From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 38D26C19F32 for ; Thu, 6 Mar 2025 02:54:34 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 650AF28000A; Wed, 5 Mar 2025 21:54:32 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 60141280005; Wed, 5 Mar 2025 21:54:32 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 4830B28000A; Wed, 5 Mar 2025 21:54:32 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 292AB280005 for ; Wed, 5 Mar 2025 21:54:32 -0500 (EST) Received: from smtpin14.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay05.hostedemail.com (Postfix) with ESMTP id D67AA561CB for ; Thu, 6 Mar 2025 02:54:32 +0000 (UTC) X-FDA: 83189607984.14.DD7E73A Received: from mail-lj1-f170.google.com (mail-lj1-f170.google.com [209.85.208.170]) by imf07.hostedemail.com (Postfix) with ESMTP id EE97A40002 for ; Thu, 6 Mar 2025 02:54:30 +0000 (UTC) Authentication-Results: imf07.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b="f/IQQU0H"; spf=pass (imf07.hostedemail.com: domain of ryncsn@gmail.com designates 209.85.208.170 as permitted sender) smtp.mailfrom=ryncsn@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1741229671; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=Th9BnbvFSv/H4LV5KRUlInal6A2L1r1zSMusFTF7La0=; b=GDmmsivnLO5gfdiy1xpwBK1tb2UM2KNTNGVDk1kqNXJqUWDEa2+FX3RG0ZIRBspOSqQDTk PIIirGzXgzJ3rk5ZtS8KHs8Kcrd5UTfF+2tR9ND3G5BB69L0/nrq+9dg1Xgs5C5gGHLvFf KTDzUPTzjLh2heZ/+LouYIBN/h0NaKo= ARC-Authentication-Results: i=1; imf07.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b="f/IQQU0H"; spf=pass (imf07.hostedemail.com: domain of ryncsn@gmail.com designates 209.85.208.170 as permitted sender) smtp.mailfrom=ryncsn@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1741229671; a=rsa-sha256; cv=none; b=Fwns4GfhbitqLn6ls/678zUwLJD1FuCgmnXGJ5YfsBPIDMDNVDGZbtWO4B79HoRe/0vd0A PfhCDbciORCTVr176AUoElkcGe8izvFG00mWvIl2g4UuKv8gfXW8edY0c61RscjP5BP2/f tpya316gtqQzMAmfQNfSTRFvODsqs7s= Received: by mail-lj1-f170.google.com with SMTP id 38308e7fff4ca-30be983a3b9so1532851fa.0 for ; Wed, 05 Mar 2025 18:54:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1741229669; x=1741834469; darn=kvack.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=Th9BnbvFSv/H4LV5KRUlInal6A2L1r1zSMusFTF7La0=; b=f/IQQU0HGGlt8zaAlbr6fw96oMHPxQkx4jEakG9f2z7T8QDlqn2CnWOw5+E3g9GdB4 oBkqNlpDN9tSSDWJbqQIZFtPE+xpgTS9nBoKAg4Sir/ZGMo2mV2Q6fw4N+Wu5za4Dtlc ZE4FCZs9A8Y+Ma7zt407DC5Qomh8oXltnN+7WeJmwFGn5T2B2dsrYRQbv43NgjyXts2w vg/vCMWE2yQzOigs9CvTdKXT41EQmgNNzo39Jkn+N71fGXx9JNmM67ddv0EApfJ/BIbj z1D8p0shtlmcGYFDvxDYFySgSvRpx4HhBRYJPYXWcXy3mu5vKkEaP7nSMzoUSUBfx1eG nrSA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1741229669; x=1741834469; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=Th9BnbvFSv/H4LV5KRUlInal6A2L1r1zSMusFTF7La0=; b=bsQ8emRxPPDKtANEbnAy3Fz+gBZAS4xsmdobxzq9bem82HfecXSHASU2xsvuQU3uC1 Jzou6sNPyaXpDRS8rlPUifruMsaS34EntqKOiJUyrVQJDstzZIZlJccQSrem2VaB8KbH jq4PXfEt2T9rvOJ7G9PwJTKRGdjHW7oKQOv6ocVE7Hi4KStkkJGqY3vnccd97QyTYLWF jMYajK8QkkY25mv88BhfIgX23DUhZ67FCfCdVDRpMJUaFXr6aUACSeTNi5UNFg/BSThg 0alC3a1aqJ7ax1uhVwAFa0PA35IrHdUo57YFZTrRV7PpG5woHSSw3b5BPffX+6hqasj3 CrYw== X-Forwarded-Encrypted: i=1; AJvYcCVPYHu/Ciqf9b01rFJWDR5Cw9upEVRNoKxvlTUmeQ7xb9Tdp88gCZ1ymexd/VjXI/T+yuerbI0SoQ==@kvack.org X-Gm-Message-State: AOJu0YwCPRbE8zBSuPAXe/hDeh4GR6lrZIGaf572fPCB/KHv4jCApsAE 6uRlDoDCkjKvWTYvBfs0La+/6v0BCcCZxwc1Ns1v6q3YI6SRWSkW2rmSpIMky4JaqAKqpNc1hkN lZlvjPSqWar1biNDKkUdEeUaUEJdGVkJi X-Gm-Gg: ASbGncttoM44gAyMXxhmb1ApXPNJnSe573E81y6OITDa88HSipN7RgoMZ9HTKiNHoQx 4TYSBfn/8jOqTpIzKgH4e7gGY3I8SoyNWrqS9AcX/IrerglfPx2JV0KCBlULuIIALT9xu+Kl7UL pJJwuarHS/1ZiqqGNc0yoGY6fAIw== X-Google-Smtp-Source: AGHT+IEJfVTrJM22yJTFgts9tci5nFp84rzjL9nZelaYrsIqHQ0VTM31zK+owTJLFjPMRhkTZOP1AOKhm9lNe6TiUlU= X-Received: by 2002:a05:6512:2309:b0:545:b89:309b with SMTP id 2adb3069b0e04-5497d3806ebmr1990378e87.44.1741229668765; Wed, 05 Mar 2025 18:54:28 -0800 (PST) MIME-Version: 1.0 References: <20250306023133.44838-1-songmuchun@bytedance.com> In-Reply-To: <20250306023133.44838-1-songmuchun@bytedance.com> From: Kairui Song Date: Thu, 6 Mar 2025 10:54:12 +0800 X-Gm-Features: AQ5f1Jo_jQXxQST2BfF6to7nckWMOdtZOnQRa7kHnH_qKevSEQD4MehIIfl6GcU Message-ID: Subject: Re: [PATCH] mm: memcontrol: fix swap counter leak from offline cgroup To: Muchun Song Cc: hannes@cmpxchg.org, mhocko@kernel.org, roman.gushchin@linux.dev, shakeel.butt@linux.dev, muchun.song@linux.dev, akpm@linux-foundation.org, chrisl@kernel.org, linux-kernel@vger.kernel.org, cgroups@vger.kernel.org, linux-mm@kvack.org, stable@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Stat-Signature: 9y8kmp1n1u5tui7i6agf7y8aru9u4rkp X-Rspamd-Queue-Id: EE97A40002 X-Rspamd-Server: rspam06 X-Rspam-User: X-HE-Tag: 1741229670-238491 X-HE-Meta: U2FsdGVkX189hoD3ZIcQcg+zkctBEdLlI5l8KN5a9zGsPJ1g4WhQJFBT9FoT1daYq2z4AglLZGwuHpNmrvsa1uN9ACaqyvEBsFpNd7A7XZ0BNaDoy4sX0i+O95I2x+18Spm8HhlqtpkI/Ncu9/xxxSMP1Z3q97Qq6hdKHvc62ZxB/rYv6StPD2FyQnBNkv1vgCWN2Z5KIuqcegjTnjfV/AWmvipQcqp0kn/CR6NIESibaBtdOLuzYqfyH4j8pAkmHede4Trb+PpX0q351BVsNna5RBlu9OAZmdY70swZW6K6eEVubJ+Y/9FoD7PQ3fp65R57EOjv/EF9vu/N6JXehJKLK/yZmh+G8Xi6Vj6XZbMYC/PWF1z+2+LeQthxtxKpx7drjkaWi18rMwLU+F5JIBztvyLUOO40Bf3fc9jQhWk4HEkq/FIitH/cwp+H44uXpH9JQV54UqY5yQ4w2ZiV3rustDkwj/3gqvr905Et8DRfsmQr/aiv/v004/NvgWmyr7IoZw28jTyhmISh3r9C8Q7TGw+W/qicfR9nQl4A38+bllq+YMCoe+WcQea1h6ywY4MxHJomxfr2qJkWy0IJok3yJO8h/Ib8eRQpwC3OQXvKqFL05OapG8X/5ATTomht6ugY2/JUEgxLTa20ylrP+HvmOeT/OPrAX1osp38GCLVi7jjDUo8uopPFZX+kEujKMx2EV/Rz8ZhfRJ4DeB47dCI8NyC6BD692kaKs+tOTFjk8XgU0LSpHOFI3SgWspSYvVisnHrVm3TJ7nSTvsC/OUo/IB+F7NGFsCCwi+yNfo+MKsNOGwavCPe6egAeS8XrIOC4ZB8dG1ricMVO01LqzFhg/QR2v1BOLRht7sYImyFSf/eUtp6ZFyTua2mNn7wHFgIbIOxcz31UOqobhyOLapyRKcgTSR8wr+Ef5wCckeDp9GhUomG/I5agItXYs7oW7dejYJwfBgdfV+nm3vT G6vCIH3x 4TAx3xw1hela3aGJICYEzbSiYayzUUfPLa0GFSyoSiezGxnPWnOefs8vA+EL97qPm45RIlnkESXrS/S6nI7mMX0GnRi02pT1rHYncwlTaoddth9VlmJvAbsdOHqSnor6UmCY9tW2yHY0JSv68s56/Fj3cVsOVfwkBapcVrDALGtxm9RSjsrjVepwlYqvA4v5gyK3hvuaRrK4u4NJfvTGnoy2Fp2BI0luQTr5qzhLF6NGft7gMKhpADyjpLR5+hl9WNQzyKOyTOu8YxlGqQdTYHEVD1L8lb/MYUmxhQTVDUaevdMpxfANVazJxYlFIBX3siT+8bO0WvUATqWDCKwwo1xnboC9W8XvKC/yRkhXS33V2iWdn55IHVgMXlwpMXBJxQZwyfmQ7JwN47Mg= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Thu, Mar 6, 2025 at 10:32=E2=80=AFAM Muchun Song wrote: > > The commit 6769183166b3 has removed the parameter of id from > swap_cgroup_record() and get the memcg id from > mem_cgroup_id(folio_memcg(folio)). However, the caller of it > may update a different memcg's counter instead of > folio_memcg(folio). E.g. in the caller of mem_cgroup_swapout(), > @swap_memcg could be different with @memcg and update the counter > of @swap_memcg, but swap_cgroup_record() records the wrong memcg's > ID. When it is uncharged from __mem_cgroup_uncharge_swap(), the > swap counter will leak since the wrong recorded ID. Fix it by > bring the parameter of id back. > > Fixes: 6769183166b3 ("mm/swap_cgroup: decouple swap cgroup recording and = clearing") > Cc: > Signed-off-by: Muchun Song > --- > include/linux/swap_cgroup.h | 4 ++-- > mm/memcontrol.c | 4 ++-- > mm/swap_cgroup.c | 7 ++++--- > 3 files changed, 8 insertions(+), 7 deletions(-) > > diff --git a/include/linux/swap_cgroup.h b/include/linux/swap_cgroup.h > index b5ec038069dab..91cdf12190a03 100644 > --- a/include/linux/swap_cgroup.h > +++ b/include/linux/swap_cgroup.h > @@ -6,7 +6,7 @@ > > #if defined(CONFIG_MEMCG) && defined(CONFIG_SWAP) > > -extern void swap_cgroup_record(struct folio *folio, swp_entry_t ent); > +extern void swap_cgroup_record(struct folio *folio, unsigned short id, s= wp_entry_t ent); > extern unsigned short swap_cgroup_clear(swp_entry_t ent, unsigned int nr= _ents); > extern unsigned short lookup_swap_cgroup_id(swp_entry_t ent); > extern int swap_cgroup_swapon(int type, unsigned long max_pages); > @@ -15,7 +15,7 @@ extern void swap_cgroup_swapoff(int type); > #else > > static inline > -void swap_cgroup_record(struct folio *folio, swp_entry_t ent) > +void swap_cgroup_record(struct folio *folio, unsigned short id, swp_entr= y_t ent) > { > } > > diff --git a/mm/memcontrol.c b/mm/memcontrol.c > index a5d870fbb4321..a5ab603806fbb 100644 > --- a/mm/memcontrol.c > +++ b/mm/memcontrol.c > @@ -4988,7 +4988,7 @@ void mem_cgroup_swapout(struct folio *folio, swp_en= try_t entry) > mem_cgroup_id_get_many(swap_memcg, nr_entries - 1); > mod_memcg_state(swap_memcg, MEMCG_SWAP, nr_entries); > > - swap_cgroup_record(folio, entry); > + swap_cgroup_record(folio, mem_cgroup_id(swap_memcg), entry); > > folio_unqueue_deferred_split(folio); > folio->memcg_data =3D 0; > @@ -5050,7 +5050,7 @@ int __mem_cgroup_try_charge_swap(struct folio *foli= o, swp_entry_t entry) > mem_cgroup_id_get_many(memcg, nr_pages - 1); > mod_memcg_state(memcg, MEMCG_SWAP, nr_pages); > > - swap_cgroup_record(folio, entry); > + swap_cgroup_record(folio, mem_cgroup_id(memcg), entry); > > return 0; > } > diff --git a/mm/swap_cgroup.c b/mm/swap_cgroup.c > index be39078f255be..1007c30f12e2c 100644 > --- a/mm/swap_cgroup.c > +++ b/mm/swap_cgroup.c > @@ -58,9 +58,11 @@ static unsigned short __swap_cgroup_id_xchg(struct swa= p_cgroup *map, > * entries must not have been charged > * > * @folio: the folio that the swap entry belongs to > + * @id: mem_cgroup ID to be recorded > * @ent: the first swap entry to be recorded > */ > -void swap_cgroup_record(struct folio *folio, swp_entry_t ent) > +void swap_cgroup_record(struct folio *folio, unsigned short id, > + swp_entry_t ent) > { > unsigned int nr_ents =3D folio_nr_pages(folio); > struct swap_cgroup *map; > @@ -72,8 +74,7 @@ void swap_cgroup_record(struct folio *folio, swp_entry_= t ent) > map =3D swap_cgroup_ctrl[swp_type(ent)].map; > > do { > - old =3D __swap_cgroup_id_xchg(map, offset, > - mem_cgroup_id(folio_memcg(fol= io))); > + old =3D __swap_cgroup_id_xchg(map, offset, id); > VM_BUG_ON(old); > } while (++offset !=3D end); > } > -- > 2.20.1 > Good catch, Thanks! Reviewed-by: Kairui Song