From 075d5837bafc317e796548f721b8fbf7add6821d Mon Sep 17 00:00:00 2001 From: Chris Mason Date: Mon, 19 Oct 2026 16:57:42 +0000 Subject: [PATCH] io_uring/rsrc: charge buffer arrays and nodes to memcg The io_mapped_ubuf of a registered buffer has one bio_vec per page, unless the pages coalesce into huge pages. Huge pages only count against RLIMIT_MEMLOCK once per ring, so a buffer that maps the same 2MB folio over and over in a way that defeats coalescing gets a full bvec array per registration while only the one folio counts as locked. 1GB of that registered in 100 slots took several times a 64MB memory.max, with 2.6MB charged. Allocate the io_mapped_ubuf and the io_rsrc_node with GFP_KERNEL_ACCOUNT. An object reused from the ring caches stays charged to whoever allocated it first, same as the io_kiocb cache. Fixes: de2939388be5 ("io_uring: improve registered buffer accounting for huge pages") Signed-off-by: Chris Mason Signed-off-by: Jens Axboe --- io_uring/rsrc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c index 1efaf29514e8..d569cea12df9 100644 --- a/io_uring/rsrc.c +++ b/io_uring/rsrc.c @@ -162,8 +162,9 @@ static struct io_mapped_ubuf *io_alloc_imu(struct io_ring_ctx *ctx, int nr_bvecs) { if (nr_bvecs <= IO_CACHED_BVECS_SEGS) - return io_cache_alloc(&ctx->imu_cache, GFP_KERNEL); - return kvmalloc_flex(struct io_mapped_ubuf, bvec, nr_bvecs); + return io_cache_alloc(&ctx->imu_cache, GFP_KERNEL_ACCOUNT); + return kvmalloc_flex(struct io_mapped_ubuf, bvec, nr_bvecs, + GFP_KERNEL_ACCOUNT); } static void io_free_imu(struct io_ring_ctx *ctx, struct io_mapped_ubuf *imu) @@ -246,7 +247,7 @@ struct io_rsrc_node *io_rsrc_node_alloc(struct io_ring_ctx *ctx, int type) { struct io_rsrc_node *node; - node = io_cache_alloc(&ctx->node_cache, GFP_KERNEL); + node = io_cache_alloc(&ctx->node_cache, GFP_KERNEL_ACCOUNT); if (node) { node->type = type; node->refs = 1;