From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f46.google.com (mail-wr1-f46.google.com [209.85.221.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BFE023EB815 for ; Fri, 17 Jul 2026 10:52:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784285581; cv=none; b=TMUBF+yCbiuL8hOg4nuSdB51IuyGHEqk5I/Vl2kpLVm0XV8sKPf6gMT/KHyUugo/rZVqqcZWr4hMHjkkJ+NDysH2JdxjQZKGcCr9p6t07jP0FTqagCtJ6Y+7yQNH1F6u6quUy+0uPPYdbDFTnwz9rfQy8axXgsACj9Rffg/saqE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784285581; c=relaxed/simple; bh=dcBQSrYE16ORzLsvX+G93dPmiXECgcXvhDGMJ204jyM=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=lrIzOBlZXyqGMaql4y0yoLh6/4v4unIENyQ8S36SZLw+wOxqNiifVpjtL9Vp8s0szi3U+mUgXF8SksaS+CT5UWAueenRKUqTJjV70n/Xc8V0qQNFUptPJZrcLcOiikwh1iwZroWbXhC+LZakDYKZxxr1rd1G4OvMQnscoCP2hOo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cmpxchg.org; spf=pass smtp.mailfrom=cmpxchg.org; dkim=pass (2048-bit key) header.d=cmpxchg.org header.i=@cmpxchg.org header.b=ANaT5PU+; arc=none smtp.client-ip=209.85.221.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cmpxchg.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cmpxchg.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cmpxchg.org header.i=@cmpxchg.org header.b="ANaT5PU+" Received: by mail-wr1-f46.google.com with SMTP id ffacd0b85a97d-4720d22c94aso4760952f8f.1 for ; Fri, 17 Jul 2026 03:52:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cmpxchg.org; s=google; t=1784285574; x=1784890374; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=1MCALYfAZM5Wgl4MTnbWAugypRriUQ0nj40l25fPONA=; b=ANaT5PU+CtT/GOw4zC+VrGO6/++Qt8ixyIzHiHS1SnD41EryRyllzssKpJ7zIZPvXr J4kn4LU0AoT7CAx4E/xwHhP4T36fQS9wUIlN+4CSQJ328nNQ5OEQXQQ24Fk54i3VH/C0 v40Rtw8iVLGsfUyAAr5OnB8+lRNWpQeeO5Ee5N0WhLbl2BKz5T9ZpLPqjAoyL+jnaDJg Y+2+XhWogJPB2XaJLNbl24rw6k/e+6f3u0dbhC0Q3Nt017DwTSJbWrpwSL9XmP/pgjR2 ljZ+vaS5JMIs5/FyvJcsLsl/D4HUo25Ch9wjURUxrDdDbjZiZYthOwwuQL8bSd/AbUFJ WIGQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784285574; x=1784890374; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=1MCALYfAZM5Wgl4MTnbWAugypRriUQ0nj40l25fPONA=; b=lLr7yggqaJ9rOXc1yS1iyVyUWv/NhqRFYYMVC0PiYrDDfHwRWQBgeqs/D/Y2iBX84/ vm9T+YTNJemFEWuOqLCxo8q5HMECeiQihJ+FpbRHCsFFsokWLTNvbU5XPTnf2mUjz7Uu FRU05tRza7M45tMYliHvOU8IS95EDAOtZEC5iQ5Wde9+DOmhCc+GnTdvQndWkoOx4Rjd xdHGyHmswKCQvAP2qM1VeIhTDmCs7iOiII1a01Q+a+SqE8TfPqAAnJzAmUl7HDwP6n1a j4KoGctaoj7bEY3YY1u/YtaDV+ffeT+zlOsUEZnvdDBOqFDb3ICJVidV7sQdc+6SqvFY pBdA== X-Forwarded-Encrypted: i=1; AHgh+RolLse7E/p+t+tkG/sEuqip2Oli0fQMK57LhFuHtpjth89cFR0z5wQTY26nmw7wY/nxTHNFbjq/ouqltTA=@vger.kernel.org X-Gm-Message-State: AOJu0YycufNeFe/Llssd6x9dfqwQgcxzCL9vsfRzgJo0YjeEsUKP80SL GBuZA2QRgIVwU7yjW/+DmAkZzEe63MAlOJtXYdt4oo7PMDnvGjDMHG9c0tK5fRcCals= X-Gm-Gg: AfdE7cnIoQijRir0BPe9naoT8U3BsjSC6x6kYBtxy+a3a7q+yNmV88nQAXIrInUnfMQ 27Pk0iKK8S92yKOOt7o1Tz0Sj7G/xIeP8VgVUaJsLhTXJNrjPCEWMB7+DR6jdjZQXVU3RjMYFfG qZO5eSdJS94f/1kD4223CMHivud98KyDjUlyEouTU5fNP52vA4mRyL9CMuT5eRQ2ZLwuJH4JGxC ffpDHnNdH+zmVGFljHZMORebdqv67c6ugxbQU1CiEFFFRPpo8dqNxMp5AQwp5MXBFuL0LF1Q2uf lNeAY1yrOKXVOcKXKuFd9+cJQJ8SaU7YeEX+LKEaeOfgs7UL4KUbrChrJVht+HMKQu5rIBpng27 aePyZlYLQ66EmOrR0ceYg5UXQ1ziUSvD7wjsgkdrv9GP11YPTRWrHxAES5izEB5h9EOrDJtZVeU g= X-Received: by 2002:adf:e192:0:b0:47f:5710:8cad with SMTP id ffacd0b85a97d-47f622f2a3fmr2694330f8f.4.1784285574335; Fri, 17 Jul 2026 03:52:54 -0700 (PDT) Received: from localhost ([2a02:8071:6401:180:d892:bf43:a0b4:83b]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f63ec7ea1sm2618713f8f.24.2026.07.17.03.52.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Jul 2026 03:52:53 -0700 (PDT) Date: Fri, 17 Jul 2026 12:52:49 +0200 From: Johannes Weiner To: Andrew Morton Cc: Breno Leitao , Michal Hocko , Roman Gushchin , Shakeel Butt , Muchun Song , Michal Hocko , cgroups@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-team@meta.com, stable@vger.kernel.org, Joshua Hahn , SeongJae Park Subject: Re: [PATCH v2] mm: memcg: initialize *locked in memcg1_oom_prepare() stub Message-ID: <20260717105249.GB6843@cmpxchg.org> References: <20260716-memcg-oom-uninit-locked-v2-1-63631d878eb4@debian.org> <20260716173949.0f87d0ab30c5eecb01067fce@linux-foundation.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260716173949.0f87d0ab30c5eecb01067fce@linux-foundation.org> On Thu, Jul 16, 2026 at 05:39:49PM -0700, Andrew Morton wrote: > On Thu, 16 Jul 2026 06:42:18 -0700 Breno Leitao wrote: > > > mem_cgroup_oom() passes an uninitialized "locked" to memcg1_oom_prepare() > > and reads it back in memcg1_oom_finish(): > > > > bool locked, ret; > > ... > > if (!memcg1_oom_prepare(memcg, &locked)) > > return false; > > ret = mem_cgroup_out_of_memory(memcg, mask, order); > > memcg1_oom_finish(memcg, locked); > > > > This relies on memcg1_oom_prepare() setting *locked whenever it returns > > true. The CONFIG_MEMCG_V1=y version does, but the stub used when > > CONFIG_MEMCG_V1=n returns true without touching *locked, so > > memcg1_oom_finish() consumes an uninitialized value. On a memcg OOM this > > is reported by UBSAN: > > > > UBSAN: invalid-load in mm/memcontrol.c:1932:27 > > load of value 0 is not a valid value for type 'bool' (aka '_Bool') > > > > Initialize *locked to false in the stub; with cgroup v1 compiled out > > there is no OOM lock to take. > > Thanks. > > Sashiko, as is its wont, reminds us that we all suck: > https://sashiko.dev/#/patchset/20260716-memcg-oom-uninit-locked-v2-1-63631d878eb4@debian.org > > Does this potential memcg issue look legit? Yes, it looks legit to me. The task is meant to be put to sleep after this until current->memcg_in_oom is cleared. But sleep-and-clear happens on userspace resume and there can be multiple allocs before. Is it worth fixing? It's a deprecated feature inside a deprecated feature (6df4ad704707 ("memcg: initiate deprecation of oom_control"), August 2024). Maybe we just ought to delete all this...