From: Andrew Morton <akpm@linux-foundation.org>
To: David Carlier <devnexen@gmail.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>,
Michal Hocko <mhocko@kernel.org>,
Roman Gushchin <roman.gushchin@linux.dev>,
Shakeel Butt <shakeel.butt@linux.dev>,
Muchun Song <muchun.song@linux.dev>,
Qi Zheng <zhengqi.arch@bytedance.com>,
linux-mm@kvack.org, stable@vger.kernel.org
Subject: Re: [PATCH] mm/memcontrol: fix obj_cgroup leak in mem_cgroup_css_online() error path
Date: Sun, 22 Mar 2026 11:54:52 -0700 [thread overview]
Message-ID: <20260322115452.29f2ce981610faf2d7b8df32@linux-foundation.org> (raw)
In-Reply-To: <20260322164943.37460-1-devnexen@gmail.com>
On Sun, 22 Mar 2026 16:49:43 +0000 David Carlier <devnexen@gmail.com> wrote:
> When obj_cgroup_alloc() fails partway through the NUMA node loop in
> mem_cgroup_css_online(), the free_objcg error path drops the extra
> reference held by pn->orig_objcg but never kills the initial percpu_ref
> from obj_cgroup_alloc() stored in pn->objcg.
>
> Since css_offline is never called when css_online fails,
> memcg_reparent_objcgs() never runs, so the percpu_ref_kill() that
> normally drops this initial reference never executes. The obj_cgroup and
> its per-cpu ref allocations are leaked.
>
> Clear pn->objcg via rcu_replace_pointer() and add the missing
> percpu_ref_kill() in the error path, matching the normal teardown
> sequence in memcg_reparent_objcgs().
>
> Fixes: 098fad3e1621 ("mm: memcontrol: convert objcg to be per-memcg per-node type")
Thanks. Sashiko review of this patch claims to have found another bug
in 098fad3e1621:
https://sashiko.dev/#/patchset/20260322164943.37460-1-devnexen@gmail.com
> Cc: stable@vger.kernel.org
next prev parent reply other threads:[~2026-03-22 18:54 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-22 8:01 [PATCH] mm/memcontrol: fix obj_cgroup leak in mem_cgroup_css_online() error path David Carlier
2026-03-22 16:20 ` Andrew Morton
2026-03-22 16:41 ` David CARLIER
2026-03-22 16:49 ` David Carlier
2026-03-22 18:54 ` Andrew Morton [this message]
2026-03-22 19:26 ` David CARLIER
2026-03-24 8:22 ` kernel test robot
2026-03-24 9:10 ` Dan Carpenter
2026-03-24 10:54 ` David CARLIER
2026-03-22 19:36 ` David Carlier
2026-03-22 22:34 ` Andrew Morton
2026-03-23 2:12 ` Qi Zheng
2026-03-23 6:30 ` David Carlier
-- strict thread matches above, loose matches on Subject: below --
2026-03-23 6:28 David Carlier
2026-03-23 6:30 ` David CARLIER
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260322115452.29f2ce981610faf2d7b8df32@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=devnexen@gmail.com \
--cc=hannes@cmpxchg.org \
--cc=linux-mm@kvack.org \
--cc=mhocko@kernel.org \
--cc=muchun.song@linux.dev \
--cc=roman.gushchin@linux.dev \
--cc=shakeel.butt@linux.dev \
--cc=stable@vger.kernel.org \
--cc=zhengqi.arch@bytedance.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.