From: Muchun Song <muchun.song@linux.dev>
To: ackerleytng@google.com
Cc: Oscar Salvador <osalvador@suse.de>,
David Hildenbrand <david@kernel.org>,
Joshua Hahn <joshua.hahnjy@gmail.com>,
Shakeel Butt <shakeel.butt@linux.dev>,
Nhat Pham <nphamcs@gmail.com>,
Andrew Morton <akpm@linux-foundation.org>,
Peter Xu <peterx@redhat.com>, Wupeng Ma <mawupeng1@huawei.com>,
fvdl@google.com, rientjes@google.com, vannapurve@google.com,
erdemaktas@google.com, linux-mm@kvack.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH 2/4] mm: hugetlb: Fix folio refcount mismatch on memcg charge failure
Date: Wed, 8 Jul 2026 14:59:10 +0800 [thread overview]
Message-ID: <CBD2D5D1-CBA2-434B-8056-8D9A407EEEAB@linux.dev> (raw)
In-Reply-To: <20260707-hugetlb-alloc-failure-fixes-v1-2-5bbd3a4b836d@google.com>
> On Jul 8, 2026, at 04:46, Ackerley Tng via B4 Relay <devnull+ackerleytng.google.com@kernel.org> wrote:
>
> From: Ackerley Tng <ackerleytng@google.com>
>
> When mem_cgroup_charge_hugetlb(folio, gfp) returns -ENOMEM, the folio has
> its refcount set to 1 via folio_ref_unfreeze(folio, 1).
>
> The error path calls free_huge_folio(folio) directly, which expects a
> refcount of 0. Hence, VM_BUG_ON_FOLIO(folio_ref_count(folio), folio) is
> triggered.
>
> Even with CONFIG_DEBUG_VM disabled, returning a folio with refcount 1 to
> the freelist can corrupt allocator state later.
>
> Use folio_put(folio) instead of free_huge_folio(folio) to properly drop the
> reference before freeing it.
>
> Fixes: 991135774c0e0 ("memcg/hugetlb: introduce mem_cgroup_charge_hugetlb")
> Signed-off-by: Ackerley Tng <ackerleytng@google.com>
Yes, a real issue, I think we should cc stable as well.
Reviewed-by: Muchun Song <muchun.song@linux.dev>
Thanks.
next prev parent reply other threads:[~2026-07-08 6:59 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-07 20:46 [PATCH 0/4] Fix bugs on HugeTLB folio allocation failure paths Ackerley Tng via B4 Relay
2026-07-07 20:46 ` [PATCH 1/4] mm: hugetlb: Fix subpool usage leak on allocation failure Ackerley Tng via B4 Relay
2026-07-07 23:43 ` Ackerley Tng
2026-07-07 20:46 ` [PATCH 2/4] mm: hugetlb: Fix folio refcount mismatch on memcg charge failure Ackerley Tng via B4 Relay
2026-07-08 6:59 ` Muchun Song [this message]
2026-07-07 20:46 ` [PATCH 3/4] mm: hugetlb: Return -ENOSPC " Ackerley Tng via B4 Relay
2026-07-08 7:04 ` Muchun Song
2026-07-07 20:46 ` [PATCH 4/4] mm: hugetlb: Move memcg charge earlier to prevent reservation leak Ackerley Tng via B4 Relay
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CBD2D5D1-CBA2-434B-8056-8D9A407EEEAB@linux.dev \
--to=muchun.song@linux.dev \
--cc=ackerleytng@google.com \
--cc=akpm@linux-foundation.org \
--cc=david@kernel.org \
--cc=erdemaktas@google.com \
--cc=fvdl@google.com \
--cc=joshua.hahnjy@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mawupeng1@huawei.com \
--cc=nphamcs@gmail.com \
--cc=osalvador@suse.de \
--cc=peterx@redhat.com \
--cc=rientjes@google.com \
--cc=shakeel.butt@linux.dev \
--cc=vannapurve@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox