When mapping a p2pdma page the page reference count is initialised to 1 prior to calling vm_insert_page(). This is to avoid vm_insert_page() warning if the page refcount is zero. Prior to setting the page count there is a check to ensure the page is currently free (ie. has a zero reference count). However vm_insert_page() can fail. In this case the pages are freed back to the genalloc pool, but that does not reset the page refcount. So a future allocation of the same page will see the elevated page refcount from the previous set_page_count() call triggering the VM_WARN_ON_ONCE_PAGE checking that the page is free. Fix this by resetting the page refcount back to zero using set_page_count(). Note that put_page() is not used because that would result in freeing the page twice due to implicitly calling p2pdma_folio_free(). Fixes: b7e282378773 ("mm/mm_init: move p2pdma page refcount initialisation to p2pdma") Signed-off-by: Alistair Popple --- This was found by inspection. I don't currently have a good setup that exercises the p2pmem_alloc_mmap() path so this has only been compile tested - additional testing would be appreciated. --- drivers/pci/p2pdma.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c index dd64ec830fdd..3b29246b9e86 100644 --- a/drivers/pci/p2pdma.c +++ b/drivers/pci/p2pdma.c @@ -152,6 +152,12 @@ static int p2pmem_alloc_mmap(struct file *filp, struct kobject *kobj, ret = vm_insert_page(vma, vaddr, page); if (ret) { gen_pool_free(p2pdma->pool, (uintptr_t)kaddr, len); + + /* + * Reset the page count. We don't use put_page() because + * we don't want to trigger the p2pdma_folio_free() path. + */ + set_page_count(page, 0); percpu_ref_put(ref); return ret; } -- 2.51.0