures, and page lists.
>
> Fix this by calling memory_bm_free() to release copy_bm's resources
> before returning the error code when zero_bm allocation fails.
>
> Fixes: 005e8dddd497 ("PM: hibernate: don't store zero pages in the image file")
> Signed-off-by: Malaya Kumar Rout <malayarout91@gmail.com>

Acked-by: Brian Geffon <bgeffon@google.com>

>
> ---
>  kernel/power/snapshot.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
> index d933b5b2c05d..4a73927cc55b 100644
> --- a/kernel/power/snapshot.c
> +++ b/kernel/power/snapshot.c
> @@ -2797,9 +2797,10 @@ int snapshot_write_next(struct snapshot_handle *handle)
>                         return error;
>
>                 error = memory_bm_create(&zero_bm, GFP_ATOMIC, PG_ANY);
> -               if (error)
> +               if (error) {
> +                       memory_bm_free(&copy_bm, PG_UNSAFE_CLEAR);
>                         return error;
> -
> +               }
>                 nr_zero_pages = 0;
>
>                 hibernate_restore_protection_begin();
> --
> 2.54.0
>