[PATCH] mm/shrinker: Fix refcount leak in shrink_slab_memcg()

[PATCH] mm/shrinker: Fix refcount leak in shrink_slab_memcg()

[Altan Hacigumus]

When kmem is disabled for memcg, slab-backed shrinkers are skipped.
However, shrink_slab_memcg() doesn't drop the reference acquired via
shrinker_try_get() before continuing.

Add the missing shrinker_put().

Fixes: 50d09da8e119 ("mm: shrinker: make memcg slab shrink lockless")

Signed-off-by: Altan Hacigumus <ahacigu.linux@gmail.com>
---
 mm/shrinker.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/mm/shrinker.c b/mm/shrinker.c
index 4a93fd433689..d0be120488b4 100644
--- a/mm/shrinker.c
+++ b/mm/shrinker.c
@@ -544,8 +544,10 @@ static unsigned long shrink_slab_memcg(gfp_t gfp_mask, int nid,
 
 			/* Call non-slab shrinkers even though kmem is disabled */
 			if (!memcg_kmem_online() &&
-			    !(shrinker->flags & SHRINKER_NONSLAB))
+			    !(shrinker->flags & SHRINKER_NONSLAB)) {
+				shrinker_put(shrinker);
 				continue;
+			}
 
 			ret = do_shrink_slab(&sc, shrinker, priority);
 			if (ret == SHRINK_EMPTY) {
-- 
2.43.0

Re: [PATCH] mm/shrinker: Fix refcount leak in shrink_slab_memcg()

[Qi Zheng]

On 2/3/26 3:37 PM, Altan Hacigumus wrote:
> When kmem is disabled for memcg, slab-backed shrinkers are skipped.
> However, shrink_slab_memcg() doesn't drop the reference acquired via
> shrinker_try_get() before continuing.

Good catch!

> 
> Add the missing shrinker_put().
> 
> Fixes: 50d09da8e119 ("mm: shrinker: make memcg slab shrink lockless")
> 
> Signed-off-by: Altan Hacigumus <ahacigu.linux@gmail.com>
> ---
>   mm/shrinker.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/mm/shrinker.c b/mm/shrinker.c
> index 4a93fd433689..d0be120488b4 100644
> --- a/mm/shrinker.c
> +++ b/mm/shrinker.c
> @@ -544,8 +544,10 @@ static unsigned long shrink_slab_memcg(gfp_t gfp_mask, int nid,
>   
>   			/* Call non-slab shrinkers even though kmem is disabled */
>   			if (!memcg_kmem_online() &&
> -			    !(shrinker->flags & SHRINKER_NONSLAB))
> +			    !(shrinker->flags & SHRINKER_NONSLAB)) {

Since memcg_kmem_online() and shrinker->flags cannot be changed
dynamically, it's best to remove this shrinker from the bitmap:

				clear_bit(offset, unit->map);

Otherwise LGTM.

Acked-by: Qi Zheng <zhengqi.arch@bytedance.com>

Thanks!


> +				shrinker_put(shrinker);
>   				continue;
> +			}
>   
>   			ret = do_shrink_slab(&sc, shrinker, priority);
>   			if (ret == SHRINK_EMPTY) {

Re: [PATCH] mm/shrinker: Fix refcount leak in shrink_slab_memcg()

[Altan Hacigumus]

[-- Attachment #1: Type: text/plain, Size: 1806 bytes --]

Sure, makes sense.
Will send a v2 with the bitmap clearing.

Thanks,
Altan


On Tue, Feb 3, 2026 at 12:18 AM Qi Zheng <zhengqi.arch@bytedance.com> wrote:

> On 2/3/26 3:37 PM, Altan Hacigumus wrote:
> > When kmem is disabled for memcg, slab-backed shrinkers are skipped.
> > However, shrink_slab_memcg() doesn't drop the reference acquired via
> > shrinker_try_get() before continuing.
>
> Good catch!
>
> >
> > Add the missing shrinker_put().
> >
> > Fixes: 50d09da8e119 ("mm: shrinker: make memcg slab shrink lockless")
> >
> > Signed-off-by: Altan Hacigumus <ahacigu.linux@gmail.com>
> > ---
> >   mm/shrinker.c | 4 +++-
> >   1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/mm/shrinker.c b/mm/shrinker.c
> > index 4a93fd433689..d0be120488b4 100644
> > --- a/mm/shrinker.c
> > +++ b/mm/shrinker.c
> > @@ -544,8 +544,10 @@ static unsigned long shrink_slab_memcg(gfp_t
> gfp_mask, int nid,
> >
> >                       /* Call non-slab shrinkers even though kmem is
> disabled */
> >                       if (!memcg_kmem_online() &&
> > -                         !(shrinker->flags & SHRINKER_NONSLAB))
> > +                         !(shrinker->flags & SHRINKER_NONSLAB)) {
>
> Since memcg_kmem_online() and shrinker->flags cannot be changed
> dynamically, it's best to remove this shrinker from the bitmap:
>
>                                 clear_bit(offset, unit->map);
>
> Otherwise LGTM.
>
> Acked-by: Qi Zheng <zhengqi.arch@bytedance.com>
>
> Thanks!
>
>
> > +                             shrinker_put(shrinker);
> >                               continue;
> > +                     }
> >
> >                       ret = do_shrink_slab(&sc, shrinker, priority);
> >                       if (ret == SHRINK_EMPTY) {
>

[-- Attachment #2: Type: text/html, Size: 2674 bytes --]

Re: [PATCH] mm/shrinker: Fix refcount leak in shrink_slab_memcg()

[Altan Hacigumus]

Sure, makes sense.
Will send a v2 with the bitmap clearing.

Thanks,
Altan


On Tue, Feb 3, 2026 at 12:18 AM Qi Zheng <zhengqi.arch@bytedance.com> wrote:
>
> On 2/3/26 3:37 PM, Altan Hacigumus wrote:
> > When kmem is disabled for memcg, slab-backed shrinkers are skipped.
> > However, shrink_slab_memcg() doesn't drop the reference acquired via
> > shrinker_try_get() before continuing.
>
> Good catch!
>
> >
> > Add the missing shrinker_put().
> >
> > Fixes: 50d09da8e119 ("mm: shrinker: make memcg slab shrink lockless")
> >
> > Signed-off-by: Altan Hacigumus <ahacigu.linux@gmail.com>
> > ---
> >   mm/shrinker.c | 4 +++-
> >   1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/mm/shrinker.c b/mm/shrinker.c
> > index 4a93fd433689..d0be120488b4 100644
> > --- a/mm/shrinker.c
> > +++ b/mm/shrinker.c
> > @@ -544,8 +544,10 @@ static unsigned long shrink_slab_memcg(gfp_t gfp_mask, int nid,
> >
> >                       /* Call non-slab shrinkers even though kmem is disabled */
> >                       if (!memcg_kmem_online() &&
> > -                         !(shrinker->flags & SHRINKER_NONSLAB))
> > +                         !(shrinker->flags & SHRINKER_NONSLAB)) {
>
> Since memcg_kmem_online() and shrinker->flags cannot be changed
> dynamically, it's best to remove this shrinker from the bitmap:
>
>                                 clear_bit(offset, unit->map);
>
> Otherwise LGTM.
>
> Acked-by: Qi Zheng <zhengqi.arch@bytedance.com>
>
> Thanks!
>
>
> > +                             shrinker_put(shrinker);
> >                               continue;
> > +                     }
> >
> >                       ret = do_shrink_slab(&sc, shrinker, priority);
> >                       if (ret == SHRINK_EMPTY) {

[PATCH v2] mm/shrinker: Fix refcount leak in shrink_slab_memcg()

[Altan Hacigumus]

When kmem is disabled for memcg, slab-backed shrinkers are skipped.
However, shrink_slab_memcg() doesn't drop the reference acquired via
shrinker_try_get() before continuing.

Add the missing shrinker_put().

Also, since memcg_kmem_online() and shrinker flags cannot change
dynamically, remove the shrinker from the bitmap to avoid unnecessary
future scans.

Fixes: 50d09da8e119 ("mm: shrinker: make memcg slab shrink lockless")
Suggested-by: Qi Zheng <zhengqi.arch@bytedance.com>
Acked-by: Qi Zheng <zhengqi.arch@bytedance.com>
Link: https://lore.kernel.org/r/20260203073757.135088-1-ahacigu.linux@gmail.com
Signed-off-by: Altan Hacigumus <ahacigu.linux@gmail.com>
---
Changes in v2:
- Use clear_bit() to remove shrinker from bitmap instead of just skipping
---
 mm/shrinker.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/mm/shrinker.c b/mm/shrinker.c
index 4a93fd433689..68dc7b4242f2 100644
--- a/mm/shrinker.c
+++ b/mm/shrinker.c
@@ -544,8 +544,11 @@ static unsigned long shrink_slab_memcg(gfp_t gfp_mask, int nid,
 
 			/* Call non-slab shrinkers even though kmem is disabled */
 			if (!memcg_kmem_online() &&
-			    !(shrinker->flags & SHRINKER_NONSLAB))
+			    !(shrinker->flags & SHRINKER_NONSLAB)) {
+				clear_bit(offset, unit->map);
+				shrinker_put(shrinker);
 				continue;
+			}
 
 			ret = do_shrink_slab(&sc, shrinker, priority);
 			if (ret == SHRINK_EMPTY) {
-- 
2.43.0

Re: [PATCH v2] mm/shrinker: Fix refcount leak in shrink_slab_memcg()

[Qi Zheng]

On 2/4/26 11:35 AM, Altan Hacigumus wrote:
> When kmem is disabled for memcg, slab-backed shrinkers are skipped.
> However, shrink_slab_memcg() doesn't drop the reference acquired via
> shrinker_try_get() before continuing.
> 
> Add the missing shrinker_put().
> 
> Also, since memcg_kmem_online() and shrinker flags cannot change
> dynamically, remove the shrinker from the bitmap to avoid unnecessary
> future scans.
> 
> Fixes: 50d09da8e119 ("mm: shrinker: make memcg slab shrink lockless")
> Suggested-by: Qi Zheng <zhengqi.arch@bytedance.com>

You identified and fixed this issue independently, not based on my
suggestion, so this tag is unnecessary. ;)

(I guess Andrew can help remove this tag)

Thanks,
Qi

> Acked-by: Qi Zheng <zhengqi.arch@bytedance.com>
> Link: https://lore.kernel.org/r/20260203073757.135088-1-ahacigu.linux@gmail.com
> Signed-off-by: Altan Hacigumus <ahacigu.linux@gmail.com>
> ---
> Changes in v2:
> - Use clear_bit() to remove shrinker from bitmap instead of just skipping
> ---
>   mm/shrinker.c | 5 ++++-
>   1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/mm/shrinker.c b/mm/shrinker.c
> index 4a93fd433689..68dc7b4242f2 100644
> --- a/mm/shrinker.c
> +++ b/mm/shrinker.c
> @@ -544,8 +544,11 @@ static unsigned long shrink_slab_memcg(gfp_t gfp_mask, int nid,
>   
>   			/* Call non-slab shrinkers even though kmem is disabled */
>   			if (!memcg_kmem_online() &&
> -			    !(shrinker->flags & SHRINKER_NONSLAB))
> +			    !(shrinker->flags & SHRINKER_NONSLAB)) {
> +				clear_bit(offset, unit->map);
> +				shrinker_put(shrinker);
>   				continue;
> +			}
>   
>   			ret = do_shrink_slab(&sc, shrinker, priority);
>   			if (ret == SHRINK_EMPTY) {

Re: [PATCH v2] mm/shrinker: Fix refcount leak in shrink_slab_memcg()

[Muchun Song]

> On Feb 4, 2026, at 11:35, Altan Hacigumus <ahacigu.linux@gmail.com> wrote:
> 
> When kmem is disabled for memcg, slab-backed shrinkers are skipped.
> However, shrink_slab_memcg() doesn't drop the reference acquired via
> shrinker_try_get() before continuing.
> 
> Add the missing shrinker_put().
> 
> Also, since memcg_kmem_online() and shrinker flags cannot change
> dynamically, remove the shrinker from the bitmap to avoid unnecessary
> future scans.
> 
> Fixes: 50d09da8e119 ("mm: shrinker: make memcg slab shrink lockless")
> Suggested-by: Qi Zheng <zhengqi.arch@bytedance.com>
> Acked-by: Qi Zheng <zhengqi.arch@bytedance.com>
> Link: https://lore.kernel.org/r/20260203073757.135088-1-ahacigu.linux@gmail.com
> Signed-off-by: Altan Hacigumus <ahacigu.linux@gmail.com>

Reviewed-by: Muchun Song <muchun.song@linux.dev>