When the resubmission path in hugetlb_mfill_atomic_pte() allocates a new hugetlb folio via alloc_hugetlb_folio(), a VMA reservation is consumed. If copy_user_large_folio() subsequently fails (e.g. -EHWPOISON when the source page is hwpoisoned), folio_put() restores the global hugetlb pool count through free_huge_folio(), but the per-VMA reservation map entry is left marked consumed. User-visible effect: on a UFFDIO_COPY into a private hugetlb VMA where the resubmission path's copy fails, the reservation for that address is leaked from the VMA's reserve map. A subsequent fault at the same address takes the no-reservation path, and under hugetlb pool pressure the task is SIGBUSed at an address it had previously reserved. One map entry is leaked per occurrence. Add the missing restore_reserve_on_error() call before folio_put(), matching the first-attempt error path which already handles this correctly. Fixes: 1cb9dc4b475c ("mm: hwpoison: support recovery from HugePage copy-on-write faults") Cc: Signed-off-by: David Carlier --- v2: - Add user-visible effects paragraph in changelog (per akpm, required for Cc: stable). - Correct Fixes: tag to 1cb9dc4b475c (per Muchun) -- the failing arm only exists since copy_user_large_folio() became int-returning. Andrew, please drop the v1 currently queued as 270157aef0d1 in mm-unstable. v1: https://lore.kernel.org/all/20260322052120.14021-1-devnexen@gmail.com/ mm/hugetlb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 4b80b167cc9c..c6dee98840db 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -6270,6 +6270,7 @@ int hugetlb_mfill_atomic_pte(pte_t *dst_pte, folio_put(*foliop); *foliop = NULL; if (ret) { + restore_reserve_on_error(h, dst_vma, dst_addr, folio); folio_put(folio); goto out; } -- 2.53.0