When the resubmission path in hugetlb_mfill_atomic_pte() allocates a new hugetlb folio via alloc_hugetlb_folio(), a VMA reservation is consumed. If copy_user_large_folio() subsequently fails, folio_put() restores the global hugetlb pool count through free_huge_folio(), but the per-VMA reservation map entry is left in an inconsistent state. Add the missing restore_reserve_on_error() call before folio_put(), matching the first-attempt error path which already handles this correctly. Fixes: 8cc5fcbb5be8 ("mm, hugetlb: fix racy resv_huge_pages underflow on UFFDIO_COPY") Cc: stable@vger.kernel.org Signed-off-by: David Carlier --- mm/hugetlb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 88009cd2a846..d6ea11113f1d 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -6295,6 +6295,7 @@ int hugetlb_mfill_atomic_pte(pte_t *dst_pte, folio_put(*foliop); *foliop = NULL; if (ret) { + restore_reserve_on_error(h, dst_vma, dst_addr, folio); folio_put(folio); goto out; } -- 2.53.0