hugetlbfs: release subpool on fill_super failure

hugetlbfs_fill_super() allocates a hugepage subpool when size or min_size mount options are specified. hugepage_new_subpool() may also reserve huge pages for min_size.

If root dentry creation fails after the subpool is created, the failure path frees the subpool with kfree(). This bypasses hugepage_put_subpool() and can leave min_size reservations charged.

Use hugepage_put_subpool() on the failure path, matching the normal put_super path.

---
 fs/hugetlbfs/inode.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index 216e1a0dd0b2..6a1d7e778cb0 100644
@@ -1419,7 +1419,8 @@ hugetlbfs_fill_super(struct super_block *sb, struct fs_context *fc)
 		goto out_free;
 	return 0;
 out_free:
-	kfree(sbinfo->spool);
+	if (sbinfo->spool)
+		hugepage_put_subpool(sbinfo->spool);
 	kfree(sbinfo);
 	return -ENOMEM;
 }

2.51.0

lgtm, thanks.

This might have led AI review to find a pre-existing bug in mm/hugetlb.c:unlock_or_release_subpool():

	https://sashiko.dev/#/patchset/[email protected]

Thanks, Andrew.

Yes, moving the NULL check into hugepage_put_subpool() makes sense. I'll send a follow-up cleanup patch for that.

The Sashiko comment about unlock_or_release_subpool() also looks like a separate pre-existing race to me, so I'll look at that as an independent fix.

Thanks,
Yichong

Both callers of hugepage_put_subpool() check whether the subpool pointer is NULL before calling it. Move the NULL check into hugepage_put_subpool() so callers can use the helper unconditionally.

This is a follow-up cleanup after using hugepage_put_subpool() from the hugetlbfs_fill_super() failure path.

---
 fs/hugetlbfs/inode.c | 6 ++----
 mm/hugetlb.c         | 3 +++
 2 files changed, 5 insertions(+), 4 deletions(-)

index 6a1d7e778cb0..0c125eda16fd 100644
@@ -1129,8 +1129,7 @@ static void hugetlbfs_put_super(struct super_block *sb)
 	if (sbi) {
 		sb->s_fs_info = NULL;
 
-		if (sbi->spool)
-			hugepage_put_subpool(sbi->spool);
+		hugepage_put_subpool(sbi->spool);
 
 		kfree(sbi);
 	}

@@ -1419,8 +1418,7 @@ hugetlbfs_fill_super(struct super_block *sb, struct fs_context *fc)
 		goto out_free;
 	return 0;
 out_free:
-	if (sbinfo->spool)
-		hugepage_put_subpool(sbinfo->spool);
+	hugepage_put_subpool(sbinfo->spool);
 	kfree(sbinfo);
 	return -ENOMEM;
 }

index 571212b80835..e319c6a00555 100644
@@ -181,6 +181,9 @@ void hugepage_put_subpool(struct hugepage_subpool *spool)
 {
 	unsigned long flags;
 
+	if (!spool)
+		return;
+
 	spin_lock_irqsave(&spool->lock, flags);
 	BUG_ON(!spool->count);
 	spool->count--;

2.51.0