From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 42A83C282DE for ; Thu, 6 Mar 2025 03:04:42 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 7D0AE280006; Wed, 5 Mar 2025 22:04:41 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 77E90280005; Wed, 5 Mar 2025 22:04:41 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 64FED280006; Wed, 5 Mar 2025 22:04:41 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 48998280005 for ; Wed, 5 Mar 2025 22:04:41 -0500 (EST) Received: from smtpin11.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 369EE1C94B1 for ; Thu, 6 Mar 2025 03:04:41 +0000 (UTC) X-FDA: 83189633562.11.D5C504E Received: from mail-il1-f171.google.com (mail-il1-f171.google.com [209.85.166.171]) by imf07.hostedemail.com (Postfix) with ESMTP id 4AC6340006 for ; Thu, 6 Mar 2025 03:04:39 +0000 (UTC) Authentication-Results: imf07.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=HmEQ5mu9; spf=pass (imf07.hostedemail.com: domain of ryncsn@gmail.com designates 209.85.166.171 as permitted sender) smtp.mailfrom=ryncsn@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1741230279; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=QTPHjQ6rOvRQ5e3N9KhKF5WRS1IcdBRxGAtFt0rhx/4=; b=wlrSwef0YQRBu87s0jx+fy6NF2ndBOEcuIpFpVtypUP6HLn6HVCvpejuLJyTwLiJSMq9ch kzeKEaCffxtvvKrnQX3ab25M7eEpKxfb4Qblq55Gy88YDldYJ/H3BHxAuNIi67xwDOiuz3 dgCiyi8JRREqMm5XtC7qWeaYpGmUE6s= ARC-Authentication-Results: i=1; imf07.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=HmEQ5mu9; spf=pass (imf07.hostedemail.com: domain of ryncsn@gmail.com designates 209.85.166.171 as permitted sender) smtp.mailfrom=ryncsn@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1741230279; a=rsa-sha256; cv=none; b=eY2d7NMhNT7g2gJ3gRYgrp1T+gC8E8R4rjEjqYZN5ZXd15acTKYui+zIyMoQq1nwNat9Bh VvAEOeUXMZe/NMEEfNBo6pcrOIrVTqlXcBNmBO0gV1if7v7qBQeOZYp4s9EoBvL9rn8O+X VxmLNLve/J2ySkeqMjZuvjsbl8+DoWY= Received: by mail-il1-f171.google.com with SMTP id e9e14a558f8ab-3d2a8c2467eso710365ab.3 for ; Wed, 05 Mar 2025 19:04:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1741230278; x=1741835078; darn=kvack.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=QTPHjQ6rOvRQ5e3N9KhKF5WRS1IcdBRxGAtFt0rhx/4=; b=HmEQ5mu95fkPIaC3T9gWO9Nfq2noRyV/I1PlxF6z596nb3Ia9qwIQHE6tgSfNPYAS6 h0uPrbJZ8e5Hc1YlF08d6nAHquJ/Koubjw+1QXTJHUm8xjOQV7OW96xBxAikpoDqrmU4 zHLXr9fTHcO68CMM1Pp6fdRHoLFX0Jm69vNxsZ90E+ar10m/8KbfdI6arbCvOErROUea qJ19Z3ntKYVSWMlqA1lrNIzZ3rgqACaxDarQ0+rsCWMzckHwbS48WF64Xq5ecGl6drxB KUHjL4BUyilaTMs51Td5p1dzH3690d0/AxiF1YZ7KTXe4XPwd2g2ln7km8XDKylVk6Kv sytw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1741230278; x=1741835078; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=QTPHjQ6rOvRQ5e3N9KhKF5WRS1IcdBRxGAtFt0rhx/4=; b=QdIA3W81sVNMi5FFj+x+3D0xJM7M5qBAR+N9iD0hy+ac9tHAPqyy6NU0S1R6D3PMrt pCCcDSE0b2yC9U/md+Ub4+kh9EzeQjctbTnPiVUB3Njz/EldsPkbf9pf0Rovp1sn/r8m AyupcMLPgb91HLqejn9yNLcqo0h4gd59XWpMWkkWCNd8AZ3F5lErVrvk/W9O10Jz+LNm v/r80xHI7Ix1ZniSK+MO2/IgX/H8iJwOe12EzFKEC75SYU6Wb+9c8KM+y7SxuoX/TL4b yMIavYczO7cces0VJC2VCZd0VdKG2CTCzRysu72URWWYV51tjyB9KosVvfz8/LQpf7Nm jH+g== X-Forwarded-Encrypted: i=1; AJvYcCVL6Mu/K6g6J2sYPsonwTPvixHebXY+Re3L4qr/fbVZcJhphzXQN23VE2EJAU1v0XgwFLTslNdsvw==@kvack.org X-Gm-Message-State: AOJu0YyfyFtq2YWid//lpm0Tvfso8ucJAGRpk8RFndBI+RxIJC3rJRE+ QwoJAO8IejezA/xfN44hReRbStT4/IOb0D0Q8VEFvSC2bJw6MNXvfdXLhzP4cMz0xVQfbwLdxnv Idb9FFr2GmelVE9YeNPU25ck50hQ= X-Gm-Gg: ASbGnctkXue/wayKg2gQpXq80mFRcJAlk+m56WiCHjcaY6DkRXEaq/2eY2OttcyPZ8k nFkiCFpFcaAyGciphjeZ+rGg20tGMaAAxw7HI5Mi2N7CAVME3PtKZMkVqtZQgQClG+U3tBLuQUn uxefNrgEKuVDYm5ljstlb01dG7tA== X-Google-Smtp-Source: AGHT+IH89Mf6uZW7zjqo37+0Io0+nUfpejpIczRhLGghrBlP2RlfzIQi3LmPucbaOaoUZehmx8fIZ7dKtXzt26eVxto= X-Received: by 2002:a05:6e02:20e1:b0:3d3:fdcc:8fb8 with SMTP id e9e14a558f8ab-3d42b8a703fmr55085455ab.10.1741230278206; Wed, 05 Mar 2025 19:04:38 -0800 (PST) MIME-Version: 1.0 References: <20250306023133.44838-1-songmuchun@bytedance.com> In-Reply-To: From: Kairui Song Date: Thu, 6 Mar 2025 11:04:20 +0800 X-Gm-Features: AQ5f1JqlzzBmoVJPCwzzjxlr6WNIti1gz7UAYuLUOM8w67kVdbaEmjLyT5pOa1E Message-ID: Subject: Re: [PATCH] mm: memcontrol: fix swap counter leak from offline cgroup To: Muchun Song Cc: hannes@cmpxchg.org, mhocko@kernel.org, roman.gushchin@linux.dev, shakeel.butt@linux.dev, muchun.song@linux.dev, akpm@linux-foundation.org, chrisl@kernel.org, linux-kernel@vger.kernel.org, cgroups@vger.kernel.org, linux-mm@kvack.org, stable@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Stat-Signature: qiicctzpzyeaxa44y6pmsb9hoak7fgrp X-Rspamd-Queue-Id: 4AC6340006 X-Rspamd-Server: rspam06 X-Rspam-User: X-HE-Tag: 1741230279-437664 X-HE-Meta: U2FsdGVkX19KLOiEhFpiVQ5qn9tlcJ5iNZx/4gC8y4bHq9unKUZQz+Fs6QZ5++g4tOLkq7f3f5cUdsgLe6J6qdtoChbOhrzChLSOpYa8ij+MEqYQJxKhMfy6oCrHa/BArz5CS9RKjB+Z2mF3H9xo225yN8QkpbYlBV2EBq5lE+GTq1GE63F161tCUN5R4E2z8mPBxTOpt05nGdjMx73nJcz/2jgfdEPa7PiF0uiGrCnLq9HZqyoh8bONDx/iR2r0u5+yDsGAFgyc1YO9xUG6lLm9c1jpnEgy9wqwqs3JNTkbG8nFxw3SkXij96YqKCnrE7fv1buEKVdPl9h7LnFF9OW4d3/95woyqnAwNfDKXDIgm7sJ/r8MqAKT4AY2rFnuU565N/JbLoldEkNJu108VrlZ1dkM1u7b9qLEggq1xeO8wv8SMz1Y/xiPUAMXvSJ1Osa8uYaxllhwejFkz5vl0vztB+DdniK8On18NRE0ynM3TcNOOj9LJ4/Qvu9rZ8azf9++KN7k/GvubYfrse5O0q79q0Bd4yDjM0h5yhq00PvTfuIbPfMUYa96Nb54xOm1pG3ygTa1dSZeqT3NZWro1XeZmv6jbcmhC9Dp0GV7jnKZnp+P4dqs55xBM4T7TDavIpTflkssGDsLgr+8WQySvqNSWb6RCBLJcxxTu+hIPiWX5myw7cJNj08YFjUJ8ExoGJQEUvMh+9iM7ElwltpmaAacCkzAGeMfOZSDpGpqBxWGVYEQxOiT4TMzUh7H3DbbN+IqHlLiZnZN6pbjwdfUCAG1Y7AGiIOSWzTdQfj+abSSmBBhe82tM7C17oA376pGRSmyoROvn9ObOu2bTyFTh3gMyA95ndqXuHGuyEHGDwzyz4LUjxSjTw06uTjlOyUdYWfJfm6q3FJK/+DOVu1PqVLyAB3c2KBKnUCBesyBQBubV9cwYG6La2D1Lt8Dg+6mcC2j1RG8vHrvdj5/VH9 3tmBdse6 utwRlthMk52m0YoXHE02niPkUZiCv6DArKIuNpu7bzBc9MkMfsxaq1Loo+hLolsSUokO13AIvfMnBpdDsMl1yz++o4VOIj0QgqtwNWLBdrgyLyxlzpI6NErnX7NYKXEhCsJm9gItUUL0xuddDXFzV/5Jho3CslQfiGKpxKbslQzCnna+B0ujfJfRR/jQxHOpVQhwc0f++MgGqXy9RiH+8GgjnSQwshfJWGrnOnOUeRIIzwxMMaLmk6KsLkYSpHD2Bd1UQx94lT+Gbm9EppcBPD9mMejvqcAoa0Bx+Ry83U9Q1q7buESUBQmmmJcFYulatJgjViY49Dgz6/KFxuGAf33xbO9IRLu4cmJFXIEIdby2Zl1dqPv8ATIVLclP35icvV3qE2vXGST9h0UAucv+F9Ov21yJeZHzmYkYB X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Thu, Mar 6, 2025 at 10:54=E2=80=AFAM Kairui Song wrot= e: > > On Thu, Mar 6, 2025 at 10:32=E2=80=AFAM Muchun Song wrote: > > > > The commit 6769183166b3 has removed the parameter of id from > > swap_cgroup_record() and get the memcg id from > > mem_cgroup_id(folio_memcg(folio)). However, the caller of it > > may update a different memcg's counter instead of > > folio_memcg(folio). E.g. in the caller of mem_cgroup_swapout(), > > @swap_memcg could be different with @memcg and update the counter > > of @swap_memcg, but swap_cgroup_record() records the wrong memcg's > > ID. When it is uncharged from __mem_cgroup_uncharge_swap(), the > > swap counter will leak since the wrong recorded ID. Fix it by > > bring the parameter of id back. > > > > Fixes: 6769183166b3 ("mm/swap_cgroup: decouple swap cgroup recording an= d clearing") > > Cc: > > Signed-off-by: Muchun Song > > --- > > include/linux/swap_cgroup.h | 4 ++-- > > mm/memcontrol.c | 4 ++-- > > mm/swap_cgroup.c | 7 ++++--- > > 3 files changed, 8 insertions(+), 7 deletions(-) > > > > diff --git a/include/linux/swap_cgroup.h b/include/linux/swap_cgroup.h > > index b5ec038069dab..91cdf12190a03 100644 > > --- a/include/linux/swap_cgroup.h > > +++ b/include/linux/swap_cgroup.h > > @@ -6,7 +6,7 @@ > > > > #if defined(CONFIG_MEMCG) && defined(CONFIG_SWAP) > > > > -extern void swap_cgroup_record(struct folio *folio, swp_entry_t ent); > > +extern void swap_cgroup_record(struct folio *folio, unsigned short id,= swp_entry_t ent); > > extern unsigned short swap_cgroup_clear(swp_entry_t ent, unsigned int = nr_ents); > > extern unsigned short lookup_swap_cgroup_id(swp_entry_t ent); > > extern int swap_cgroup_swapon(int type, unsigned long max_pages); > > @@ -15,7 +15,7 @@ extern void swap_cgroup_swapoff(int type); > > #else > > > > static inline > > -void swap_cgroup_record(struct folio *folio, swp_entry_t ent) > > +void swap_cgroup_record(struct folio *folio, unsigned short id, swp_en= try_t ent) > > { > > } > > > > diff --git a/mm/memcontrol.c b/mm/memcontrol.c > > index a5d870fbb4321..a5ab603806fbb 100644 > > --- a/mm/memcontrol.c > > +++ b/mm/memcontrol.c > > @@ -4988,7 +4988,7 @@ void mem_cgroup_swapout(struct folio *folio, swp_= entry_t entry) > > mem_cgroup_id_get_many(swap_memcg, nr_entries - 1); > > mod_memcg_state(swap_memcg, MEMCG_SWAP, nr_entries); > > > > - swap_cgroup_record(folio, entry); > > + swap_cgroup_record(folio, mem_cgroup_id(swap_memcg), entry); > > > > folio_unqueue_deferred_split(folio); > > folio->memcg_data =3D 0; > > @@ -5050,7 +5050,7 @@ int __mem_cgroup_try_charge_swap(struct folio *fo= lio, swp_entry_t entry) > > mem_cgroup_id_get_many(memcg, nr_pages - 1); > > mod_memcg_state(memcg, MEMCG_SWAP, nr_pages); > > > > - swap_cgroup_record(folio, entry); > > + swap_cgroup_record(folio, mem_cgroup_id(memcg), entry); > > > > return 0; > > } > > diff --git a/mm/swap_cgroup.c b/mm/swap_cgroup.c > > index be39078f255be..1007c30f12e2c 100644 > > --- a/mm/swap_cgroup.c > > +++ b/mm/swap_cgroup.c > > @@ -58,9 +58,11 @@ static unsigned short __swap_cgroup_id_xchg(struct s= wap_cgroup *map, > > * entries must not have been charged > > * > > * @folio: the folio that the swap entry belongs to > > + * @id: mem_cgroup ID to be recorded > > * @ent: the first swap entry to be recorded > > */ > > -void swap_cgroup_record(struct folio *folio, swp_entry_t ent) > > +void swap_cgroup_record(struct folio *folio, unsigned short id, > > + swp_entry_t ent) > > { > > unsigned int nr_ents =3D folio_nr_pages(folio); > > struct swap_cgroup *map; > > @@ -72,8 +74,7 @@ void swap_cgroup_record(struct folio *folio, swp_entr= y_t ent) > > map =3D swap_cgroup_ctrl[swp_type(ent)].map; > > > > do { > > - old =3D __swap_cgroup_id_xchg(map, offset, > > - mem_cgroup_id(folio_memcg(f= olio))); > > + old =3D __swap_cgroup_id_xchg(map, offset, id); > > VM_BUG_ON(old); > > } while (++offset !=3D end); > > } > > -- > > 2.20.1 > > > > Good catch, Thanks! > > Reviewed-by: Kairui Song BTW, it need to be fixed in 6.14, no stable fix is needed, just double checked the commit is not in 6.13.