Re: [PATCH] mm/memcontrol: fix obj_cgroup leak in mem_cgroup_css_online() error path

[David CARLIER <devnexen@gmail.com>]

Both good points. I'll address them in a v3:

  - Drop the redundant pn NULL check in the free_objcg error path.
  - Add a NULL check for pn in __mem_cgroup_free() to guard against
    partial alloc_mem_cgroup_per_node_info() failure.

On Sun, 22 Mar 2026 at 18:54, Andrew Morton <akpm@linux-foundation.org> wrote:
>
> On Sun, 22 Mar 2026 16:49:43 +0000 David Carlier <devnexen@gmail.com> wrote:
>
> > When obj_cgroup_alloc() fails partway through the NUMA node loop in
> > mem_cgroup_css_online(), the free_objcg error path drops the extra
> > reference held by pn->orig_objcg but never kills the initial percpu_ref
> > from obj_cgroup_alloc() stored in pn->objcg.
> >
> > Since css_offline is never called when css_online fails,
> > memcg_reparent_objcgs() never runs, so the percpu_ref_kill() that
> > normally drops this initial reference never executes. The obj_cgroup and
> > its per-cpu ref allocations are leaked.
> >
> > Clear pn->objcg via rcu_replace_pointer() and add the missing
> > percpu_ref_kill() in the error path, matching the normal teardown
> > sequence in memcg_reparent_objcgs().
> >
> > Fixes: 098fad3e1621 ("mm: memcontrol: convert objcg to be per-memcg per-node type")
>
> Thanks.  Sashiko review of this patch claims to have found another bug
> in 098fad3e1621:
>
>         https://sashiko.dev/#/patchset/20260322164943.37460-1-devnexen@gmail.com
>
> > Cc: stable@vger.kernel.org
>