github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-13 21:53:36 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
d885a076d7
linux/mm
History
Bing Jiao d885a076d7 mm/memcontrol: fix reclaim_options leak in try_charge_memcg() 
In try_charge_memcg(), the 'reclaim_options' variable is initialized once
at the start of the function.  However, the function contains a retry
loop.  If reclaim_options were modified during an iteration (e.g., by
encountering a memsw limit), the modified state would persist into
subsequent retries.

This leads to incorrect reclaim behavior.  Specifically,
MEMCG_RECLAIM_MAY_SWAP is cleared when the combined memcg->memsw limit is
reached.  After reclaimation attempts, a subsequent retry may successfully
charge memcg->memsw but fail on the memcg->memory charge.  In this case,
swapping should be permitted, but the carried-over state prevents it.

This issue was identified during code reading of try_charge_memcg() while
analyzing memsw limit behavior in tiered-memory systems; no production
failures have been reported yet.

Fix by moving the initialization of 'reclaim_options' inside the retry
loop, ensuring a clean state for every reclaim attempt.

Link: https://lkml.kernel.org/r/20260321033500.2558070-1-bingjiao@google.com
Fixes: 6539cc0538 ("mm: memcontrol: fold mem_cgroup_do_charge()")
Signed-off-by: Bing Jiao <bingjiao@google.com>
Reviewed-by: Yosry Ahmed <yosry@kernel.org>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Baoquan He <bhe@redhat.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Chris Li <chrisl@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Kairui Song <kasong@tencent.com>
Cc: Kemeng Shi <shikemeng@huaweicloud.com>
Cc: Lorenzo Stoakes (Oracle) <ljs@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: Qi Zheng <zhengqi.arch@bytedance.com>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Wei Xu <weixugc@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-04-05 13:53:36 -07:00
..
damon mm/damon/core: document damos_commit_dests() failure semantics 2026-04-05 13:53:34 -07:00
kasan kasan: fix bug type classification for SW_TAGS mode 2026-04-05 13:53:18 -07:00
kfence kfence: add kfence.fault parameter 2026-04-05 13:53:06 -07:00
kmsan Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
tests
backing-dev.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
balloon.c
bootmem_info.c mm/bootmem_info: avoid using sparse_decode_mem_map() 2026-04-05 13:53:32 -07:00
bpf_memcontrol.c
cma_debug.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
cma_sysfs.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
cma.c mm/cma: move put_page_testzero() out of VM_WARN_ON in cma_release() 2026-03-04 09:44:22 -08:00
cma.h
compaction.c
debug_page_alloc.c
debug_page_ref.c
debug_vm_pgtable.c mm/debug_vm_pgtable: replace WRITE_ONCE() with pxd_clear() 2026-04-05 13:53:11 -07:00
debug.c
dmapool_test.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dmapool.c
early_ioremap.c
execmem.c mm/execmem: make the populate and alloc atomic 2026-04-05 13:53:34 -07:00
fadvise.c mm/fadvise: validate offset in generic_fadvise 2026-04-05 13:52:53 -07:00
fail_page_alloc.c
failslab.c
filemap.c folio_batch: rename pagevec.h to folio_batch.h 2026-04-05 13:53:07 -07:00
folio-compat.c mm: add SPDX id lines to some mm source files 2026-02-06 15:47:16 -08:00
gup_test.c mm: add SPDX id lines to some mm source files 2026-02-06 15:47:16 -08:00
gup_test.h
gup.c folio_batch: rename pagevec.h to folio_batch.h 2026-04-05 13:53:07 -07:00
highmem.c
hmm.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
huge_memory.c mm: introduce is_pmd_order helper 2026-04-05 13:53:29 -07:00
hugetlb_cgroup.c Convert 'alloc_flex' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hugetlb_cma.c
hugetlb_cma.h
hugetlb_internal.h
hugetlb_sysctl.c
hugetlb_sysfs.c
hugetlb_vmemmap.c mm/hugetlb: remove hugetlb_optimize_vmemmap_key static key 2026-04-05 13:53:09 -07:00
hugetlb_vmemmap.h
hugetlb.c mm: move vma_mmu_pagesize() from hugetlb to vma.c 2026-04-05 13:53:23 -07:00
hwpoison-inject.c
init-mm.c
internal.h mm: change to return bool for the MMU notifier's young flag check 2026-04-05 13:53:35 -07:00
interval_tree.c mm/memory: simplify calculation in unmap_mapping_range_tree() 2026-04-05 13:53:13 -07:00
ioremap.c
Kconfig mm: introduce CONFIG_NUMA_MIGRATION and simplify CONFIG_MIGRATION 2026-04-05 13:53:33 -07:00
Kconfig.debug
khugepaged.c mm/khugepaged: unify khugepaged and madv_collapse with collapse_single_pmd() 2026-04-05 13:53:30 -07:00
kmemleak.c mm/kmemleak: use PF_KTHREAD flag to detect kernel threads 2026-04-05 13:53:02 -07:00
ksm.c ksm: initialize the addr only once in rmap_walk_ksm 2026-04-05 13:52:35 -07:00
list_lru.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
maccess.c
madvise.c mm: rename zap_page_range_single() to zap_vma_range() 2026-04-05 13:53:15 -07:00
Makefile mm.git review status for linus..mm-nonmm-stable 2026-02-12 12:13:01 -08:00
mapping_dirty_helpers.c
memblock.c memblock: updates for 7.0-rc1 2026-02-14 12:39:34 -08:00
memcontrol-v1.c memcg: consolidate private id refcount get/put helpers 2026-04-05 13:53:00 -07:00
memcontrol-v1.h memcg: consolidate private id refcount get/put helpers 2026-04-05 13:53:00 -07:00
memcontrol.c mm/memcontrol: fix reclaim_options leak in try_charge_memcg() 2026-04-05 13:53:36 -07:00
memfd_luo.c mm: memfd_luo: preserve file seals 2026-04-05 13:53:00 -07:00
memfd.c memfd: export memfd_{add,get}_seals() 2026-04-05 13:53:00 -07:00
memory_hotplug.c mm/memory_hotplug: simplify check_pfn_span() 2026-04-05 13:53:31 -07:00
memory-failure.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
memory-tiers.c mm: introduce CONFIG_NUMA_MIGRATION and simplify CONFIG_MIGRATION 2026-04-05 13:53:33 -07:00
memory.c mm: introduce is_pmd_order helper 2026-04-05 13:53:29 -07:00
mempolicy.c mm: introduce CONFIG_NUMA_MIGRATION and simplify CONFIG_MIGRATION 2026-04-05 13:53:33 -07:00
mempool.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
memremap.c
memtest.c
migrate_device.c mm/migrate_device: document folio_get requirement before frozen PMD split 2026-04-05 13:53:19 -07:00
migrate.c mm: introduce CONFIG_NUMA_MIGRATION and simplify CONFIG_MIGRATION 2026-04-05 13:53:33 -07:00
mincore.c
mlock.c mm: prevent droppable mappings from being locked 2026-04-05 13:53:25 -07:00
mm_init.c mm: mark early-init static variables with __meminitdata 2026-04-05 13:53:34 -07:00
mm_slot.h
mmap_lock.c
mmap.c mm: abstract reading sysctl_max_map_count, and READ_ONCE() 2026-04-05 13:53:28 -07:00
mmu_gather.c mm/mmu_gather: replace IPI with synchronize_rcu() when batch allocation fails 2026-04-05 13:53:05 -07:00
mmu_notifier.c mm: change to return bool for the MMU notifier's young flag check 2026-04-05 13:53:35 -07:00
mmzone.c
mprotect.c mm/pkeys: remove unused tsk parameter from arch_set_user_pkey_access() 2026-04-05 13:52:57 -07:00
mremap.c mm/khugepaged: rename hpage_collapse_* to collapse_* 2026-04-05 13:53:30 -07:00
mseal.c
msync.c
nommu.c mm: abstract reading sysctl_max_map_count, and READ_ONCE() 2026-04-05 13:53:28 -07:00
numa_emulation.c
numa_memblks.c memblock: numa_memblks: fix detection of NUMA node for CXL windows 2026-02-21 09:58:22 -08:00
numa.c
oom_kill.c mm/oom_kill.c: simpilfy rcu call with guard(rcu) 2026-04-05 13:53:17 -07:00
page_alloc.c mm: introduce is_pmd_order helper 2026-04-05 13:53:29 -07:00
page_counter.c
page_ext.c
page_frag_cache.c
page_idle.c mm/page_idle.c: remove redundant mmu notifier in aging code 2026-04-05 13:53:02 -07:00
page_io.c mm: update outdated comments for removed scan_swap_map_slots() 2026-04-05 13:53:35 -07:00
page_isolation.c
page_owner.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
page_poison.c
page_reporting.c mm/page_reporting: change page_reporting_order to PAGE_REPORTING_ORDER_UNSPECIFIED 2026-04-05 13:53:17 -07:00
page_reporting.h
page_table_check.c
page_vma_mapped.c mm: centralize+fix comments about compound_mapcount() in new sync_with_folio_pmd_zap() 2026-04-05 13:53:03 -07:00
page-writeback.c mm: rename zap_vma_pages() to zap_vma() 2026-04-05 13:53:14 -07:00
pagewalk.c mm/pagewalk: drop FW_MIGRATION 2026-04-05 13:53:10 -07:00
percpu-internal.h
percpu-km.c
percpu-stats.c
percpu-vm.c
percpu.c
pgalloc-track.h
pgtable-generic.c mm: change to return bool for pmdp_clear_flush_young() 2026-04-05 13:53:35 -07:00
process_vm_access.c
ptdump.c
readahead.c mm.git review status for linus..mm-stable 2026-02-12 11:32:37 -08:00
rmap.c mm/mglru: fix cgroup OOM during MGLRU state switching 2026-04-05 13:53:33 -07:00
rodata_test.c
secretmem.c mm: rename VMA flag helpers to be more readable 2026-04-05 13:53:18 -07:00
shmem_quota.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
shmem.c mm: introduce is_pmd_order helper 2026-04-05 13:53:29 -07:00
show_mem.c
shrinker_debug.c
shrinker.c mm: do not allocate shrinker info with cgroup.memory=nokmem 2026-04-05 13:53:05 -07:00
shuffle.c
shuffle.h
slab_common.c Merge branch 'slab/for-7.0/sheaves' into slab/for-next 2026-02-10 09:10:00 +01:00
slab.h mm/slab: use compound_head() in page_slab() 2026-04-05 13:53:10 -07:00
slub.c slab: fix memory leak when refill_sheaf() fails 2026-03-11 17:55:26 +01:00
sparse-vmemmap.c mm: mark early-init static variables with __meminitdata 2026-04-05 13:53:34 -07:00
sparse.c mm/sparse: move memory hotplug bits to sparse-vmemmap.c 2026-04-05 13:53:33 -07:00
swap_cgroup.c
swap_state.c folio_batch: rename PAGEVEC_SIZE to FOLIO_BATCH_SIZE 2026-04-05 13:53:07 -07:00
swap_table.h mm, swap: use the swap table to track the swap count 2026-04-05 13:52:59 -07:00
swap.c folio_batch: rename PAGEVEC_SIZE to FOLIO_BATCH_SIZE 2026-04-05 13:53:07 -07:00
swap.h mm, swap: no need to clear the shadow explicitly 2026-04-05 13:52:59 -07:00
swapfile.c mm/swapfile: remove duplicate include of swap_table.h 2026-04-05 13:53:31 -07:00
truncate.c folio_batch: rename PAGEVEC_SIZE to FOLIO_BATCH_SIZE 2026-04-05 13:53:07 -07:00
usercopy.c
userfaultfd.c mm/userfaultfd: fix hugetlb fault mutex hash calculation 2026-04-05 13:53:29 -07:00
util.c mm: rework compound_head() for power-of-2 sizeof(struct page) 2026-04-05 13:53:08 -07:00
vma_exec.c
vma_init.c
vma_internal.h mm: relocate the page table ceiling and floor definitions 2026-02-12 15:42:53 -08:00
vma.c mm: abstract reading sysctl_max_map_count, and READ_ONCE() 2026-04-05 13:53:28 -07:00
vma.h mm: make vm_area_desc utilise vma_flags_t only 2026-02-12 15:42:59 -08:00
vmalloc.c mm: vmalloc: update outdated comment for renamed vread() 2026-04-05 13:53:34 -07:00
vmpressure.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
vmscan.c mm: update outdated comments for removed scan_swap_map_slots() 2026-04-05 13:53:35 -07:00
vmstat.c mm: vmalloc: streamline vmalloc memory accounting 2026-04-05 13:53:04 -07:00
workingset.c mm/workingset: leave highest bits empty for anon shadow 2026-04-05 13:52:58 -07:00
zpdesc.h
zsmalloc.c mm/zsmalloc: copy KMSAN metadata in zs_page_migrate() 2026-04-05 13:53:34 -07:00
zswap.c mm/zswap: remove SWP_SYNCHRONOUS_IO swapcache bypass workaround 2026-04-05 13:53:02 -07:00