Re: [PATCH] mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page

[Zi Yan]

On 25 Apr 2026, at 9:44, Sunny Patel wrote:

> When migrate_vma_insert_huge_pmd_page() jumps to unlock_abort due
> to a PMD check failure, the pgtable allocated earlier via
> pte_alloc_one() is never freed, causing a memory leak.
>
> Add a pte_free() call in the unlock_abort error path to release
> the pgtable before returning.
>
> Signed-off-by: Sunny Patel <nueralspacetech@xxxxxxxxx>
> ---
>  mm/migrate_device.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/mm/migrate_device.c b/mm/migrate_device.c
> index fbfe5715f635..457bab5c7c31 100644
> --- a/mm/migrate_device.c
> +++ b/mm/migrate_device.c
> @@ -893,6 +893,7 @@ static int migrate_vma_insert_huge_pmd_page(struct migrate_vma *migrate,
>
>  unlock_abort:
>  	spin_unlock(ptl);
> +	pte_free(vma->vm_mm, pgtable);
>  abort:
>  	for (i = 0; i < HPAGE_PMD_NR; i++)
>  		src[i] &= ~MIGRATE_PFN_MIGRATE;
> -- 
> 2.43.0

Actually,

I think the "goto abort" above pmd_lock() need to do pte_free():

        if (folio_is_device_private(folio)) {
			...
        } else {
                if (folio_is_zone_device(folio) &&
                    !folio_is_device_coherent(folio)) {
                        goto abort; <-- this one
                }
			...
        }

The lock is not taken yet, so you might need to add a pte_free() before
goto abort.

--
Best Regards,
Yan, Zi