From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 35A4539D6D4 for ; Mon, 27 Apr 2026 10:43:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777286634; cv=none; b=Py3TRrlpAF8oUJmZRS4mpj1t9n/BUAE1zvo7m6A6equKnmwwkH8nOxIE/1XZSi5ajjGBGJprmU6kF30v/L76jSTrz2F028vxrIWudh2O+kX8VAIyNh/tR3s0sN4PTH96dWmACtya38LHfIQ1WVHVwjgy+gdS1XoAEHkiWd3CzSI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777286634; c=relaxed/simple; bh=Kh7VcPD0UebwKcjRW9kxX/xxEb3tquDORcfCNx73BBY=; h=Date:From:To:Cc:Subject:Message-Id:In-Reply-To:References: Mime-Version:Content-Type; b=DVri78yI+3mH16dN+k5cKr7pef1iHDvOEInJ6exu9Scnj45oLATIvRliy3gF977A0XsmHdfKOuSpiYqn8qiossUyC2WzaSA6quXqBelXPwn/Omw8HzUFuCftXQoFz92M09NsQGgHfcR0mba9YG+mY7nume2e4TENgaoifEinQcw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=cBxhYKn2; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="cBxhYKn2" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5FAAFC2BCB4; Mon, 27 Apr 2026 10:43:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1777286633; bh=Kh7VcPD0UebwKcjRW9kxX/xxEb3tquDORcfCNx73BBY=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=cBxhYKn24E4Wff8v3kXMyY9v06fkDcfNPYR13C38R/VJGwODif4B3dVKpG80pUgxo GXfocFV0PN11rCXvgqvSsSJYTfaUPVJDqCSecYbITJRuoDlepAjKMo1zuywuCdIObE IftviacLyiYyKDbEl8ibEIa0chNKayx/bs8Ge6qs= Date: Mon, 27 Apr 2026 03:43:52 -0700 From: Andrew Morton To: Qi Zheng Cc: shakeel.butt@linux.dev, syzbot , Liam.Howlett@oracle.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, ljs@kernel.org, surenb@google.com, syzkaller-bugs@googlegroups.com, vbabka@kernel.org, Muchun Song Subject: Re: [syzbot] [mm?] WARNING: bad unlock balance in do_wp_page Message-Id: <20260427034352.6ca48156d613319aac415290@linux-foundation.org> In-Reply-To: <3591c663-a4a9-4c22-97cf-b58b2e7d8a41@linux.dev> References: <69edca15.170a0220.38e3f1.0000.GAE@google.com> <20260426034938.db29d74982a8eb8463f8cf3a@linux-foundation.org> <20260426105532.43768b24a42744f1b52fdff2@linux-foundation.org> <3591c663-a4a9-4c22-97cf-b58b2e7d8a41@linux.dev> X-Mailer: Sylpheed 3.8.0beta1 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Mon, 27 Apr 2026 15:24:10 +0800 Qi Zheng wrote: > > --- a/mm/memcontrol.c > +++ b/mm/memcontrol.c > @@ -805,10 +805,15 @@ static long memcg_state_val_in_pages(int idx, long > val) > * Used in mod_memcg_state() and mod_memcg_lruvec_state() to avoid > race with > * reparenting of non-hierarchical state_locals. > */ > -static inline struct mem_cgroup *get_non_dying_memcg_start(struct > mem_cgroup *memcg) > +static inline struct mem_cgroup *get_non_dying_memcg_start(struct > mem_cgroup *memcg, > + bool *locked) Sometimes this is called "locked", sometimes "rcu_locked". Let's be consistent please. > { > - if (cgroup_subsys_on_dfl(memory_cgrp_subsys)) > + if (cgroup_subsys_on_dfl(memory_cgrp_subsys)) { > + *locked = false; > return memcg; > + } I was thinking we could use a single bit in the task_struct for this: --- a/mm/memcontrol.c~a +++ a/mm/memcontrol.c @@ -810,6 +810,8 @@ static inline struct mem_cgroup *get_non if (cgroup_subsys_on_dfl(memory_cgrp_subsys)) return memcg; + current->foo = 1; + rcu_read_lock(); while (memcg_is_dying(memcg)) @@ -820,9 +822,11 @@ static inline struct mem_cgroup *get_non static inline void get_non_dying_memcg_end(void) { - if (cgroup_subsys_on_dfl(memory_cgrp_subsys)) + if (current->foo == 0) return; + current->foo = 0; + rcu_read_unlock(); } #else _ That doesn't work if get_non_dying_memcg_start/get_non_dying_memcg_end calls can nest? If they can nest then we'd need a counter in the task_struct.