From e387ebe5cd31720b1e0281fd045be4eef36fadb3 Mon Sep 17 00:00:00 2001 From: Weilin Tong Date: Wed, 14 Oct 2026 16:22:18 +0800 Subject: [PATCH] ipc/shm: fix RSS accounting for hugetlb shared memory Commit a08c7193e4f1 ("mm/filemap: remove hugetlb special casing in filemap.c") changed mapping->nrpages to count base pages for hugetlb folios. However, shm_add_rss_swap() still multiplies it by pages_per_huge_page(), overcounting RSS in both SHM_INFO and /proc/sysvipc/shm. Use mapping->nrpages for RSS accounting across all backing types, and account swap only for non-hugetlb shmem. Use READ_ONCE() for both counters instead of info->lock, which does not protect nrpages and cannot provide a consistent snapshot. Link: https://lore.kernel.org/20261014082218.2236088-1-tongweilin@linux.alibaba.com Fixes: a08c7193e4f1 ("mm/filemap: remove hugetlb special casing in filemap.c") Signed-off-by: Weilin Tong Signed-off-by: Andrew Morton Suggested-by: Muchun Song Acked-by: Muchun Song Cc: Oscar Salvador Cc: David Hildenbrand Cc: Sidhartha Kumar Cc: Lorenzo Stoakes Cc: Dan Carpenter Cc: Baolin Wang Cc: --- ipc/shm.c | 23 ++++------------------- 1 file changed, 4 insertions(+), 19 deletions(-) diff --git a/ipc/shm.c b/ipc/shm.c index bb1a721a3e74..6862f681373f 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -936,26 +936,11 @@ static inline unsigned long copy_shminfo_to_user(void __user *buf, struct shminf static void shm_add_rss_swap(struct shmid_kernel *shp, unsigned long *rss_add, unsigned long *swp_add) { - struct inode *inode; + struct inode *inode = file_inode(shp->shm_file); - inode = file_inode(shp->shm_file); - - if (is_file_hugepages(shp->shm_file)) { - struct address_space *mapping = inode->i_mapping; - struct hstate *h = hstate_file(shp->shm_file); - *rss_add += pages_per_huge_page(h) * mapping->nrpages; - } else { -#ifdef CONFIG_SHMEM - struct shmem_inode_info *info = SHMEM_I(inode); - - spin_lock_irq(&info->lock); - *rss_add += inode->i_mapping->nrpages; - *swp_add += info->swapped; - spin_unlock_irq(&info->lock); -#else - *rss_add += inode->i_mapping->nrpages; -#endif - } + *rss_add += READ_ONCE(inode->i_mapping->nrpages); + if (IS_ENABLED(CONFIG_SHMEM) && !is_file_hugepages(shp->shm_file)) + *swp_add += READ_ONCE(SHMEM_I(inode)->swapped); } /*