Commit 73f839b6 authored by Muchun Song's avatar Muchun Song Committed by Andrew Morton
Browse files

mm: memcontrol: fix swap counter leak from offline cgroup 

Commit 67691831 removed the parameter of id from swap_cgroup_record()
and get the memcg id from mem_cgroup_id(folio_memcg(folio)).  However, the
caller of it may update a different memcg's counter instead of
folio_memcg(folio).

E.g.  in the caller of mem_cgroup_swapout(), @swap_memcg could be
different with @memcg and update the counter of @swap_memcg, but
swap_cgroup_record() records the wrong memcg's ID.  When it is uncharged
from __mem_cgroup_uncharge_swap(), the swap counter will leak since the
wrong recorded ID.

Fix it by bringing the parameter of id back.

Link: https://lkml.kernel.org/r/20250306023133.44838-1-songmuchun@bytedance.com


Fixes: 67691831 ("mm/swap_cgroup: decouple swap cgroup recording and clearing")
Signed-off-by: default avatarMuchun Song <songmuchun@bytedance.com>
Reviewed-by: default avatarKairui Song <kasong@tencent.com>
Cc: Chris Li <chrisl@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent 8c6ff7f1

include/linux/swap_cgroup.h

+2 −2
Original line number Diff line number Diff line
@@ -6,7 +6,7 @@ 


#if defined(CONFIG_MEMCG) && defined(CONFIG_SWAP)



extern void swap_cgroup_record(struct folio *folio, swp_entry_t ent);

extern void swap_cgroup_record(struct folio *folio, unsigned short id, swp_entry_t ent);

extern unsigned short swap_cgroup_clear(swp_entry_t ent, unsigned int nr_ents);

extern unsigned short lookup_swap_cgroup_id(swp_entry_t ent);

extern int swap_cgroup_swapon(int type, unsigned long max_pages);
@@ -15,7 +15,7 @@ extern void swap_cgroup_swapoff(int type); 
#else



static inline

void swap_cgroup_record(struct folio *folio, swp_entry_t ent)

void swap_cgroup_record(struct folio *folio, unsigned short id, swp_entry_t ent)

{

}

mm/memcontrol.c

+2 −2
Original line number Diff line number Diff line
@@ -4993,7 +4993,7 @@ void mem_cgroup_swapout(struct folio *folio, swp_entry_t entry) 
		mem_cgroup_id_get_many(swap_memcg, nr_entries - 1);

	mod_memcg_state(swap_memcg, MEMCG_SWAP, nr_entries);



	swap_cgroup_record(folio, entry);

	swap_cgroup_record(folio, mem_cgroup_id(swap_memcg), entry);



	folio_unqueue_deferred_split(folio);

	folio->memcg_data = 0;
@@ -5055,7 +5055,7 @@ int __mem_cgroup_try_charge_swap(struct folio *folio, swp_entry_t entry) 
		mem_cgroup_id_get_many(memcg, nr_pages - 1);

	mod_memcg_state(memcg, MEMCG_SWAP, nr_pages);



	swap_cgroup_record(folio, entry);

	swap_cgroup_record(folio, mem_cgroup_id(memcg), entry);



	return 0;

}

mm/swap_cgroup.c

+4 −3
Original line number Diff line number Diff line
@@ -58,9 +58,11 @@ static unsigned short __swap_cgroup_id_xchg(struct swap_cgroup *map, 
 * entries must not have been charged

 *

 * @folio: the folio that the swap entry belongs to

 * @id: mem_cgroup ID to be recorded

 * @ent: the first swap entry to be recorded

 */

void swap_cgroup_record(struct folio *folio, swp_entry_t ent)

void swap_cgroup_record(struct folio *folio, unsigned short id,

			swp_entry_t ent)

{

	unsigned int nr_ents = folio_nr_pages(folio);

	struct swap_cgroup *map;
@@ -72,8 +74,7 @@ void swap_cgroup_record(struct folio *folio, swp_entry_t ent) 
	map = swap_cgroup_ctrl[swp_type(ent)].map;



	do {

		old = __swap_cgroup_id_xchg(map, offset,

					    mem_cgroup_id(folio_memcg(folio)));

		old = __swap_cgroup_id_xchg(map, offset, id);

		VM_BUG_ON(old);

	} while (++offset != end);

}