From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from CH1PR05CU001.outbound.protection.outlook.com (mail-northcentralusazon11010056.outbound.protection.outlook.com [52.101.193.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8C184533D6 for ; Thu, 2 Jul 2026 02:02:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.193.56 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782957740; cv=fail; b=q2XLeKmBXydy0093rEV/+Vt/G9QSdWV8JEYQcXwPVBRedwi/T5+uXD3jLFkxAxaXWK0epv/NO/r5qLEtOxKRQWspWsAPPruoTIinxP/tN8HrjsLbrjAwas9lCBGLQ46zbAzbPvllveaGbI4INvP74S5MGhD5BrM8h/2escT/jwo= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782957740; c=relaxed/simple; bh=NB/q8+7dyoYfyNRnmtT+VTXEPHeDaWrl7l5V2apyifQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=o5eNFLuRTIdI2ZluDH62QZXNhf8rUQ/j4//cvdUanaZMFtBvVNcug3UZIKIBUzysKmWRJeETsQHefDHaBzY4HccObDnFOl2fpnUF/RAXT6M8V1iDqaxukN5wuLE4ULC7cYYzhDVts+9GTPbG3Zk93fo68KZ/Ez2xlxzVnVu0840= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=O/kpIOrE; arc=fail smtp.client-ip=52.101.193.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="O/kpIOrE" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=X6sH6lHxgSwYi5mgH3j1prhBGeNMQZW3JxEwlRuLn5aB5IDx78iDSBGaDIdgHKFpNBDyzrOCaEr0rUzen7ByTSs0lNKXfCbJY7yYOeOUCAwdPvaD4bshnxhN8hOfSprUEkf1rC8pN+nCa08DbGL99+XeDhFGdcuRElCZ7HrW2QytuHHhQo+/OvYBHzAGCBY2Rx2R9KApDvSB5nNrt5m2OyOxfj0HX/F8izHl1gqqKrhLCg41s7e9KdbRWX1b4E1Ail5TbMW2TTu07TgpucBO/4bf4eO644YE68v6aXpk0g7cABIWcWK/FRqmqz+d5bRloSP7waHDcmmsO3asPyuaEA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Qb0cYiet7xpuGUYnpzdKUwzBzTRt0hgCt/DWG+JNSJM=; b=bYVw8+KkWsGbSPvWe03FZSrQPDAuy6sgP5aD/5RKMjL2XpeRvY5bpW6irJfOaPyZf4KczKLDL15OiIEc9R1QmCGox/nfmCUQiRNYM0uQB1oZAzDFKvVS+5CSlqsq27EMZXRJifjkXz34DHLZW2G92MBaF8QeZbc6opqKKxLOVwMwSA1yEC9aXIV/G3q81AL1wm0Ge/b0aRP+lpaXzy8Mi7Xe4MkigdC9tk3FHGtJ/QRPyQsuW9cVR5ilo0QHepu9xobiFmdSlkZsCmjJOuFgPp3i4zDNQ2sk68WSoesYi3S6ZytSAlhxpr+Y2iAdn3FyXNUB+Q1G3NKfQvPIS2jICA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nvidia.com; dmarc=pass action=none header.from=nvidia.com; dkim=pass header.d=nvidia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Qb0cYiet7xpuGUYnpzdKUwzBzTRt0hgCt/DWG+JNSJM=; b=O/kpIOrE+PEBhkHZhS6NlzhtM5EDifNOao4gyWWUnlrGwcond/zgULaXcuZvJ82icRavYr+pzJjgtplVA7fTGo2Es74NrfZlRw+tdY/csHN6eo2vBlIGKPjr6Vcn0518hi9WD9TVJv/4FsaWGebxrR2MtGtWWM5ibBaQFAxAz8WXAeHfhTIx9J81NG8j7suMLHh4RjVSuVxOaEB7y56TgcFHRWW/WV+UBZG0vGU1P2r2FOOQQDnjHsq/z3WD17dFPwqDaF/6RD39InDus2obEkOqMlwnx+DweEfX9Iof3L+8yqbILyyC3OmGCD7I5wML1yDIjqHqVux9iRrFUkSVuw== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=nvidia.com; Received: from IA0PR12MB8374.namprd12.prod.outlook.com (2603:10b6:208:40e::7) by BL4PR12MB9533.namprd12.prod.outlook.com (2603:10b6:208:58f::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.10; Thu, 2 Jul 2026 02:02:15 +0000 Received: from IA0PR12MB8374.namprd12.prod.outlook.com ([fe80::d85f:4c87:ae84:3f16]) by IA0PR12MB8374.namprd12.prod.outlook.com ([fe80::d85f:4c87:ae84:3f16%5]) with mapi id 15.21.0181.008; Thu, 2 Jul 2026 02:02:15 +0000 From: Zi Yan To: Ye Liu Cc: Andrew Morton , Vlastimil Babka , Suren Baghdasaryan , Michal Hocko , Brendan Jackman , Johannes Weiner , linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v5 9/9] mm/page_owner: use memcg_data snapshot instead of PageMemcgKmem() to avoid TOCTOU VM_BUG_ON Date: Wed, 01 Jul 2026 22:02:13 -0400 X-Mailer: MailMate (2.0r6290) Message-ID: <0E890CCC-818A-47DE-9D1C-9EEF98CC758D@nvidia.com> In-Reply-To: <20260701061101.344679-10-ye.liu@linux.dev> References: <20260701061101.344679-1-ye.liu@linux.dev> <20260701061101.344679-10-ye.liu@linux.dev> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-ClientProxiedBy: BL1PR13CA0230.namprd13.prod.outlook.com (2603:10b6:208:2bf::25) To IA0PR12MB8374.namprd12.prod.outlook.com (2603:10b6:208:40e::7) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: IA0PR12MB8374:EE_|BL4PR12MB9533:EE_ X-MS-Office365-Filtering-Correlation-Id: 0c86afd2-bcb8-4dac-f490-08ded7ddeff5 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|376014|1800799024|366016|56012099006|11063799006|4143699003|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: L54Ow1ViCKjUeLENqwEZkwltXkMUe26a4SO5gSAATiEoOhg1B6wqODWa6fBQB48d1DI0bzdMYd5aPL+t3VZmqMBkxsVodo548zV1rPXlhnQ2LRpv2I0y8Czwqq6ixALq6wcB2LPIp0zrE7hCEhrKVZGqnM8x+EVeoxarpBxW+G4iIVFAIVIqav2fgCFhXk8TccdAVGWrfs5IHT+DXwY6n1aiuiVOoTjQe5zjsPM+NbOkoRaS3pOHw8ZDkpiO7+uzizp2os8YgVPS9IeWtqLUYkDTFqAeoEEShFMe2Pil5OIsAodedikPZAIKqIIrXBaFGUSKBJb8bSTJaY6ErGdAzGHumAINR3Fduc4a+9WmuErRUZ5zsXBhQQv7HOf04rDiRjMkv8oCc4zlmhFXlAo9PxpYAhl97dDzBaUV8Fz429Wc14hQCmGy7n64GrS83iGQZzzF6JLggDqh6JSAppZ0Xx1rdgTPIbVw7FqUInNc2DN4vDPErEzU2AU3P2iDtc/gfPUQchctkNzhM01rBvq0+naPoiWKn1Te5AmfMms956iamZ80TzIrtyV20Y8MKOsiqEvQKVJ+YL2gzOTEN0g2wZu40IaojCU+xgKw5IYGEovr7K3haN850+TBz6J6dMAFYp8GxzBpNRBOgKZtpkbD1I7gtwqwyd3tBcELSLxBlSs= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:IA0PR12MB8374.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(376014)(1800799024)(366016)(56012099006)(11063799006)(4143699003)(22082099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?aTdTS0NjZUdFNi9rR1UwZmRPMjJFYVY4b2lNV1B0UE11U3FscVRKY01LZ2sx?= =?utf-8?B?NVhDYzRqQnNnemp3TEhHdHcwLzByeG9USzhscXVmd0FWUjhmUGwxVmcyZzBD?= =?utf-8?B?MGxpNWZBUC9jNkNwUlRZckNLTlg0QTI2ZytVUnEyVTNwSFZQOW5mS0NFSFl5?= =?utf-8?B?NzdxcHZvOFd2ZXMwOHBuVTJJYVdZV0dSNDE5NWlkWEQyNGhrMDdadnAvY3VF?= =?utf-8?B?WW1SeUVrdW5EUlc4Y1RKcWdoZHYwbHlsbEE4R1JTbWQ3Vlcwd1pENUFhdEQ0?= =?utf-8?B?a1lkQjRlSFlsSjNTN3ZPaVlEV3Z1dElaM1B6akFjclhBSWVCS3ZyU2dxS1R5?= =?utf-8?B?Z1BLdVpRT21yaVRLdVhYZFBlaW5hVWE1dW95SU9BQmRscGZXWUN5eHJBR2s3?= =?utf-8?B?WXpHd3JER3ZtNlZKNlZaNzJleWxIQXB2U0ZodittSTVHU3NFL1BmdGRjVmJQ?= =?utf-8?B?YlFxUXhjMm5PdjBqNXhqR1V2dWNOSytkS1o1VWZOVDFyWUtyZTNEaVdScnBO?= =?utf-8?B?Z1NySXBEOXFLbHoxMDJXRHU0SkRCTW1ETmtlWHpQdDRUVk90QzdSNW5ZZUs0?= =?utf-8?B?QzVqMC8zMWRQcmorcVF1QjNaMUEvUit2eGJJSzJZRXFNb2g1cHl5NGRTU3B6?= =?utf-8?B?QzA0cWN4blFxU1FUclUzOTR5b3VTMENhRmVHdGNmYVFwWkwxODZaQ3ZFTlBE?= =?utf-8?B?K0lHc2RuMEdvRDJuaGV5aDBOekpLbWtjUTJPeXVMT1QxaVJvemNhZCtkM2I0?= =?utf-8?B?OXRkWHpZa1EvR3k2QTZucnQyMWhxeDZ1cDl3TnlhWDNET3hKM0RCNmVXZkpy?= =?utf-8?B?MzBoUU1zU3k4b09qczRraFZzZEpNL1FFdGVvUkxYRksxY21KTElkanIyUXgz?= =?utf-8?B?M012b1pJamZjK1gwYlRxSi9ER0pzbzV4dHRlbk1LbmZIOFFuWEM0Qmcva1Na?= =?utf-8?B?OG9KWk5pazlmT0dNOHRyWjVxTkduMmtJNHRENDFyRGxPSkEyVTFWSVNzVlIv?= =?utf-8?B?dE5mRVVTMm9TQ3FwT1JKZUlNcW1rQTh1VEhJLzROWlJkWEFHTVd3VW4zSEc5?= =?utf-8?B?Si9nazR4U2dCOXlYRG5GQ2FhMzNpZlNqbEd6dVZGQWJyL2F6VDg0YnVEeXlk?= =?utf-8?B?WTQwT3VqS3JrTXFpWlpZZjVrckZqSFRISkdhV1lGQXlpRWloNXRYM0IwK0Fo?= =?utf-8?B?M1VrQ2JHYWVCaGJsbHhyREpTeUxCL3JMTlZVOUxXWFd0UHBjS0VOVGhRdUVZ?= =?utf-8?B?VEhLNWw3M1VIaUdoam9WNnFRYW9kZmlGMFRGWjFDTHZjMDhrdHZNUktjc0VP?= =?utf-8?B?bVN3T1kwdjNIb28rMi9SRGtwbTNQNHVTemNKNVh3dGRKUldFQjRnZ1F6TGgx?= =?utf-8?B?OFI5SXpXOHBLSllMaDQ3TjFqM2NBTWRHRnYvREU5cEZtNExOSDY4ZTYxRDB1?= =?utf-8?B?U0ZYWlRZZ2YxUWJrQkhiRkYvckNML290V3hsbE5EWnhDS3FCS216OVJhWGtt?= =?utf-8?B?UDBvZHpTb1dIbmJGdW1FREI2Q0Nlb3kvdks0clBUOFFxQ1dvUWtzbFdzdCtG?= =?utf-8?B?bkdYZ3FEVk5EZG5ncEtvUFlEQkV2eGpOOTR4b1BzQTl2b05rU1EvTG5xN0tj?= =?utf-8?B?WEVVeDkrd1d1eTNvK29ZT0V2V0EzNEhvNzdIb0RsTUZSdm1tbXZyaUhqTXZ0?= =?utf-8?B?UDd4RHNleUlGWDllRkVUeGkza3dneWJWWnBnL1VwR2NURFRPMU1ERzIrS1NV?= =?utf-8?B?TUNZL2VlR1dQQlovQ1BCNG42UEt6ZUx3c1lwajJYOFJoU1RsLzBmaUUyMkRu?= =?utf-8?B?R2liRytEa2R0Y0VVTkxRVmFMdFNRanA1eEE1VVVTaVdyODJHWXlQb1pVRE8z?= =?utf-8?B?V0xURW1tTHpzUFVSMnAvSldmTmh6NmJlYmU3dk5vUGZHTjZDMjlGY2FkN0ky?= =?utf-8?B?R2ZITys4NzI1VWozOCt3WGV0Ylhmb3o3VG02VFNFM1JyZXBUSFE4YlJlOE9r?= =?utf-8?B?M2puV054M2piUzJOMjB3bXZKNlV0eEFxbVo3SHBGTlQ5QzNKMU5EUDh4KzRu?= =?utf-8?B?MUVKc3FtQzVUUUdDWlpJZHF3cXlKMnBUQVhsWllMQ0JVN05WZ0F4bGFiektJ?= =?utf-8?B?OXRIc3B6TW44aEhyMDhlendjRno5akZUSDljNkJJeDBNK21EemNDOHc4Z05w?= =?utf-8?B?azhHckt3ajR0eCsxZWtLMDh5USt0S0JiUHJqZTNubDdFVG96eU5UTU5ZdTM3?= =?utf-8?B?M1NDMld2bTdYZFYvUUFYMGN6OUlLNS9iNmovdHQrY2JnRHZnZTFKU1QwQkds?= =?utf-8?B?bExHUmlZakZrcUhMZ2llVWloeWFtemw1ZzhmbUFxcHJqK2hER0FyUT09?= X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0c86afd2-bcb8-4dac-f490-08ded7ddeff5 X-MS-Exchange-CrossTenant-AuthSource: IA0PR12MB8374.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Jul 2026 02:02:14.8404 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: iFA+0Yp7oQQNh5gyQBo4IiumdEUT+2SvEA2PrFXlTTNU6tUe2yKf1weCngslNqA7 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL4PR12MB9533 On 1 Jul 2026, at 2:10, Ye Liu wrote: > print_page_owner_memcg() takes a snapshot of page->memcg_data via > READ_ONCE at the top of the function and guards against tail pages > and NULL memcg_data. However, at the end it calls PageMemcgKmem(page) > which internally calls folio_memcg_kmem() — and that function re-reads > folio->memcg_data and page->compound_head locklessly, wrapping both > in VM_BUG_ON assertions: > > VM_BUG_ON_PGFLAGS(PageTail(&folio->page), &folio->page); > VM_BUG_ON_FOLIO(folio->memcg_data & MEMCG_DATA_OBJEXTS, folio); > > If the page is concurrently freed and reallocated as a THP tail page > or a slab page between the initial guards and this final call, the > VM_BUG_ON assertions can fire on debug builds (CONFIG_DEBUG_VM=y), > causing a kernel panic. > > Fix by reusing the memcg_data snapshot already taken at function entry > instead of calling PageMemcgKmem(), which is semantically equivalent: > PageMemcgKmem()->folio_memcg_kmem()->folio->memcg_data & MEMCG_DATA_KMEM. > This avoids both the TOCTOU window and the assertions entirely. > > Signed-off-by: Ye Liu > --- > mm/page_owner.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > LGTM. Reviewed-by: Zi Yan Best Regards, Yan, Zi