Re: [PATCH] hugetlbfs: release subpool on fill_super failure

[Andrew Morton]

On Mon, 20 Jul 2026 10:18:59 +0800 Yichong Chen <chenyichong@xxxxxxxxxxxxx> wrote:

> hugetlbfs_fill_super() allocates a hugepage subpool when size or
> min_size mount options are specified.  hugepage_new_subpool() may also
> reserve huge pages for min_size.
> 
> If root dentry creation fails after the subpool is created, the failure
> path frees the subpool with kfree().  This bypasses
> hugepage_put_subpool() and can leave min_size reservations charged.
> 
> Use hugepage_put_subpool() on the failure path, matching the normal
> put_super path.

lgtm, thanks.

This might have led AI review to find a pre-existing bug in
mm/hugetlb.c:unlock_or_release_subpool():

	https://sashiko.dev/#/patchset/20260720021900.1376309-1-chenyichong@xxxxxxxxxxxxx

> --- a/fs/hugetlbfs/inode.c
> +++ b/fs/hugetlbfs/inode.c
> @@ -1419,7 +1419,8 @@ hugetlbfs_fill_super(struct super_block *sb, struct fs_context *fc)
>  		goto out_free;
>  	return 0;
>  out_free:
> -	kfree(sbinfo->spool);
> +	if (sbinfo->spool)
> +		hugepage_put_subpool(sbinfo->spool);

Both callers of hugepage_put_subpool do this NULL check.  We could move
that check into hugepage_put_subpool().

>  	kfree(sbinfo);
>  	return -ENOMEM;
>  }