From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-180.mta0.migadu.com (out-180.mta0.migadu.com [91.218.175.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 19A69370D7B for ; Mon, 27 Apr 2026 07:56:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.180 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777276586; cv=none; b=nf36DoH1ec2kfzChqY04NUb8S56xeDMywWf3Fz/HG27OulgQGJgISJa90RUqsr2JKWob2S/v5Q5S8/sxvTVnHDxJbm0+VntGkUmSQtNly5sjVMoClnnqVnlH4L813sCMYA092lgLU2UE2MYF2OtF6CcV2K9FzyuMArYfLi8D3MU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777276586; c=relaxed/simple; bh=I8UWZgprBLK6zorfw1UuGLNsgOasSGqPUtG48+0HNyM=; h=Content-Type:Mime-Version:Subject:From:In-Reply-To:Date:Cc: Message-Id:References:To; b=K7Z1BHhWQiM24WykM40kPehL2gCf4kNRthn8cpdHmn0NLLlYKR4hDDNDywQRslyLIcnav5eXJTGM5X0v4iebgrhQ6kkKXU5kSDiDOKZdJeEJnnDOEOm5hWHu3t4KnQqIVuKZCmotByV9qdwBxe884Yv+dva/jaffSnTcatUwEdQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=K4S5OJ67; arc=none smtp.client-ip=91.218.175.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="K4S5OJ67" Content-Type: text/plain; charset=us-ascii DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1777276581; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=srNLnD8+s9OliipECDwqoPjWKvlwyPl55SmJ7/0HSYQ=; b=K4S5OJ67U8gyj75430b7Hm2IHdAalie/0+hRyASPyhuoLIoag6cMS1fT/4Kf5mqEH/u7MN nDWYN7ZghYLtpM+MQCM97uk7ztsZPHUrhmemTxDM8aJR8LK8es3CyeFmAAvy8ywTlAE6OG D5Rp+2kbrpNyBe3/M1wepTLpgeFUKmM= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.500.181\)) Subject: Re: [RFC PATCH] mm/hugetlb: fix resv_map memory leak in __mmap_region error path X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Muchun Song In-Reply-To: <20260425070700.562229-1-25181214217@stu.xidian.edu.cn> Date: Mon, 27 Apr 2026 15:55:00 +0800 Cc: Liam.Howlett@oracle.com, akpm@linux-foundation.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, ljs@kernel.org, vbabka@kernel.org, jannh@google.com, pfalcato@suse.de, osalvador@suse.de, david@kernel.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <20260425070700.562229-1-25181214217@stu.xidian.edu.cn> To: Mingyu Wang <25181214217@stu.xidian.edu.cn> X-Migadu-Flow: FLOW_OUT > On Apr 25, 2026, at 15:07, Mingyu Wang <25181214217@stu.xidian.edu.cn> = wrote: >=20 > While fuzzing with Syzkaller and fault injection (failslab) enabled, > I observed a persistent resv_map memory leak in the hugetlb mmap error = path. >=20 > BUG: memory leak > unreferenced object 0xffff888110b92400 (size 512): > comm "syz.0.5386", pid 20390, jiffies 4298157188 > backtrace: > __kmalloc_cache_noprof+0x509/0x6e0 > resv_map_alloc+0x47/0x3a0 > hugetlb_reserve_pages+0x758/0x1220 > hugetlbfs_file_mmap_prepare+0x492/0x790 > __mmap_region+0x1ae6/0x29f0 >=20 > This is a regression introduced by the recent VMA iterator and mmap = region > refactoring, which decoupled mmap preparation from VMA completion. >=20 > In `__mmap_region()`, `call_mmap_prepare()` triggers = `hugetlbfs_file_mmap_prepare()`, > which successfully allocates the `resv_map` and registers a = `success_hook` > in `desc->action`. >=20 > If `__mmap_new_vma()` subsequently fails (e.g., `vma_iter_prealloc()` > returns -ENOMEM due to failslab), the code jumps to `abort_munmap`. > However, the `desc` structure is completely discarded without invoking > any cleanup. The newly allocated empty VMA is freed, but since > `set_vma_user_defined_fields()` was never reached, `vm_area_free()` > doesn't call `hugetlb_vm_close()`. Thus, the `resv_map` is permanently = leaked. >=20 > This RFC proposes adding an `abort_hook` to `struct mmap_action` > so that subsystems can properly clean up resources allocated during = the > `mmap_prepare` phase if VMA creation fails. >=20 > Any feedback on whether this architectural approach is correct, or how = to=20 > properly implement the hugetlb unreserve rollback, would be highly = appreciated. Please use ./scripts/get_maintainer.pl to get full mail list for Cc/To = since it is not only related to HugeTLB subsystem. It will also consider the = author of commit introducing the problem. >=20 > Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn> > --- > fs/hugetlbfs/inode.c | 9 +++++++++ > include/linux/mm_types.h | 2 ++ > mm/vma.c | 4 ++++ > 3 files changed, 15 insertions(+) >=20 > diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c > index 8b05bec08e04..002bb6d9ca23 100644 > --- a/fs/hugetlbfs/inode.c > +++ b/fs/hugetlbfs/inode.c > @@ -102,6 +102,14 @@ static int = hugetlb_file_mmap_prepare_success(const struct vm_area_struct *vma) > return hugetlb_vma_lock_alloc((struct vm_area_struct *)vma); > } >=20 > +static void hugetlb_file_mmap_prepare_abort(struct vm_area_desc = *desc) > +{ > + /* > + * TODO: Implement the proper rollback for = hugetlb_reserve_pages() > + * and drop the resv_map reference held in the desc here. > + */ > +} > + > static int hugetlbfs_file_mmap_prepare(struct vm_area_desc *desc) > { > struct file *file =3D desc->file; > @@ -172,6 +180,7 @@ static int hugetlbfs_file_mmap_prepare(struct = vm_area_desc *desc) > if (!ret) { > /* Allocate the VMA lock after we set it up. */ > desc->action.success_hook =3D hugetlb_file_mmap_prepare_success; > + desc->action.abort_hook =3D hugetlb_file_mmap_prepare_abort; > /* > * We cannot permit the rmap finding this VMA in the time > * between the VMA being inserted into the VMA tree and the > diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h > index a308e2c23b82..9320f6699fa9 100644 > --- a/include/linux/mm_types.h > +++ b/include/linux/mm_types.h > @@ -861,6 +861,8 @@ struct mmap_action { > * it is not valid to clear the error here. > */ > int (*error_hook)(int err); > +=20 > + void (*abort_hook)(struct vm_area_desc *desc); At least for me, it is not good name to distinguish it from error_hook. abort_mmap_prepare? I am not sure if it is a good solution, Cc other MM maintainers as well. Muchun, Thanks. >=20 > /* > * This should be set in rare instances where the operation required > diff --git a/mm/vma.c b/mm/vma.c > index 377321b48734..d64cea5b4335 100644 > --- a/mm/vma.c > +++ b/mm/vma.c > @@ -2799,6 +2799,10 @@ static unsigned long __mmap_region(struct file = *file, unsigned long addr, > */ > if (map.file_doesnt_need_get) > fput(map.file); > +=20 > + if (have_mmap_prepare && desc.action.abort_hook) > + desc.action.abort_hook(&desc); > +=20 > vms_abort_munmap_vmas(&map.vms, &map.mas_detach); > return error; > } > --=20 > 2.34.1 >=20