diff for duplicates of <202603241635.qNXDPwjs-lkp@intel.com> diff --git a/a/1.txt b/N1/1.txt index 5a97c33..3df156c 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -1,11 +1,31 @@ +BCC: lkp@intel.com +CC: oe-kbuild-all@lists.linux.dev +In-Reply-To: <20260322164943.37460-1-devnexen@gmail.com> +References: <20260322164943.37460-1-devnexen@gmail.com> +TO: David Carlier <devnexen@gmail.com> +TO: Johannes Weiner <hannes@cmpxchg.org> +TO: Michal Hocko <mhocko@kernel.org> +TO: Roman Gushchin <roman.gushchin@linux.dev> +TO: Shakeel Butt <shakeel.butt@linux.dev> +TO: Muchun Song <muchun.song@linux.dev> +TO: Andrew Morton <akpm@linux-foundation.org> +CC: Linux Memory Management List <linux-mm@kvack.org> +TO: Qi Zheng <zhengqi.arch@bytedance.com> +CC: David Carlier <devnexen@gmail.com> +CC: stable@vger.kernel.org + Hi David, kernel test robot noticed the following build warnings: +[auto build test WARNING on akpm-mm/mm-everything] + url: https://github.com/intel-lab-lkp/linux/commits/David-Carlier/mm-memcontrol-fix-obj_cgroup-leak-in-mem_cgroup_css_online-error-path/20260324-010357 base: https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-everything patch link: https://lore.kernel.org/r/20260322164943.37460-1-devnexen%40gmail.com patch subject: [PATCH] mm/memcontrol: fix obj_cgroup leak in mem_cgroup_css_online() error path +:::::: branch date: 15 hours ago +:::::: commit date: 15 hours ago config: arm64-randconfig-r072-20260324 (https://download.01.org/0day-ci/archive/20260324/202603241635.qNXDPwjs-lkp@intel.com/config) compiler: aarch64-linux-gcc (GCC) 14.3.0 smatch: v0.5.0-9004-gb810ac53 @@ -13,7 +33,7 @@ smatch: v0.5.0-9004-gb810ac53 If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp@intel.com> -| Reported-by: Dan Carpenter <dan.carpenter@linaro.org> +| Reported-by: Dan Carpenter <error27@gmail.com> | Closes: https://lore.kernel.org/r/202603241635.qNXDPwjs-lkp@intel.com/ smatch warnings: @@ -21,6 +41,55 @@ mm/memcontrol.c:4180 mem_cgroup_css_online() warn: variable dereferenced before vim +/pn +4180 mm/memcontrol.c +0b8f73e104285a Johannes Weiner 2016-01-20 4119 +73f576c04b9410 Johannes Weiner 2016-07-20 4120 static int mem_cgroup_css_online(struct cgroup_subsys_state *css) +0b8f73e104285a Johannes Weiner 2016-01-20 4121 { +58fa2a5512d9f2 Vladimir Davydov 2016-10-07 4122 struct mem_cgroup *memcg = mem_cgroup_from_css(css); +a0dd8b1942f5bf Muchun Song 2026-03-05 4123 struct obj_cgroup *objcg; +098fad3e1621cb Qi Zheng 2026-03-05 4124 int nid; +58fa2a5512d9f2 Vladimir Davydov 2016-10-07 4125 +a0dd8b1942f5bf Muchun Song 2026-03-05 4126 memcg_online_kmem(memcg); +da0efe30944476 Muchun Song 2022-03-22 4127 +0a4465d340282f Kirill Tkhai 2018-08-17 4128 /* +e4262c4f51d637 Yang Shi 2021-05-04 4129 * A memcg must be visible for expand_shrinker_info() +0a4465d340282f Kirill Tkhai 2018-08-17 4130 * by the time the maps are allocated. So, we allocate maps +0a4465d340282f Kirill Tkhai 2018-08-17 4131 * here, when for_each_mem_cgroup() can't skip it. +0a4465d340282f Kirill Tkhai 2018-08-17 4132 */ +da0efe30944476 Muchun Song 2022-03-22 4133 if (alloc_shrinker_info(memcg)) +da0efe30944476 Muchun Song 2022-03-22 4134 goto offline_kmem; +0a4465d340282f Kirill Tkhai 2018-08-17 4135 +098fad3e1621cb Qi Zheng 2026-03-05 4136 for_each_node(nid) { +a0dd8b1942f5bf Muchun Song 2026-03-05 4137 objcg = obj_cgroup_alloc(); +59f75a1877fbf7 David Carlier 2026-03-22 4138 if (!objcg) { +098fad3e1621cb Qi Zheng 2026-03-05 4139 goto free_objcg; +59f75a1877fbf7 David Carlier 2026-03-22 4140 } +a0dd8b1942f5bf Muchun Song 2026-03-05 4141 +7e6ee1e3da3510 Muchun Song 2026-03-05 4142 if (unlikely(mem_cgroup_is_root(memcg))) +098fad3e1621cb Qi Zheng 2026-03-05 4143 objcg->is_root = true; +7e6ee1e3da3510 Muchun Song 2026-03-05 4144 +a0dd8b1942f5bf Muchun Song 2026-03-05 4145 objcg->memcg = memcg; +098fad3e1621cb Qi Zheng 2026-03-05 4146 rcu_assign_pointer(memcg->nodeinfo[nid]->objcg, objcg); +a0dd8b1942f5bf Muchun Song 2026-03-05 4147 obj_cgroup_get(objcg); +098fad3e1621cb Qi Zheng 2026-03-05 4148 memcg->nodeinfo[nid]->orig_objcg = objcg; +098fad3e1621cb Qi Zheng 2026-03-05 4149 } +a0dd8b1942f5bf Muchun Song 2026-03-05 4150 +13ef7424577ff9 T.J. Mercier 2024-01-26 4151 if (unlikely(mem_cgroup_is_root(memcg)) && !mem_cgroup_disabled()) +0bcbd7cf659682 Marco Crivellari 2026-01-13 4152 queue_delayed_work(system_dfl_wq, &stats_flush_dwork, +396faf88981917 Miaohe Lin 2023-06-03 4153 FLUSH_TIME); +e4dde56cd20867 Yu Zhao 2022-12-21 4154 lru_gen_online_memcg(memcg); +6f0df8e16eb543 Johannes Weiner 2023-08-23 4155 +6f0df8e16eb543 Johannes Weiner 2023-08-23 4156 /* Online state pins memcg ID, memcg ID pins CSS */ +6f0df8e16eb543 Johannes Weiner 2023-08-23 4157 refcount_set(&memcg->id.ref, 1); +6f0df8e16eb543 Johannes Weiner 2023-08-23 4158 css_get(css); +6f0df8e16eb543 Johannes Weiner 2023-08-23 4159 +6f0df8e16eb543 Johannes Weiner 2023-08-23 4160 /* +e77786b4682e69 Shakeel Butt 2025-12-25 4161 * Ensure mem_cgroup_from_private_id() works once we're fully online. +6f0df8e16eb543 Johannes Weiner 2023-08-23 4162 * +6f0df8e16eb543 Johannes Weiner 2023-08-23 4163 * We could do this earlier and require callers to filter with +6f0df8e16eb543 Johannes Weiner 2023-08-23 4164 * css_tryget_online(). But right now there are no users that +6f0df8e16eb543 Johannes Weiner 2023-08-23 4165 * need earlier access, and the workingset code relies on the +6f0df8e16eb543 Johannes Weiner 2023-08-23 4166 * cgroup tree linkage (mem_cgroup_get_nr_swap_pages()). So +6f0df8e16eb543 Johannes Weiner 2023-08-23 4167 * publish it here at the end of onlining. This matches the 6f0df8e16eb543 Johannes Weiner 2023-08-23 4168 * regular ID destruction during offlining. 6f0df8e16eb543 Johannes Weiner 2023-08-23 4169 */ e77786b4682e69 Shakeel Butt 2025-12-25 4170 xa_store(&mem_cgroup_private_ids, memcg->id.id, memcg, GFP_KERNEL); @@ -30,16 +99,10 @@ e77786b4682e69 Shakeel Butt 2025-12-25 4170 xa_store(&mem_cgroup_private_ 098fad3e1621cb Qi Zheng 2026-03-05 4174 for_each_node(nid) { 098fad3e1621cb Qi Zheng 2026-03-05 4175 struct mem_cgroup_per_node *pn = memcg->nodeinfo[nid]; 59f75a1877fbf7 David Carlier 2026-03-22 @4176 objcg = rcu_replace_pointer(pn->objcg, NULL, true); - ^^^^^^^^^ -Dereference - 59f75a1877fbf7 David Carlier 2026-03-22 4177 if (objcg) 59f75a1877fbf7 David Carlier 2026-03-22 4178 percpu_ref_kill(&objcg->refcnt); 098fad3e1621cb Qi Zheng 2026-03-05 4179 4a2f95f5c79e02 Qi Zheng 2026-03-09 @4180 if (pn && pn->orig_objcg) { - ^^ -Checked too late. - 098fad3e1621cb Qi Zheng 2026-03-05 4181 obj_cgroup_put(pn->orig_objcg); 4a2f95f5c79e02 Qi Zheng 2026-03-09 4182 /* 02b5fc7885d9f8 Andrew Morton 2026-03-09 4183 * Reset pn->orig_objcg to NULL to prevent @@ -55,6 +118,7 @@ da0efe30944476 Muchun Song 2022-03-22 4192 memcg_offline_kmem(memcg); e77786b4682e69 Shakeel Butt 2025-12-25 4193 mem_cgroup_private_id_remove(memcg); da0efe30944476 Muchun Song 2022-03-22 4194 return -ENOMEM; 8cdea7c0545426 Balbir Singh 2008-02-07 4195 } +8cdea7c0545426 Balbir Singh 2008-02-07 4196 -- 0-DAY CI Kernel Test Service diff --git a/a/content_digest b/N1/content_digest index 6b1f490..7633bac 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -1,31 +1,39 @@ - "ref\020260322164943.37460-1-devnexen@gmail.com\0" - "From\0Dan Carpenter <dan.carpenter@linaro.org>\0" + "From\0kernel test robot <lkp@intel.com>\0" "Subject\0Re: [PATCH] mm/memcontrol: fix obj_cgroup leak in mem_cgroup_css_online() error path\0" - "Date\0Tue, 24 Mar 2026 12:10:49 +0300\0" - "To\0oe-kbuild@lists.linux.dev" - David Carlier <devnexen@gmail.com> - Johannes Weiner <hannes@cmpxchg.org> - Michal Hocko <mhocko@kernel.org> - Roman Gushchin <roman.gushchin@linux.dev> - Shakeel Butt <shakeel.butt@linux.dev> - Muchun Song <muchun.song@linux.dev> - Andrew Morton <akpm@linux-foundation.org> - " Qi Zheng <zhengqi.arch@bytedance.com>\0" + "Date\0Tue, 24 Mar 2026 16:22:44 +0800\0" + "To\0oe-kbuild@lists.linux.dev\0" "Cc\0lkp@intel.com" - oe-kbuild-all@lists.linux.dev - Linux Memory Management List <linux-mm@kvack.org> - David Carlier <devnexen@gmail.com> - " stable@vger.kernel.org\0" + " Dan Carpenter <error27@gmail.com>\0" "\00:1\0" "b\0" + "BCC: lkp@intel.com\n" + "CC: oe-kbuild-all@lists.linux.dev\n" + "In-Reply-To: <20260322164943.37460-1-devnexen@gmail.com>\n" + "References: <20260322164943.37460-1-devnexen@gmail.com>\n" + "TO: David Carlier <devnexen@gmail.com>\n" + "TO: Johannes Weiner <hannes@cmpxchg.org>\n" + "TO: Michal Hocko <mhocko@kernel.org>\n" + "TO: Roman Gushchin <roman.gushchin@linux.dev>\n" + "TO: Shakeel Butt <shakeel.butt@linux.dev>\n" + "TO: Muchun Song <muchun.song@linux.dev>\n" + "TO: Andrew Morton <akpm@linux-foundation.org>\n" + "CC: Linux Memory Management List <linux-mm@kvack.org>\n" + "TO: Qi Zheng <zhengqi.arch@bytedance.com>\n" + "CC: David Carlier <devnexen@gmail.com>\n" + "CC: stable@vger.kernel.org\n" + "\n" "Hi David,\n" "\n" "kernel test robot noticed the following build warnings:\n" "\n" + "[auto build test WARNING on akpm-mm/mm-everything]\n" + "\n" "url: https://github.com/intel-lab-lkp/linux/commits/David-Carlier/mm-memcontrol-fix-obj_cgroup-leak-in-mem_cgroup_css_online-error-path/20260324-010357\n" "base: https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-everything\n" "patch link: https://lore.kernel.org/r/20260322164943.37460-1-devnexen%40gmail.com\n" "patch subject: [PATCH] mm/memcontrol: fix obj_cgroup leak in mem_cgroup_css_online() error path\n" + ":::::: branch date: 15 hours ago\n" + ":::::: commit date: 15 hours ago\n" "config: arm64-randconfig-r072-20260324 (https://download.01.org/0day-ci/archive/20260324/202603241635.qNXDPwjs-lkp@intel.com/config)\n" "compiler: aarch64-linux-gcc (GCC) 14.3.0\n" "smatch: v0.5.0-9004-gb810ac53\n" @@ -33,7 +41,7 @@ "If you fix the issue in a separate patch/commit (i.e. not just a new version of\n" "the same patch/commit), kindly add following tags\n" "| Reported-by: kernel test robot <lkp@intel.com>\n" - "| Reported-by: Dan Carpenter <dan.carpenter@linaro.org>\n" + "| Reported-by: Dan Carpenter <error27@gmail.com>\n" "| Closes: https://lore.kernel.org/r/202603241635.qNXDPwjs-lkp@intel.com/\n" "\n" "smatch warnings:\n" @@ -41,6 +49,55 @@ "\n" "vim +/pn +4180 mm/memcontrol.c\n" "\n" + "0b8f73e104285a Johannes Weiner 2016-01-20 4119 \n" + "73f576c04b9410 Johannes Weiner 2016-07-20 4120 static int mem_cgroup_css_online(struct cgroup_subsys_state *css)\n" + "0b8f73e104285a Johannes Weiner 2016-01-20 4121 {\n" + "58fa2a5512d9f2 Vladimir Davydov 2016-10-07 4122 \tstruct mem_cgroup *memcg = mem_cgroup_from_css(css);\n" + "a0dd8b1942f5bf Muchun Song 2026-03-05 4123 \tstruct obj_cgroup *objcg;\n" + "098fad3e1621cb Qi Zheng 2026-03-05 4124 \tint nid;\n" + "58fa2a5512d9f2 Vladimir Davydov 2016-10-07 4125 \n" + "a0dd8b1942f5bf Muchun Song 2026-03-05 4126 \tmemcg_online_kmem(memcg);\n" + "da0efe30944476 Muchun Song 2022-03-22 4127 \n" + "0a4465d340282f Kirill Tkhai 2018-08-17 4128 \t/*\n" + "e4262c4f51d637 Yang Shi 2021-05-04 4129 \t * A memcg must be visible for expand_shrinker_info()\n" + "0a4465d340282f Kirill Tkhai 2018-08-17 4130 \t * by the time the maps are allocated. So, we allocate maps\n" + "0a4465d340282f Kirill Tkhai 2018-08-17 4131 \t * here, when for_each_mem_cgroup() can't skip it.\n" + "0a4465d340282f Kirill Tkhai 2018-08-17 4132 \t */\n" + "da0efe30944476 Muchun Song 2022-03-22 4133 \tif (alloc_shrinker_info(memcg))\n" + "da0efe30944476 Muchun Song 2022-03-22 4134 \t\tgoto offline_kmem;\n" + "0a4465d340282f Kirill Tkhai 2018-08-17 4135 \n" + "098fad3e1621cb Qi Zheng 2026-03-05 4136 \tfor_each_node(nid) {\n" + "a0dd8b1942f5bf Muchun Song 2026-03-05 4137 \t\tobjcg = obj_cgroup_alloc();\n" + "59f75a1877fbf7 David Carlier 2026-03-22 4138 \t\tif (!objcg) {\n" + "098fad3e1621cb Qi Zheng 2026-03-05 4139 \t\t\tgoto free_objcg;\n" + "59f75a1877fbf7 David Carlier 2026-03-22 4140 \t\t}\n" + "a0dd8b1942f5bf Muchun Song 2026-03-05 4141 \n" + "7e6ee1e3da3510 Muchun Song 2026-03-05 4142 \t\tif (unlikely(mem_cgroup_is_root(memcg)))\n" + "098fad3e1621cb Qi Zheng 2026-03-05 4143 \t\t\tobjcg->is_root = true;\n" + "7e6ee1e3da3510 Muchun Song 2026-03-05 4144 \n" + "a0dd8b1942f5bf Muchun Song 2026-03-05 4145 \t\tobjcg->memcg = memcg;\n" + "098fad3e1621cb Qi Zheng 2026-03-05 4146 \t\trcu_assign_pointer(memcg->nodeinfo[nid]->objcg, objcg);\n" + "a0dd8b1942f5bf Muchun Song 2026-03-05 4147 \t\tobj_cgroup_get(objcg);\n" + "098fad3e1621cb Qi Zheng 2026-03-05 4148 \t\tmemcg->nodeinfo[nid]->orig_objcg = objcg;\n" + "098fad3e1621cb Qi Zheng 2026-03-05 4149 \t}\n" + "a0dd8b1942f5bf Muchun Song 2026-03-05 4150 \n" + "13ef7424577ff9 T.J. Mercier 2024-01-26 4151 \tif (unlikely(mem_cgroup_is_root(memcg)) && !mem_cgroup_disabled())\n" + "0bcbd7cf659682 Marco Crivellari 2026-01-13 4152 \t\tqueue_delayed_work(system_dfl_wq, &stats_flush_dwork,\n" + "396faf88981917 Miaohe Lin 2023-06-03 4153 \t\t\t\t FLUSH_TIME);\n" + "e4dde56cd20867 Yu Zhao 2022-12-21 4154 \tlru_gen_online_memcg(memcg);\n" + "6f0df8e16eb543 Johannes Weiner 2023-08-23 4155 \n" + "6f0df8e16eb543 Johannes Weiner 2023-08-23 4156 \t/* Online state pins memcg ID, memcg ID pins CSS */\n" + "6f0df8e16eb543 Johannes Weiner 2023-08-23 4157 \trefcount_set(&memcg->id.ref, 1);\n" + "6f0df8e16eb543 Johannes Weiner 2023-08-23 4158 \tcss_get(css);\n" + "6f0df8e16eb543 Johannes Weiner 2023-08-23 4159 \n" + "6f0df8e16eb543 Johannes Weiner 2023-08-23 4160 \t/*\n" + "e77786b4682e69 Shakeel Butt 2025-12-25 4161 \t * Ensure mem_cgroup_from_private_id() works once we're fully online.\n" + "6f0df8e16eb543 Johannes Weiner 2023-08-23 4162 \t *\n" + "6f0df8e16eb543 Johannes Weiner 2023-08-23 4163 \t * We could do this earlier and require callers to filter with\n" + "6f0df8e16eb543 Johannes Weiner 2023-08-23 4164 \t * css_tryget_online(). But right now there are no users that\n" + "6f0df8e16eb543 Johannes Weiner 2023-08-23 4165 \t * need earlier access, and the workingset code relies on the\n" + "6f0df8e16eb543 Johannes Weiner 2023-08-23 4166 \t * cgroup tree linkage (mem_cgroup_get_nr_swap_pages()). So\n" + "6f0df8e16eb543 Johannes Weiner 2023-08-23 4167 \t * publish it here at the end of onlining. This matches the\n" "6f0df8e16eb543 Johannes Weiner 2023-08-23 4168 \t * regular ID destruction during offlining.\n" "6f0df8e16eb543 Johannes Weiner 2023-08-23 4169 \t */\n" "e77786b4682e69 Shakeel Butt 2025-12-25 4170 \txa_store(&mem_cgroup_private_ids, memcg->id.id, memcg, GFP_KERNEL);\n" @@ -50,16 +107,10 @@ "098fad3e1621cb Qi Zheng 2026-03-05 4174 \tfor_each_node(nid) {\n" "098fad3e1621cb Qi Zheng 2026-03-05 4175 \t\tstruct mem_cgroup_per_node *pn = memcg->nodeinfo[nid];\n" "59f75a1877fbf7 David Carlier 2026-03-22 @4176 \t\tobjcg = rcu_replace_pointer(pn->objcg, NULL, true);\n" - " ^^^^^^^^^\n" - "Dereference\n" - "\n" "59f75a1877fbf7 David Carlier 2026-03-22 4177 \t\tif (objcg)\n" "59f75a1877fbf7 David Carlier 2026-03-22 4178 \t\t\tpercpu_ref_kill(&objcg->refcnt);\n" "098fad3e1621cb Qi Zheng 2026-03-05 4179 \n" "4a2f95f5c79e02 Qi Zheng 2026-03-09 @4180 \t\tif (pn && pn->orig_objcg) {\n" - " ^^\n" - "Checked too late.\n" - "\n" "098fad3e1621cb Qi Zheng 2026-03-05 4181 \t\t\tobj_cgroup_put(pn->orig_objcg);\n" "4a2f95f5c79e02 Qi Zheng 2026-03-09 4182 \t\t\t/*\n" "02b5fc7885d9f8 Andrew Morton 2026-03-09 4183 \t\t\t * Reset pn->orig_objcg to NULL to prevent\n" @@ -75,9 +126,10 @@ "e77786b4682e69 Shakeel Butt 2025-12-25 4193 \tmem_cgroup_private_id_remove(memcg);\n" "da0efe30944476 Muchun Song 2022-03-22 4194 \treturn -ENOMEM;\n" "8cdea7c0545426 Balbir Singh 2008-02-07 4195 }\n" + "8cdea7c0545426 Balbir Singh 2008-02-07 4196 \n" "\n" "-- \n" "0-DAY CI Kernel Test Service\n" https://github.com/intel/lkp-tests/wiki -748120db3d2cecee0f3589c45daa66fcc146ae5ff09992b55f53145a4b165828 +0f8abb80d144c853bc4bf147054c1a6c5bc69c1ff262a9248c38b494d6fb0d1d
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.