From: bot+bpf-ci@kernel.org
To: hui.zhu@linux.dev, akpm@linux-foundation.org, hannes@cmpxchg.org,
mhocko@kernel.org, roman.gushchin@linux.dev,
shakeel.butt@linux.dev, muchun.song@linux.dev, ast@kernel.org,
daniel@iogearbox.net, andrii@kernel.org, martin.lau@linux.dev,
eddyz87@gmail.com, song@kernel.org, yonghong.song@linux.dev,
john.fastabend@gmail.com, kpsingh@kernel.org, sdf@fomichev.me,
haoluo@google.com, jolsa@kernel.org, shuah@kernel.org,
peterz@infradead.org, ojeda@kernel.org, nathan@kernel.org,
kees@kernel.org, tj@kernel.org, jeffxu@chromium.org,
mkoutny@suse.com, kernel@jfarr.cc, brauner@kernel.org,
rdunlap@infradead.org, brgerst@gmail.com, masahiroy@kernel.org,
davem@davemloft.net, kuba@kernel.org, hawk@kernel.org,
inwardvessel@gmail.com, willemb@google.com,
kerneljasonxing@gmail.com, paul.chaignon@gmail.com,
a.s.protopopov@gmail.com, ameryhung@gmail.com,
chenridong@huaweicloud.com, lance.yang@linux.dev,
jiayuan.chen@linux.dev, linux-kernel@vger.kernel.org,
linux-mm@kvack.org, cgroups@vger.kernel.org, bpf@vger.kernel.org,
netdev@vger.kernel.org, linu@kvack.org,
x-kselftest@vger.kernel.org
Cc: zhuhui@kylinos.cn,geliang@kernel.org,ast@kernel.org,andrii@kernel.org,daniel@iogearbox.net,martin.lau@kernel.org,eddyz87@gmail.com,yonghong.song@linux.dev,clm@meta.com,ihor.solodrai@linux.dev
Subject: Re: [RFC PATCH bpf-next v5 10/12] mm/bpf: Add BPF_F_ALLOW_OVERRIDE support for memcg_bpf_ops
Date: Tue, 27 Jan 2026 10:08:27 +0000 (UTC) [thread overview]
Message-ID: <12bedb9d4fc0676edf3812bfcc8ff7c761286fc6d2e8ae4ca457a6602ec98dfe@mail.kernel.org> (raw)
In-Reply-To: <4a1ad099a2db96b92318cb924d2a7b76ee530209.1769506741.git.zhuhui@kylinos.cn>
[-- Attachment #1: Type: text/plain, Size: 2384 bytes --]
> diff --git a/mm/bpf_memcontrol.c b/mm/bpf_memcontrol.c
> index e746eb9cbd56..7cd983e350d7 100644
> --- a/mm/bpf_memcontrol.c
> +++ b/mm/bpf_memcontrol.c
[ ... ]
> static int bpf_memcg_ops_reg(void *kdata, struct bpf_link *link)
> {
> struct bpf_struct_ops_link *ops_link
> = container_of(link, struct bpf_struct_ops_link, link);
>- struct memcg_bpf_ops *ops = kdata;
>+ struct memcg_bpf_ops *ops = kdata, *old_ops;
> struct mem_cgroup *memcg, *iter = NULL;
> int err = 0;
[ ... ]
>+ /* Check for incompatible bpf_ops in descendants. */
> while ((iter = mem_cgroup_iter(memcg, iter, NULL))) {
>- if (READ_ONCE(iter->bpf_ops)) {
>- mem_cgroup_iter_break(memcg, iter);
>+ struct memcg_bpf_ops *iter_ops = READ_ONCE(iter->bpf_ops);
>+
>+ if (iter_ops && iter_ops != old_ops) {
>+ /* cannot override existing bpf_ops of sub-cgroup. */
> err = -EBUSY;
>- break;
>+ goto unlock_out;
^^^^
It looks like this error path leaks a CSS reference. The original code
called mem_cgroup_iter_break(memcg, iter) before breaking out of the loop,
which releases the CSS reference held on iter. The new code jumps directly
to unlock_out without releasing this reference.
mem_cgroup_iter() acquires a reference on each returned memcg via
css_tryget() in mm/memcontrol.c. When breaking out of the loop early,
mem_cgroup_iter_break() must be called to release that reference.
Should this be:
if (iter_ops && iter_ops != old_ops) {
mem_cgroup_iter_break(memcg, iter);
err = -EBUSY;
goto unlock_out;
}
> }
>+ }
>+
>+ while ((iter = mem_cgroup_iter(memcg, iter, NULL))) {
> WRITE_ONCE(iter->bpf_ops, ops);
>+ iter->bpf_ops_flags = ops_link->flags;
> }
>- if (err)
>- clean_memcg_bpf_ops(memcg, ops);
>+
>+unlock_out:
> cgroup_unlock();
[ ... ]
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/21392729810
AI-authorship-score: low
AI-authorship-explanation: The commit follows standard kernel documentation patterns without distinctive AI markers.
issues-found: 1
issue-severity-score: medium
issue-severity-explanation: CSS reference leak in error path leads to memcg lifetime issues but does not cause immediate system instability.
next prev parent reply other threads:[~2026-01-27 10:08 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-27 9:42 [RFC PATCH bpf-next v5 00/12] mm: memcontrol: Add BPF hooks for memory controller Hui Zhu
2026-01-27 9:42 ` [RFC PATCH bpf-next v5 01/12] bpf: move bpf_struct_ops_link into bpf.h Hui Zhu
2026-01-27 9:42 ` [RFC PATCH bpf-next v5 02/12] bpf: initial support for attaching struct ops to cgroups Hui Zhu
2026-01-27 9:42 ` [RFC PATCH bpf-next v5 03/12] bpf: mark struct oom_control's memcg field as TRUSTED_OR_NULL Hui Zhu
2026-01-27 9:42 ` [RFC PATCH bpf-next v5 04/12] mm: define mem_cgroup_get_from_ino() outside of CONFIG_SHRINKER_DEBUG Hui Zhu
2026-01-27 9:42 ` [RFC PATCH bpf-next v5 05/12] libbpf: introduce bpf_map__attach_struct_ops_opts() Hui Zhu
2026-01-27 10:08 ` bot+bpf-ci
2026-01-27 9:45 ` [RFC PATCH bpf-next v5 06/12] bpf: Pass flags in bpf_link_create for struct_ops Hui Zhu
2026-01-27 9:45 ` [RFC PATCH bpf-next v5 07/12] libbpf: Support passing user-defined flags " Hui Zhu
2026-01-27 9:45 ` [RFC PATCH bpf-next v5 08/12] mm: memcontrol: Add BPF struct_ops for memory controller Hui Zhu
2026-01-27 10:08 ` bot+bpf-ci
2026-01-27 9:47 ` [RFC PATCH bpf-next v5 09/12] selftests/bpf: Add tests for memcg_bpf_ops Hui Zhu
2026-01-27 10:08 ` bot+bpf-ci
2026-01-27 9:47 ` [RFC PATCH bpf-next v5 10/12] mm/bpf: Add BPF_F_ALLOW_OVERRIDE support " Hui Zhu
2026-01-27 10:08 ` bot+bpf-ci [this message]
2026-01-27 9:47 ` [RFC PATCH bpf-next v5 11/12] selftests/bpf: Add test for memcg_bpf_ops hierarchies Hui Zhu
2026-01-27 9:48 ` [RFC PATCH bpf-next v5 12/12] samples/bpf: Add memcg priority control example Hui Zhu
2026-01-27 10:08 ` bot+bpf-ci
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=12bedb9d4fc0676edf3812bfcc8ff7c761286fc6d2e8ae4ca457a6602ec98dfe@mail.kernel.org \
--to=bot+bpf-ci@kernel.org \
--cc=a.s.protopopov@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=ameryhung@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=brauner@kernel.org \
--cc=brgerst@gmail.com \
--cc=cgroups@vger.kernel.org \
--cc=chenridong@huaweicloud.com \
--cc=clm@meta.com \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=eddyz87@gmail.com \
--cc=geliang@kernel.org \
--cc=hannes@cmpxchg.org \
--cc=haoluo@google.com \
--cc=hawk@kernel.org \
--cc=hui.zhu@linux.dev \
--cc=ihor.solodrai@linux.dev \
--cc=inwardvessel@gmail.com \
--cc=jeffxu@chromium.org \
--cc=jiayuan.chen@linux.dev \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kees@kernel.org \
--cc=kernel@jfarr.cc \
--cc=kerneljasonxing@gmail.com \
--cc=kpsingh@kernel.org \
--cc=kuba@kernel.org \
--cc=lance.yang@linux.dev \
--cc=linu@kvack.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=martin.lau@kernel.org \
--cc=martin.lau@linux.dev \
--cc=masahiroy@kernel.org \
--cc=mhocko@kernel.org \
--cc=mkoutny@suse.com \
--cc=muchun.song@linux.dev \
--cc=nathan@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=ojeda@kernel.org \
--cc=paul.chaignon@gmail.com \
--cc=peterz@infradead.org \
--cc=rdunlap@infradead.org \
--cc=roman.gushchin@linux.dev \
--cc=sdf@fomichev.me \
--cc=shakeel.butt@linux.dev \
--cc=shuah@kernel.org \
--cc=song@kernel.org \
--cc=tj@kernel.org \
--cc=willemb@google.com \
--cc=x-kselftest@vger.kernel.org \
--cc=yonghong.song@linux.dev \
--cc=zhuhui@kylinos.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox