Re: [PATCH 2/4] mm: hugetlb: Fix folio refcount mismatch on memcg charge failure

[Muchun Song]

> On Jul 8, 2026, at 04:46, Ackerley Tng via B4 Relay <devnull+ackerleytng.google.com@xxxxxxxxxx> wrote:
> 
> From: Ackerley Tng <ackerleytng@xxxxxxxxxx>
> 
> When mem_cgroup_charge_hugetlb(folio, gfp) returns -ENOMEM, the folio has
> its refcount set to 1 via folio_ref_unfreeze(folio, 1).
> 
> The error path calls free_huge_folio(folio) directly, which expects a
> refcount of 0. Hence, VM_BUG_ON_FOLIO(folio_ref_count(folio), folio) is
> triggered.
> 
> Even with CONFIG_DEBUG_VM disabled, returning a folio with refcount 1 to
> the freelist can corrupt allocator state later.
> 
> Use folio_put(folio) instead of free_huge_folio(folio) to properly drop the
> reference before freeing it.
> 
> Fixes: 991135774c0e0 ("memcg/hugetlb: introduce mem_cgroup_charge_hugetlb")
> Signed-off-by: Ackerley Tng <ackerleytng@xxxxxxxxxx>

Yes, a real issue, I think we should cc stable as well.

Reviewed-by: Muchun Song <muchun.song@xxxxxxxxx>

Thanks.