[PATCH] mm/hugetlb: restore subpool used_hpages on alloc_hugetlb_folio error

[David Carlier <devnexen@gmail.com>]

Commit a833a693a490 added a !gbl_chg guard around the
hugepage_subpool_put_pages() call in alloc_hugetlb_folio()'s
out_subpool_put path so a failed allocation wouldn't drive
h->resv_huge_pages negative.  But hugepage_subpool_get_pages()
increments spool->used_hpages whenever max_hpages != -1, regardless
of whether the request was satisfied from subpool reserves or needs
global pages.  When gbl_chg > 0 and a later step fails (cgroup
charge, dequeue, buddy alloc), used_hpages is never put back.

Each such failure leaks one count; eventually used_hpages reaches
max_hpages and the subpool refuses every further allocation even
though no pages are held.

Commit 1d3f9bb4c8af fixed the same defect in hugetlb_reserve_pages();
apply the equivalent restore here, guarded by spool and max_hpages.

Fixes: a833a693a490 ("mm: hugetlb: fix incorrect fallback for subpool")
Signed-off-by: David Carlier <devnexen@gmail.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Wupeng Ma <mawupeng1@huawei.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: David Hildenbrand <david@kernel.org>
Cc: <stable@vger.kernel.org>
---
 mm/hugetlb.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index cfb7cb2e9806..9614330889de 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3010,9 +3010,22 @@ struct folio *alloc_hugetlb_folio(struct vm_area_struct *vma,
 	 * put page to subpool iff the quota of subpool's rsv_hpages is used
 	 * during hugepage_subpool_get_pages.
 	 */
-	if (map_chg && !gbl_chg) {
-		gbl_reserve = hugepage_subpool_put_pages(spool, 1);
-		hugetlb_acct_memory(h, -gbl_reserve);
+	if (map_chg) {
+		/*
+		 * Put used_hpages back for the global portion of the request that
+		 * was never actually consumed; restore the subpool-reservation
+		 * portion via hugepage_subpool_put_pages() so rsv_hpages is rebuilt.
+		 */
+		if (!gbl_chg) {
+			gbl_reserve = hugepage_subpool_put_pages(spool, 1);
+			hugetlb_acct_memory(h, -gbl_reserve);
+		} else if (spool && spool->max_hpages != -1) {
+			unsigned long flags;
+
+			spin_lock_irqsave(&spool->lock, flags);
+			spool->used_hpages -= 1;
+			unlock_or_release_subpool(spool, flags);
+		}
 	}
 
 
-- 
2.53.0