From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5E70E3A8759 for ; Mon, 20 Jul 2026 05:42:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784526177; cv=none; b=pMI2j1u5Aax71FVRJkvnYv806RJfQFD/l4VBKW9Tw9rlYpnRhCe44WQ8JkqIss3+Bh0RYJEJaFXiFTvnUFttlaBiN1w/r6O2JZcnsVkRgTjOf+DBluW9fipX2GsytdwqHDMi1b0D6QU+P7D8XVvYwOZd0wrcRWCNSUli8BcaQKw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784526177; c=relaxed/simple; bh=tw5OvKOQF8UW2yo5kcVcEdUHls37lWjcKfwvniLc8W8=; h=Date:From:To:Cc:Subject:Message-Id:In-Reply-To:References: Mime-Version:Content-Type; b=DayKPZg6T0Ph3cLdUHt/uDBxPJ0CobBW6k0vB8c2KItUkB0isM4Ebu34iFTz9DA2ei9MAJzZVZS53eXRMk6JVM962hdnKLZER6yVukuDge/N04d9bgNQkNMsoDEAC879YtPA7qCFKSLeVNBqXoDfNGngkPFCYwe3gTREtpl77vY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=u+euP0CG; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="u+euP0CG" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A98FD1F000E9; Mon, 20 Jul 2026 05:42:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-foundation.org; s=korg; t=1784526176; bh=Q+S1mGES7WPFX17qfsQ0UaEG3UvF5m9koKB2T3Ujw8A=; h=Date:From:To:Cc:Subject:In-Reply-To:References; b=u+euP0CGJuyGXiEpj1CFp/mtlnGZ8bFF1xr8YiE7rfFZU8pp89brbNM6+s+9hF+Cp qMlBVmrOkt56Kezq8lC4STXPkj7RI8D+bskVdz86DGccjmPXEVEMJ6vugAZSHqzYeX lbrbqmuRTrX86Na7dX/8KvBIJumhyamzMGIb650s= Date: Sun, 19 Jul 2026 22:42:55 -0700 From: Andrew Morton To: Ye Liu Cc: "Vlastimil Babka (SUSE)" , Suren Baghdasaryan , Michal Hocko , Brendan Jackman , Johannes Weiner , Zi Yan , linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v6 9/9] mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() Message-Id: <20260719224255.8e2bc60e8a42681fb541e6ad@linux-foundation.org> In-Reply-To: References: <20260714015117.78351-1-ye.liu@linux.dev> <20260714015117.78351-10-ye.liu@linux.dev> <21007313-40dc-46fb-bbf2-453c8eedf3e8@kernel.org> X-Mailer: Sylpheed 3.8.0beta1 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Mon, 20 Jul 2026 10:45:56 +0800 Ye Liu wrote: > > These points have too much detail that's already in the code. Would just > > mention that we opencode applicable parts of page_memcg_check() and > > PageMemcgKmem() using the snapshot? > Yes,It's a bit wordy. > > > >> This avoids both TOCTOU windows and the assertions entirely. > >> > >> Signed-off-by: Ye Liu > > > > Reviewed-by: Vlastimil Babka (SUSE) > > > > Was all of this reported by sashiko? At least the new-in-v6 was? > > Then: > > > > Reported-by: Sashiko > > > > But it's no longer a cleanup but a fix, so probably this? > > > > Fixes: fcf8935832b8 ("mm/page_owner: print memcg information") > > Cc: stable@vger.kernel.org > > > > It's not fixing a new regression so I think it's fine to keep it part of > > this series for next release and not need to split out for mm-hotfixes. > > > Hi Andrew, > > Could you please help me revise the above? Sure, how does this look? From: Ye Liu Subject: mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg() Date: Tue, 14 Jul 2026 09:51:08 +0800 print_page_owner_memcg() reads page->memcg_data via READ_ONCE() at the start to guard against tail pages and NULL data. However, it later re-reads page->memcg_data locklessly in two places: 1: page_memcg_check(page) 2: PageMemcgKmem(page) (via folio_memcg_kmem(), which includes VM_BUG_ON assertions for tail pages and MEMCG_DATA_OBJEXTS) If the page is concurrently freed and reallocated as a THP tail page or slab page between these calls, the VM_BUG_ON assertions can trigger on CONFIG_DEBUG_VM=y builds, crashing the kernel. Fix both TOCTOU issues by using the memcg_data snapshot throughout. Link: https://lore.kernel.org/20260714015117.78351-10-ye.liu@linux.dev Fixes: fcf8935832b8 ("mm/page_owner: print memcg information") Signed-off-by: Ye Liu Reviewed-by: Zi Yan Reviewed-by: Vlastimil Babka (SUSE) Cc: Brendan Jackman Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: David Hildenbrand (Arm) Cc: