From: bot+bpf-ci@kernel.org
To: hui.zhu@linux.dev, akpm@linux-foundation.org, hannes@cmpxchg.org,
mhocko@kernel.org, roman.gushchin@linux.dev,
shakeel.butt@linux.dev, muchun.song@linux.dev, ast@kernel.org,
daniel@iogearbox.net, andrii@kernel.org, martin.lau@linux.dev,
eddyz87@gmail.com, song@kernel.org, yonghong.song@linux.dev,
john.fastabend@gmail.com, kpsingh@kernel.org, sdf@fomichev.me,
haoluo@google.com, jolsa@kernel.org, shuah@kernel.org,
peterz@infradead.org, ojeda@kernel.org, nathan@kernel.org,
kees@kernel.org, tj@kernel.org, jeffxu@chromium.org,
mkoutny@suse.com, kernel@jfarr.cc, brauner@kernel.org,
rdunlap@infradead.org, brgerst@gmail.com, masahiroy@kernel.org,
davem@davemloft.net, kuba@kernel.org, hawk@kernel.org,
inwardvessel@gmail.com, willemb@google.com,
kerneljasonxing@gmail.com, paul.chaignon@gmail.com,
a.s.protopopov@gmail.com, ameryhung@gmail.com,
chenridong@huaweicloud.com, lance.yang@linux.dev,
jiayuan.chen@linux.dev, linux-kernel@vger.kernel.org,
linux-mm@kvack.org, cgroups@vger.kernel.org, bpf@vger.kernel.org,
netdev@vger.kernel.org, linu@kvack.org,
x-kselftest@vger.kernel.org
Cc: zhuhui@kylinos.cn,geliang@kernel.org,ast@kernel.org,andrii@kernel.org,daniel@iogearbox.net,martin.lau@kernel.org,eddyz87@gmail.com,yonghong.song@linux.dev,clm@meta.com,ihor.solodrai@linux.dev
Subject: Re: [RFC PATCH bpf-next v3 10/12] mm/bpf: Add BPF_F_ALLOW_OVERRIDE support for memcg_bpf_ops
Date: Fri, 23 Jan 2026 09:29:42 +0000 (UTC) [thread overview]
Message-ID: <d2161f4252546f252dd0a84c461ba5dbb3b63e22d4826771edd8f1f30df050bc@mail.kernel.org> (raw)
In-Reply-To: <9f072e53f79ceaea43e3730476494517e453530a.1769157382.git.zhuhui@kylinos.cn>
[-- Attachment #1: Type: text/plain, Size: 2397 bytes --]
> diff --git a/mm/bpf_memcontrol.c b/mm/bpf_memcontrol.c
> index 415e3c59b6a6..0ded1fdd0de8 100644
> --- a/mm/bpf_memcontrol.c
> +++ b/mm/bpf_memcontrol.c
[ ... ]
> static int bpf_memcg_ops_reg(void *kdata, struct bpf_link *link)
> {
> struct bpf_struct_ops_link *ops_link
> = container_of(link, struct bpf_struct_ops_link, link);
> struct memcg_bpf_ops *ops = kdata;
> struct mem_cgroup *memcg, *iter = NULL;
> int err = 0;
>
> + if (ops_link->flags & ~BPF_F_ALLOW_OVERRIDE) {
> + pr_err("attach only support BPF_F_ALLOW_OVERRIDE\n");
> + return -EOPNOTSUPP;
> + }
> +
> memcg = mem_cgroup_get_from_ino(ops_link->cgroup_id);
> if (IS_ERR_OR_NULL(memcg))
> return PTR_ERR(memcg);
>
> cgroup_lock();
> +
> + if (READ_ONCE(memcg->bpf_ops)) {
> + /* Check if bpf_ops of the parent is BPF_F_ALLOW_OVERRIDE. */
> + if (memcg->bpf_ops_flags & BPF_F_ALLOW_OVERRIDE) {
> + iter = parent_mem_cgroup(memcg);
> +
> + if (!iter)
> + goto busy_out;
> + if (READ_ONCE(iter->bpf_ops) !=
> + READ_ONCE(memcg->bpf_ops))
> + goto busy_out;
> + } else {
> +busy_out:
> + err = -EBUSY;
> + goto unlock_out;
> + }
> + }
> +
> while ((iter = mem_cgroup_iter(memcg, iter, NULL))) {
^^^^
When the override check passes (all conditions at lines 363-377 are met),
iter is set to parent_mem_cgroup(memcg) but is never reset to NULL before
this loop. Should iter be reset to NULL here?
The mem_cgroup_iter() function expects prev (iter) to be either NULL or a
previous result from iterating within memcg's descendants. When iter points
to memcg's parent, the iteration will not correctly traverse memcg's
subtree since parent is outside that subtree.
For comparison, bpf_memcg_ops_unreg() correctly resets iter to NULL before
its loop:
> + iter = NULL;
> + while ((iter = mem_cgroup_iter(memcg, iter, NULL))) {
> if (READ_ONCE(iter->bpf_ops)) {
> - mem_cgroup_iter_break(memcg, iter);
> - err = -EBUSY;
> - break;
> + /* cannot override existing bpf_ops of sub-cgroup. */
> + continue;
> }
> WRITE_ONCE(iter->bpf_ops, ops);
> + iter->bpf_ops_flags = ops_link->flags;
> }
[ ... ]
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/21280790825
next prev parent reply other threads:[~2026-01-23 9:29 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-23 8:55 [RFC PATCH bpf-next v3 00/12] mm: memcontrol: Add BPF hooks for memory controller Hui Zhu
2026-01-23 8:55 ` [RFC PATCH bpf-next v3 01/12] bpf: move bpf_struct_ops_link into bpf.h Hui Zhu
2026-01-23 8:55 ` [RFC PATCH bpf-next v3 02/12] bpf: initial support for attaching struct ops to cgroups Hui Zhu
2026-01-23 9:19 ` bot+bpf-ci
2026-01-23 8:55 ` [RFC PATCH bpf-next v3 03/12] bpf: mark struct oom_control's memcg field as TRUSTED_OR_NULL Hui Zhu
2026-01-23 8:57 ` [RFC PATCH bpf-next v3 04/12] mm: define mem_cgroup_get_from_ino() outside of CONFIG_SHRINKER_DEBUG Hui Zhu
2026-01-23 8:57 ` [RFC PATCH bpf-next v3 05/12] libbpf: introduce bpf_map__attach_struct_ops_opts() Hui Zhu
2026-01-23 9:19 ` bot+bpf-ci
2026-01-23 8:58 ` [RFC PATCH bpf-next v3 06/12] bpf: Pass flags in bpf_link_create for struct_ops Hui Zhu
2026-01-23 8:58 ` [RFC PATCH bpf-next v3 07/12] libbpf: Support passing user-defined flags " Hui Zhu
2026-01-23 9:00 ` [RFC PATCH bpf-next v3 08/12] mm: memcontrol: Add BPF struct_ops for memory controller Hui Zhu
2026-01-23 9:29 ` bot+bpf-ci
2026-01-23 9:00 ` [RFC PATCH bpf-next v3 09/12] selftests/bpf: Add tests for memcg_bpf_ops Hui Zhu
2026-01-23 9:19 ` bot+bpf-ci
2026-01-23 20:47 ` JP Kobryn
2026-01-26 1:40 ` hui.zhu
2026-01-23 9:00 ` [RFC PATCH bpf-next v3 10/12] mm/bpf: Add BPF_F_ALLOW_OVERRIDE support " Hui Zhu
2026-01-23 9:29 ` bot+bpf-ci [this message]
2026-01-23 9:01 ` [RFC PATCH bpf-next v3 11/12] selftests/bpf: Add test for memcg_bpf_ops hierarchies Hui Zhu
2026-01-23 9:18 ` bot+bpf-ci
2026-01-23 9:01 ` [RFC PATCH bpf-next v3 12/12] samples/bpf: Add memcg priority control example Hui Zhu
2026-01-23 9:18 ` bot+bpf-ci
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d2161f4252546f252dd0a84c461ba5dbb3b63e22d4826771edd8f1f30df050bc@mail.kernel.org \
--to=bot+bpf-ci@kernel.org \
--cc=a.s.protopopov@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=ameryhung@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=brauner@kernel.org \
--cc=brgerst@gmail.com \
--cc=cgroups@vger.kernel.org \
--cc=chenridong@huaweicloud.com \
--cc=clm@meta.com \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=eddyz87@gmail.com \
--cc=geliang@kernel.org \
--cc=hannes@cmpxchg.org \
--cc=haoluo@google.com \
--cc=hawk@kernel.org \
--cc=hui.zhu@linux.dev \
--cc=ihor.solodrai@linux.dev \
--cc=inwardvessel@gmail.com \
--cc=jeffxu@chromium.org \
--cc=jiayuan.chen@linux.dev \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kees@kernel.org \
--cc=kernel@jfarr.cc \
--cc=kerneljasonxing@gmail.com \
--cc=kpsingh@kernel.org \
--cc=kuba@kernel.org \
--cc=lance.yang@linux.dev \
--cc=linu@kvack.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=martin.lau@kernel.org \
--cc=martin.lau@linux.dev \
--cc=masahiroy@kernel.org \
--cc=mhocko@kernel.org \
--cc=mkoutny@suse.com \
--cc=muchun.song@linux.dev \
--cc=nathan@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=ojeda@kernel.org \
--cc=paul.chaignon@gmail.com \
--cc=peterz@infradead.org \
--cc=rdunlap@infradead.org \
--cc=roman.gushchin@linux.dev \
--cc=sdf@fomichev.me \
--cc=shakeel.butt@linux.dev \
--cc=shuah@kernel.org \
--cc=song@kernel.org \
--cc=tj@kernel.org \
--cc=willemb@google.com \
--cc=x-kselftest@vger.kernel.org \
--cc=yonghong.song@linux.dev \
--cc=zhuhui@kylinos.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox