Re: [RFC PATCH v1] mm: memcg: skip frozen folios in page_cgroup_ino()

[Daejun Park <daejun7.park@samsung.com>]

Sorry for the new thread, I was not on Cc of the original mail:
https://lore.kernel.org/all/20260907124001.1544655-1-escape@deepseek.com/

On Mon, Sep 07, 2026 at 12:40:00PM +0000, Tao Yi wrote:
> When a large folio is split, __split_folio_to_order() clears PageTail
> before copying the original folio's memcg_data to the new folio.

Thanks for tracking this down. The oops reproduces on 7.3-rc7 here.

I wonder if the fix belongs on the split side instead:

- The window exists because the split makes page 1 a folio before its
  memcg_data is set. Before commit fa23a338de93 ("mm: separate
  folio_split_memcg_refs() from split_page_memcg()"), memcg_data was
  set first.
- A zero refcount does not always mean a split. Large kmalloc pages are
  frozen but charged, so /proc/kpagecgroup would report them as
  uncharged.
- print_page_owner_memcg() reads memcg_data in the same window, and the
  refcount check does not cover it.

Copying memcg_data before the smp_wmb() in __split_folio_to_order(),
with a paired smp_rmb() on the reader side, closes the window for both
readers. The same reproducer ran 300 s without an oops with that change.

Would you consider a v2 along these lines? I am happy to test it.

Daejun