[PATCH] mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page

From: Sunny Patel

Date: Sat Apr 25 2026 - 09:45:12 EST


When migrate_vma_insert_huge_pmd_page() jumps to unlock_abort due
to a PMD check failure, the pgtable allocated earlier via
pte_alloc_one() is never freed, causing a memory leak.

Add a pte_free() call in the unlock_abort error path to release
the pgtable before returning.

Signed-off-by: Sunny Patel <nueralspacetech@xxxxxxxxx>
---
mm/migrate_device.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/mm/migrate_device.c b/mm/migrate_device.c
index fbfe5715f635..457bab5c7c31 100644
--- a/mm/migrate_device.c
+++ b/mm/migrate_device.c
@@ -893,6 +893,7 @@ static int migrate_vma_insert_huge_pmd_page(struct migrate_vma *migrate,

unlock_abort:
spin_unlock(ptl);
+ pte_free(vma->vm_mm, pgtable);
abort:
for (i = 0; i < HPAGE_PMD_NR; i++)
src[i] &= ~MIGRATE_PFN_MIGRATE;
--
2.43.0