Re: [PATCH v3] slab: Add check for memcg_data != OBJEXTS_ALLOC_FAIL in folio_memcg_kmem

[Vlastimil Babka <vbabka@suse.cz>]

On 10/15/25 11:25, Harry Yoo wrote:
> On Tue, Oct 14, 2025 at 09:12:43AM -0700, Suren Baghdasaryan wrote:
>> On Tue, Oct 14, 2025 at 8:28 AM Hao Ge <hao.ge@linux.dev> wrote:
>> >
>> > From: Hao Ge <gehao@kylinos.cn>
>> >
>> > Since OBJEXTS_ALLOC_FAIL and MEMCG_DATA_OBJEXTS currently share
>> > the same bit position, we cannot determine whether memcg_data still
>> > points to the slabobj_ext vector simply by checking
>> > folio->memcg_data & MEMCG_DATA_OBJEXTS.
>> >
>> > If obj_exts allocation failed, slab->obj_exts is set to OBJEXTS_ALLOC_FAIL,
>> > and during the release of the associated folio, the BUG check is triggered
>> > because it was mistakenly assumed that a valid folio->memcg_data
>> > was not cleared before freeing the folio.
> 
> nit: yesterday I was confused that this is sanity checks in buddy complaining
> folio->memcg_data not being cleared, but it's actually folio_memcg_kmem()
> complaining that MEMCG_OBJEXTS_DATA flag is set on non-slab folios (in
> free_pages_prepare(), if PageMemcgKmem(page) -> __memcg_kmem_uncharge_page()))
> So the paragraph above should be updated?
> 
> And as a side question, we clear slab->obj_exts when freeing obj_ext array,
> but don't clear OBJEXTS_ALLOC_FAIL when freeing a slab? That's not good.

Hm great point. We should rather make sure it's cleared always, instead of
adjusting the debugging check, which shouldn't be then necessary, right?

>> > So let's check for memcg_data != OBJEXTS_ALLOC_FAIL in folio_memcg_kmem.
>> >
>> > Fixes: 7612833192d5 ("slab: Reuse first bit for OBJEXTS_ALLOC_FAIL")
>> > Suggested-by: Harry Yoo <harry.yoo@oracle.com>
>> > Signed-off-by: Hao Ge <gehao@kylinos.cn>
>> 
>> Reviewed-by: Suren Baghdasaryan <surenb@google.com>
>>
>> nit: I think it would be helpful if the changelog explained why we
>> need the additional check. We can have the same bit set in two
>> different situations:
>> 1. object extension vector allocation failure;
>> 2. memcg_data pointing to a valid mem_cgroup.
>> To distinguish between them, we need to check not only the bit itself
>> but also the rest of this field. If the rest is NULL, we have case 1,
>> otherwise case 2.
> 
> Agreed.
> 
> In general LGTM,
> Reviewed-by: Harry Yoo <harry.yoo@oracle.com>
> 
> By the way, maybe it'd be nice to introduce a new helper function that
> properly checks MEMCG_DATA_OBJEXTS flag.

I thought so too at first...

>> ~/slab (slab/for-next-fixes)> git grep -n MEMCG_DATA_OBJEXTS
>> include/linux/memcontrol.h:337:	MEMCG_DATA_OBJEXTS = (1UL << 0),
>> include/linux/memcontrol.h:344:#define __OBJEXTS_ALLOC_FAIL	MEMCG_DATA_OBJEXTS
>> include/linux/memcontrol.h:358:	 * MEMCG_DATA_OBJEXTS.
> 
>> include/linux/memcontrol.h:400:	VM_BUG_ON_FOLIO(memcg_data & MEMCG_DATA_OBJEXTS, folio);
>> include/linux/memcontrol.h:421:	VM_BUG_ON_FOLIO(memcg_data & MEMCG_DATA_OBJEXTS, folio);
> 
> these two,
> 
>> include/linux/memcontrol.h:492:	if (memcg_data & MEMCG_DATA_OBJEXTS)
> 
> this,
> 
>> include/linux/memcontrol.h:538:			(folio->memcg_data & MEMCG_DATA_OBJEXTS),
>> include/linux/memcontrol.h:1491: * if MEMCG_DATA_OBJEXTS is set.
>> mm/kfence/core.c:624:				 MEMCG_DATA_OBJEXTS;
> 
>> mm/page_owner.c:513:	if (memcg_data & MEMCG_DATA_OBJEXTS)
> 
> this,
> 
>> mm/slab.h:541:	 * MEMCG_DATA_OBJEXTS bit set or be equal to OBJEXTS_ALLOC_FAIL.
>> mm/slab.h:543:	VM_BUG_ON_PAGE(obj_exts && !(obj_exts & MEMCG_DATA_OBJEXTS) &&
>> mm/slub.c:2137:	new_exts |= MEMCG_DATA_OBJEXTS;
>> tools/mm/show_page_info.py:55:        MEMCG_DATA_OBJEXTS = prog.constant("MEMCG_DATA_OBJEXTS").value_()
> 
>> tools/mm/show_page_info.py:59:        if memcg_data & MEMCG_DATA_OBJEXTS:
> 
> and this do not look good.
> 
> I mean technically they are fine since OBJEXTS_ALLOC_FAIL is set on
> slabs only, but that's just a coincidence.

And checked the the other debugging checks too. But then thought it's better
that if these are not expected to see slabs, then they should not be
adjusted. I don't see it as a coincidence but as intention to keep it slab
specific. It will be also more future proof for the upcoming separation of
struct slab from struct page.

>> > ---
>> > v3: Simplify the solution, per Harry's suggestion in the v1 comments
>> >     Add Suggested-by: Harry Yoo <harry.yoo@oracle.com>
>> > ---
>> >  include/linux/memcontrol.h | 4 +++-
>> >  1 file changed, 3 insertions(+), 1 deletion(-)
>> >
>> > diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
>> > index 873e510d6f8d..7ed15f858dc4 100644
>> > --- a/include/linux/memcontrol.h
>> > +++ b/include/linux/memcontrol.h
>> > @@ -534,7 +534,9 @@ static inline struct mem_cgroup *get_mem_cgroup_from_objcg(struct obj_cgroup *ob
>> >  static inline bool folio_memcg_kmem(struct folio *folio)
>> >  {
>> >         VM_BUG_ON_PGFLAGS(PageTail(&folio->page), &folio->page);
>> > -       VM_BUG_ON_FOLIO(folio->memcg_data & MEMCG_DATA_OBJEXTS, folio);
>> > +       VM_BUG_ON_FOLIO((folio->memcg_data != OBJEXTS_ALLOC_FAIL) &&
>> > +                       (folio->memcg_data & MEMCG_DATA_OBJEXTS),
>> > +                       folio);
>> >         return folio->memcg_data & MEMCG_DATA_KMEM;
>> >  }
>> >
>> > --
>> > 2.25.1
>