* Re: [PATCH v3] mm/vmscan: fix demotion targets checks in reclaim/demotion
2025-12-23 21:19 ` [PATCH v3] mm/vmscan: fix demotion targets checks in reclaim/demotion Bing Jiao
@ 2025-12-23 21:38 ` Bing Jiao
2025-12-24 1:19 ` Gregory Price
` (4 subsequent siblings)
5 siblings, 0 replies; 54+ messages in thread
From: Bing Jiao @ 2025-12-23 21:38 UTC (permalink / raw)
To: linux-mm
Cc: linux-kernel, akpm, gourry, longman, hannes, mhocko,
roman.gushchin, shakeel.butt, muchun.song, tj, mkoutny, david,
zhengqi.arch, lorenzo.stoakes, axelrasmussen, chenridong, yuanchu,
weixugc, cgroups
On Tue, Dec 23, 2025 at 09:19:59PM +0000, Bing Jiao wrote:
> Fix two bugs in demote_folio_list() and can_demote() due to incorrect
> demotion target checks in reclaim/demotion.
>
Considering these bugs are introduced from one commit, I think
it is better to fix it in one patch rather than split it.
v3: Rename cpuset_node_allowed() as cpuset_node_get_allowed() to
return effective_mems directly, providing better versatility
(thanks Ridong for the suggestion).
^ permalink raw reply [flat|nested] 54+ messages in thread* Re: [PATCH v3] mm/vmscan: fix demotion targets checks in reclaim/demotion
2025-12-23 21:19 ` [PATCH v3] mm/vmscan: fix demotion targets checks in reclaim/demotion Bing Jiao
2025-12-23 21:38 ` Bing Jiao
@ 2025-12-24 1:19 ` Gregory Price
2025-12-26 18:48 ` Bing Jiao
2025-12-24 1:49 ` Chen Ridong
` (3 subsequent siblings)
5 siblings, 1 reply; 54+ messages in thread
From: Gregory Price @ 2025-12-24 1:19 UTC (permalink / raw)
To: Bing Jiao
Cc: linux-mm, linux-kernel, akpm, longman, hannes, mhocko,
roman.gushchin, shakeel.butt, muchun.song, tj, mkoutny, david,
zhengqi.arch, lorenzo.stoakes, axelrasmussen, chenridong, yuanchu,
weixugc, cgroups
On Tue, Dec 23, 2025 at 09:19:59PM +0000, Bing Jiao wrote:
> -static inline bool cpuset_node_allowed(struct cgroup *cgroup, int nid)
> +static inline nodemask_t cpuset_node_get_allowed(struct cgroup *cgroup)
> {
> - return true;
> + return node_possible_map;
...
> -static inline bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid)
> +static inline nodemask_t mem_cgroup_node_get_allowed(struct mem_cgroup *memcg)
> {
> - return true;
> + return node_possible_map;
> }
...
> -bool cpuset_node_allowed(struct cgroup *cgroup, int nid)
> +nodemask_t cpuset_node_get_allowed(struct cgroup *cgroup)
> {
> + nodemask_t nodes = node_possible_map;
...
> -bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid)
> +nodemask_t mem_cgroup_node_get_allowed(struct mem_cgroup *memcg)
> {
> - return memcg ? cpuset_node_allowed(memcg->css.cgroup, nid) : true;
> + if (memcg)
> + return cpuset_node_get_allowed(memcg->css.cgroup);
> + return node_possible_map;
> }
node_possible_map or node_states[N_MEMORY]?
The latter seems more appropriate to me since node_possible_map will
include offline nodes.
> - allowed = node_isset(nid, cs->effective_mems);
> + nodes_copy(nodes, cs->effective_mems);
> css_put(css);
> - return allowed;
> + return nodes;
> }
I saw in vmscan you check for returning an empty nodemask, may want to
at least add a comment to the function definition that says this needs
to be checked.
> diff --git a/mm/vmscan.c b/mm/vmscan.c
> index a4b308a2f9ad..711a04baf258 100644
> --- a/mm/vmscan.c
> +++ b/mm/vmscan.c
> @@ -345,18 +345,24 @@ static bool can_demote(int nid, struct scan_control *sc,
> struct mem_cgroup *memcg)
> {
> int demotion_nid;
> + struct pglist_data *pgdat = NODE_DATA(nid);
> + nodemask_t allowed_mask, allowed_mems;
Only other concern i have is the number of nodemasks being added to the
stack. Should be <512 bytes, but I've run into situations where builds
have screamed at me for adding one nodemask to the stack, let alone 3+.
Have you run this through klp?
~Gregory
^ permalink raw reply [flat|nested] 54+ messages in thread* Re: [PATCH v3] mm/vmscan: fix demotion targets checks in reclaim/demotion
2025-12-24 1:19 ` Gregory Price
@ 2025-12-26 18:48 ` Bing Jiao
2026-01-05 21:57 ` Bing Jiao
0 siblings, 1 reply; 54+ messages in thread
From: Bing Jiao @ 2025-12-26 18:48 UTC (permalink / raw)
To: Gregory Price
Cc: linux-mm, linux-kernel, akpm, longman, hannes, mhocko,
roman.gushchin, shakeel.butt, muchun.song, tj, mkoutny, david,
zhengqi.arch, lorenzo.stoakes, axelrasmussen, chenridong, yuanchu,
weixugc, cgroups
On Tue, Dec 23, 2025 at 08:19:32PM -0500, Gregory Price wrote:
> On Tue, Dec 23, 2025 at 09:19:59PM +0000, Bing Jiao wrote:
> > -bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid)
> > +nodemask_t mem_cgroup_node_get_allowed(struct mem_cgroup *memcg)
> > {
> > - return memcg ? cpuset_node_allowed(memcg->css.cgroup, nid) : true;
> > + if (memcg)
> > + return cpuset_node_get_allowed(memcg->css.cgroup);
> > + return node_possible_map;
> > }
>
>
> node_possible_map or node_states[N_MEMORY]?
>
> The latter seems more appropriate to me since node_possible_map will
> include offline nodes.
Yes, I agree that node_states[N_MEMORY] would be better.
> > - allowed = node_isset(nid, cs->effective_mems);
> > + nodes_copy(nodes, cs->effective_mems);
> > css_put(css);
> > - return allowed;
> > + return nodes;
> > }
>
> I saw in vmscan you check for returning an empty nodemask, may want to
> at least add a comment to the function definition that says this needs
> to be checked.
Will add a comment to say that it may return an empty nodemask.
> > diff --git a/mm/vmscan.c b/mm/vmscan.c
> > index a4b308a2f9ad..711a04baf258 100644
> > --- a/mm/vmscan.c
> > +++ b/mm/vmscan.c
> > @@ -345,18 +345,24 @@ static bool can_demote(int nid, struct scan_control *sc,
> > struct mem_cgroup *memcg)
> > {
> > int demotion_nid;
> > + struct pglist_data *pgdat = NODE_DATA(nid);
> > + nodemask_t allowed_mask, allowed_mems;
>
> Only other concern i have is the number of nodemasks being added to the
> stack. Should be <512 bytes, but I've run into situations where builds
> have screamed at me for adding one nodemask to the stack, let alone 3+.
While having 3+ nodemasks presents a risk, utilizing two nodemasks
should be acceptable. Given that the maximum number of nodes is
1024 (2^10), two nodemasks would require 256 bytes, which should be okay.
Otherwise, we can keep to use mem_node_filter_allowed().
Only update it to return a nodemask when subsequent features need.
> Have you run this through klp?
I have not run it through klp. Will do it then.
Thanks,
Bing
^ permalink raw reply [flat|nested] 54+ messages in thread* Re: [PATCH v3] mm/vmscan: fix demotion targets checks in reclaim/demotion
2025-12-26 18:48 ` Bing Jiao
@ 2026-01-05 21:57 ` Bing Jiao
0 siblings, 0 replies; 54+ messages in thread
From: Bing Jiao @ 2026-01-05 21:57 UTC (permalink / raw)
To: Gregory Price
Cc: linux-mm, linux-kernel, akpm, longman, hannes, mhocko,
roman.gushchin, shakeel.butt, muchun.song, tj, mkoutny, david,
zhengqi.arch, lorenzo.stoakes, axelrasmussen, chenridong, yuanchu,
weixugc, cgroups
On Fri, Dec 26, 2025 at 06:48:20PM +0000, Bing Jiao wrote:
> On Tue, Dec 23, 2025 at 08:19:32PM -0500, Gregory Price wrote:
> > Have you run this through klp?
>
> I have not run it through klp. Will do it then.
>
> Thanks,
> Bing
Hi Gregory,
I tried to build a klp against kernel v6.16, but it ran into a
segfault during `create-diff-object` using kpatch-build v0.9.11.
I do not think it was caused by this patch. But I will try it
again at a later time.
Best,
Bing
^ permalink raw reply [flat|nested] 54+ messages in thread
* Re: [PATCH v3] mm/vmscan: fix demotion targets checks in reclaim/demotion
2025-12-23 21:19 ` [PATCH v3] mm/vmscan: fix demotion targets checks in reclaim/demotion Bing Jiao
2025-12-23 21:38 ` Bing Jiao
2025-12-24 1:19 ` Gregory Price
@ 2025-12-24 1:49 ` Chen Ridong
2025-12-26 18:58 ` Bing Jiao
2025-12-26 19:32 ` Waiman Long
` (2 subsequent siblings)
5 siblings, 1 reply; 54+ messages in thread
From: Chen Ridong @ 2025-12-24 1:49 UTC (permalink / raw)
To: Bing Jiao, linux-mm
Cc: linux-kernel, akpm, gourry, longman, hannes, mhocko,
roman.gushchin, shakeel.butt, muchun.song, tj, mkoutny, david,
zhengqi.arch, lorenzo.stoakes, axelrasmussen, yuanchu, weixugc,
cgroups
On 2025/12/24 5:19, Bing Jiao wrote:
> Fix two bugs in demote_folio_list() and can_demote() due to incorrect
> demotion target checks in reclaim/demotion.
>
> Commit 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
> introduces the cpuset.mems_effective check and applies it to
> can_demote(). However:
>
> 1. It does not apply this check in demote_folio_list(), which leads
> to situations where pages are demoted to nodes that are
> explicitly excluded from the task's cpuset.mems.
>
> 2. It checks only the nodes in the immediate next demotion hierarchy
> and does not check all allowed demotion targets in can_demote().
> This can cause pages to never be demoted if the nodes in the next
> demotion hierarchy are not set in mems_effective.
>
> These bugs break resource isolation provided by cpuset.mems.
> This is visible from userspace because pages can either fail to be
> demoted entirely or are demoted to nodes that are not allowed
> in multi-tier memory systems.
>
> To address these bugs, update cpuset_node_allowed() and
> mem_cgroup_node_allowed() to return effective_mems, allowing directly
> logic-and operation against demotion targets. Also update can_demote()
> and demote_folio_list() accordingly.
>
> Reproduct Bug 1:
> Assume a system with 4 nodes, where nodes 0-1 are top-tier and
> nodes 2-3 are far-tier memory. All nodes have equal capacity.
>
> Test script:
> echo 1 > /sys/kernel/mm/numa/demotion_enabled
> mkdir /sys/fs/cgroup/test
> echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
> echo "0-2" > /sys/fs/cgroup/test/cpuset.mems
> echo $$ > /sys/fs/cgroup/test/cgroup.procs
> swapoff -a
> # Expectation: Should respect node 0-2 limit.
> # Observation: Node 3 shows significant allocation (MemFree drops)
> stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1
>
> Reproduct Bug 2:
> Assume a system with 6 nodes, where nodes 0-2 are top-tier,
> node 3 is a far-tier node, and nodes 4-5 are the farthest-tier nodes.
> All nodes have equal capacity.
>
> Test script:
> echo 1 > /sys/kernel/mm/numa/demotion_enabled
> mkdir /sys/fs/cgroup/test
> echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
> echo "0-2,4-5" > /sys/fs/cgroup/test/cpuset.mems
> echo $$ > /sys/fs/cgroup/test/cgroup.procs
> swapoff -a
> # Expectation: Pages are demoted to Nodes 4-5
> # Observation: No pages are demoted before oom.
> stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1,2
>
> Fixes: 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Bing Jiao <bingjiao@google.com>
> ---
> include/linux/cpuset.h | 6 +++---
> include/linux/memcontrol.h | 6 +++---
> kernel/cgroup/cpuset.c | 16 ++++++++--------
> mm/memcontrol.c | 6 ++++--
> mm/vmscan.c | 35 +++++++++++++++++++++++------------
> 5 files changed, 41 insertions(+), 28 deletions(-)
>
> diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h
> index a98d3330385c..eb358c3aa9c0 100644
> --- a/include/linux/cpuset.h
> +++ b/include/linux/cpuset.h
> @@ -174,7 +174,7 @@ static inline void set_mems_allowed(nodemask_t nodemask)
> task_unlock(current);
> }
>
> -extern bool cpuset_node_allowed(struct cgroup *cgroup, int nid);
> +extern nodemask_t cpuset_node_get_allowed(struct cgroup *cgroup);
> #else /* !CONFIG_CPUSETS */
>
> static inline bool cpusets_enabled(void) { return false; }
> @@ -301,9 +301,9 @@ static inline bool read_mems_allowed_retry(unsigned int seq)
> return false;
> }
>
> -static inline bool cpuset_node_allowed(struct cgroup *cgroup, int nid)
> +static inline nodemask_t cpuset_node_get_allowed(struct cgroup *cgroup)
> {
> - return true;
> + return node_possible_map;
> }
> #endif /* !CONFIG_CPUSETS */
>
> diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
> index fd400082313a..f9463d853bba 100644
> --- a/include/linux/memcontrol.h
> +++ b/include/linux/memcontrol.h
> @@ -1740,7 +1740,7 @@ static inline void count_objcg_events(struct obj_cgroup *objcg,
> rcu_read_unlock();
> }
>
> -bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid);
> +nodemask_t mem_cgroup_node_get_allowed(struct mem_cgroup *memcg);
>
> void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg);
>
> @@ -1811,9 +1811,9 @@ static inline ino_t page_cgroup_ino(struct page *page)
> return 0;
> }
>
> -static inline bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid)
> +static inline nodemask_t mem_cgroup_node_get_allowed(struct mem_cgroup *memcg)
> {
> - return true;
> + return node_possible_map;
> }
>
> static inline void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg)
> diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
> index 6e6eb09b8db6..abb9afb64205 100644
> --- a/kernel/cgroup/cpuset.c
> +++ b/kernel/cgroup/cpuset.c
> @@ -4416,23 +4416,23 @@ bool cpuset_current_node_allowed(int node, gfp_t gfp_mask)
> return allowed;
> }
>
> -bool cpuset_node_allowed(struct cgroup *cgroup, int nid)
> +nodemask_t cpuset_node_get_allowed(struct cgroup *cgroup)
> {
Could we define it as:
void cpuset_node_get_allowed(struct cgroup *cgroup, nodemask_t *node)
to align with the naming style of node_get_allowed_targets?
> + nodemask_t nodes = node_possible_map;
> struct cgroup_subsys_state *css;
> struct cpuset *cs;
> - bool allowed;
>
> /*
> * In v1, mem_cgroup and cpuset are unlikely in the same hierarchy
> * and mems_allowed is likely to be empty even if we could get to it,
> - * so return true to avoid taking a global lock on the empty check.
> + * so return directly to avoid taking a global lock on the empty check.
> */
> - if (!cpuset_v2())
> - return true;
> + if (!cgroup || !cpuset_v2())
> + return nodes;
>
> css = cgroup_get_e_css(cgroup, &cpuset_cgrp_subsys);
> if (!css)
> - return true;
> + return nodes;
>
> /*
> * Normally, accessing effective_mems would require the cpuset_mutex
> @@ -4447,9 +4447,9 @@ bool cpuset_node_allowed(struct cgroup *cgroup, int nid)
> * cannot make strong isolation guarantees, so this is acceptable.
> */
> cs = container_of(css, struct cpuset, css);
> - allowed = node_isset(nid, cs->effective_mems);
> + nodes_copy(nodes, cs->effective_mems);
> css_put(css);
> - return allowed;
> + return nodes;
> }
>
> /**
> diff --git a/mm/memcontrol.c b/mm/memcontrol.c
> index 75fc22a33b28..c2f4ac50d5c2 100644
> --- a/mm/memcontrol.c
> +++ b/mm/memcontrol.c
> @@ -5597,9 +5597,11 @@ subsys_initcall(mem_cgroup_swap_init);
>
> #endif /* CONFIG_SWAP */
>
> -bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid)
> +nodemask_t mem_cgroup_node_get_allowed(struct mem_cgroup *memcg)
void mem_cgroup_node_get_allowed(struct mem_cgroup *memcg, nodemask_t *node)
> {
> - return memcg ? cpuset_node_allowed(memcg->css.cgroup, nid) : true;
> + if (memcg)
> + return cpuset_node_get_allowed(memcg->css.cgroup);
> + return node_possible_map;
> }
>
> void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg)
> diff --git a/mm/vmscan.c b/mm/vmscan.c
> index a4b308a2f9ad..711a04baf258 100644
> --- a/mm/vmscan.c
> +++ b/mm/vmscan.c
> @@ -345,18 +345,24 @@ static bool can_demote(int nid, struct scan_control *sc,
> struct mem_cgroup *memcg)
> {
> int demotion_nid;
> + struct pglist_data *pgdat = NODE_DATA(nid);
> + nodemask_t allowed_mask, allowed_mems;
>
> - if (!numa_demotion_enabled)
> + if (!pgdat || !numa_demotion_enabled)
> return false;
> if (sc && sc->no_demotion)
> return false;
>
> - demotion_nid = next_demotion_node(nid);
> - if (demotion_nid == NUMA_NO_NODE)
> + node_get_allowed_targets(pgdat, &allowed_mask);
> + if (nodes_empty(allowed_mask))
> + return false;
> +
> + allowed_mems = mem_cgroup_node_get_allowed(memcg);
> + nodes_and(allowed_mask, allowed_mask, allowed_mems);
> + if (nodes_empty(allowed_mask))
> return false;
>
node_get_allowed_targets(pgdat, &allowed_mask);
mem_cgroup_node_get_allowed(memcg, allowed_mems);
if (!nodes_intersects(allowed_mask, allowed_mems))
return false;
Would it look better?
> - /* If demotion node isn't in the cgroup's mems_allowed, fall back */
> - if (mem_cgroup_node_allowed(memcg, demotion_nid)) {
> + for_each_node_mask(demotion_nid, allowed_mask) {
> int z;
> struct zone *zone;
> struct pglist_data *pgdat = NODE_DATA(demotion_nid);
> @@ -1029,11 +1035,12 @@ static struct folio *alloc_demote_folio(struct folio *src,
> * Folios which are not demoted are left on @demote_folios.
> */
> static unsigned int demote_folio_list(struct list_head *demote_folios,
> - struct pglist_data *pgdat)
> + struct pglist_data *pgdat,
> + struct mem_cgroup *memcg)
> {
> int target_nid = next_demotion_node(pgdat->node_id);
> unsigned int nr_succeeded;
> - nodemask_t allowed_mask;
> + nodemask_t allowed_mask, allowed_mems;
>
> struct migration_target_control mtc = {
> /*
> @@ -1043,7 +1050,6 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
> */
> .gfp_mask = (GFP_HIGHUSER_MOVABLE & ~__GFP_RECLAIM) |
> __GFP_NOMEMALLOC | GFP_NOWAIT,
> - .nid = target_nid,
> .nmask = &allowed_mask,
> .reason = MR_DEMOTION,
> };
> @@ -1051,10 +1057,15 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
> if (list_empty(demote_folios))
> return 0;
>
> - if (target_nid == NUMA_NO_NODE)
> - return 0;
> -
> node_get_allowed_targets(pgdat, &allowed_mask);
> + allowed_mems = mem_cgroup_node_get_allowed(memcg);
> + nodes_and(allowed_mask, allowed_mask, allowed_mems);
> + if (nodes_empty(allowed_mask))
> + return false;
> +
> + if (target_nid == NUMA_NO_NODE || !node_isset(target_nid, allowed_mask))
> + target_nid = node_random(&allowed_mask);
> + mtc.nid = target_nid;
>
> /* Demotion ignores all cpuset and mempolicy settings */
> migrate_pages(demote_folios, alloc_demote_folio, NULL,
> @@ -1576,7 +1587,7 @@ static unsigned int shrink_folio_list(struct list_head *folio_list,
> /* 'folio_list' is always empty here */
>
> /* Migrate folios selected for demotion */
> - nr_demoted = demote_folio_list(&demote_folios, pgdat);
> + nr_demoted = demote_folio_list(&demote_folios, pgdat, memcg);
> nr_reclaimed += nr_demoted;
> stat->nr_demoted += nr_demoted;
> /* Folios that could not be demoted are still in @demote_folios */
> --
> 2.52.0.358.g0dd7633a29-goog
--
Best regards,
Ridong
^ permalink raw reply [flat|nested] 54+ messages in thread* Re: [PATCH v3] mm/vmscan: fix demotion targets checks in reclaim/demotion
2025-12-24 1:49 ` Chen Ridong
@ 2025-12-26 18:58 ` Bing Jiao
0 siblings, 0 replies; 54+ messages in thread
From: Bing Jiao @ 2025-12-26 18:58 UTC (permalink / raw)
To: Chen Ridong
Cc: linux-mm, linux-kernel, akpm, gourry, longman, hannes, mhocko,
roman.gushchin, shakeel.butt, muchun.song, tj, mkoutny, david,
zhengqi.arch, lorenzo.stoakes, axelrasmussen, yuanchu, weixugc,
cgroups
On Wed, Dec 24, 2025 at 09:49:38AM +0800, Chen Ridong wrote:
> > +nodemask_t cpuset_node_get_allowed(struct cgroup *cgroup)
> > {
>
> Could we define it as:
>
> void cpuset_node_get_allowed(struct cgroup *cgroup, nodemask_t *node)
>
> to align with the naming style of node_get_allowed_targets?
>
> > -bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid)
> > +nodemask_t mem_cgroup_node_get_allowed(struct mem_cgroup *memcg)
>
> void mem_cgroup_node_get_allowed(struct mem_cgroup *memcg, nodemask_t *node)
Thanks for the suggestion. Pass a pointer is better.
Also, Gregory mentioned that the stack size may be an issue if
systems have many nodes.
Do you think it is better to use mem_cgroup_node_filter_allowed()
to keep the stack size smaller?
> > - demotion_nid = next_demotion_node(nid);
> > - if (demotion_nid == NUMA_NO_NODE)
> > + node_get_allowed_targets(pgdat, &allowed_mask);
> > + if (nodes_empty(allowed_mask))
> > + return false;
This is a fast-fail path. When the queried node is the farthest node,
allowed_mask will be empty. Thus, I would like to keep this check
before mem_cgroup_node_get_allowed().
> > +
> > + allowed_mems = mem_cgroup_node_get_allowed(memcg);
> > + nodes_and(allowed_mask, allowed_mask, allowed_mems);
> > + if (nodes_empty(allowed_mask))
> > return false;
> >
> node_get_allowed_targets(pgdat, &allowed_mask);
> mem_cgroup_node_get_allowed(memcg, allowed_mems);
> if (!nodes_intersects(allowed_mask, allowed_mems))
> return false;
>
> Would it look better?
Yes, nodes_intersects() is better than logic-and.
Will update in v3.
Best,
Bing
^ permalink raw reply [flat|nested] 54+ messages in thread
* Re: [PATCH v3] mm/vmscan: fix demotion targets checks in reclaim/demotion
2025-12-23 21:19 ` [PATCH v3] mm/vmscan: fix demotion targets checks in reclaim/demotion Bing Jiao
` (2 preceding siblings ...)
2025-12-24 1:49 ` Chen Ridong
@ 2025-12-26 19:32 ` Waiman Long
2025-12-26 20:24 ` Waiman Long
2026-01-04 8:54 ` [PATCH v4] " Bing Jiao
5 siblings, 0 replies; 54+ messages in thread
From: Waiman Long @ 2025-12-26 19:32 UTC (permalink / raw)
To: Bing Jiao, linux-mm
Cc: linux-kernel, akpm, gourry, hannes, mhocko, roman.gushchin,
shakeel.butt, muchun.song, tj, mkoutny, david, zhengqi.arch,
lorenzo.stoakes, axelrasmussen, chenridong, yuanchu, weixugc,
cgroups
On 12/23/25 4:19 PM, Bing Jiao wrote:
> Fix two bugs in demote_folio_list() and can_demote() due to incorrect
> demotion target checks in reclaim/demotion.
>
> Commit 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
> introduces the cpuset.mems_effective check and applies it to
> can_demote(). However:
>
> 1. It does not apply this check in demote_folio_list(), which leads
> to situations where pages are demoted to nodes that are
> explicitly excluded from the task's cpuset.mems.
>
> 2. It checks only the nodes in the immediate next demotion hierarchy
> and does not check all allowed demotion targets in can_demote().
> This can cause pages to never be demoted if the nodes in the next
> demotion hierarchy are not set in mems_effective.
>
> These bugs break resource isolation provided by cpuset.mems.
> This is visible from userspace because pages can either fail to be
> demoted entirely or are demoted to nodes that are not allowed
> in multi-tier memory systems.
>
> To address these bugs, update cpuset_node_allowed() and
> mem_cgroup_node_allowed() to return effective_mems, allowing directly
> logic-and operation against demotion targets. Also update can_demote()
> and demote_folio_list() accordingly.
>
> Reproduct Bug 1:
"Reproduct" is not an English word. Use either "Reproduce" or
"Reproduction".
Cheers,
Longman
^ permalink raw reply [flat|nested] 54+ messages in thread* Re: [PATCH v3] mm/vmscan: fix demotion targets checks in reclaim/demotion
2025-12-23 21:19 ` [PATCH v3] mm/vmscan: fix demotion targets checks in reclaim/demotion Bing Jiao
` (3 preceding siblings ...)
2025-12-26 19:32 ` Waiman Long
@ 2025-12-26 20:24 ` Waiman Long
2026-01-04 9:04 ` Bing Jiao
2026-01-04 8:54 ` [PATCH v4] " Bing Jiao
5 siblings, 1 reply; 54+ messages in thread
From: Waiman Long @ 2025-12-26 20:24 UTC (permalink / raw)
To: Bing Jiao, linux-mm
Cc: linux-kernel, akpm, gourry, hannes, mhocko, roman.gushchin,
shakeel.butt, muchun.song, tj, mkoutny, david, zhengqi.arch,
lorenzo.stoakes, axelrasmussen, chenridong, yuanchu, weixugc,
cgroups
On 12/23/25 4:19 PM, Bing Jiao wrote:
> Fix two bugs in demote_folio_list() and can_demote() due to incorrect
> demotion target checks in reclaim/demotion.
>
> Commit 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
> introduces the cpuset.mems_effective check and applies it to
> can_demote(). However:
>
> 1. It does not apply this check in demote_folio_list(), which leads
> to situations where pages are demoted to nodes that are
> explicitly excluded from the task's cpuset.mems.
>
> 2. It checks only the nodes in the immediate next demotion hierarchy
> and does not check all allowed demotion targets in can_demote().
> This can cause pages to never be demoted if the nodes in the next
> demotion hierarchy are not set in mems_effective.
>
> These bugs break resource isolation provided by cpuset.mems.
> This is visible from userspace because pages can either fail to be
> demoted entirely or are demoted to nodes that are not allowed
> in multi-tier memory systems.
>
> To address these bugs, update cpuset_node_allowed() and
> mem_cgroup_node_allowed() to return effective_mems, allowing directly
> logic-and operation against demotion targets. Also update can_demote()
> and demote_folio_list() accordingly.
>
> Reproduct Bug 1:
> Assume a system with 4 nodes, where nodes 0-1 are top-tier and
> nodes 2-3 are far-tier memory. All nodes have equal capacity.
>
> Test script:
> echo 1 > /sys/kernel/mm/numa/demotion_enabled
> mkdir /sys/fs/cgroup/test
> echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
> echo "0-2" > /sys/fs/cgroup/test/cpuset.mems
> echo $$ > /sys/fs/cgroup/test/cgroup.procs
> swapoff -a
> # Expectation: Should respect node 0-2 limit.
> # Observation: Node 3 shows significant allocation (MemFree drops)
> stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1
>
> Reproduct Bug 2:
> Assume a system with 6 nodes, where nodes 0-2 are top-tier,
> node 3 is a far-tier node, and nodes 4-5 are the farthest-tier nodes.
> All nodes have equal capacity.
>
> Test script:
> echo 1 > /sys/kernel/mm/numa/demotion_enabled
> mkdir /sys/fs/cgroup/test
> echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
> echo "0-2,4-5" > /sys/fs/cgroup/test/cpuset.mems
> echo $$ > /sys/fs/cgroup/test/cgroup.procs
> swapoff -a
> # Expectation: Pages are demoted to Nodes 4-5
> # Observation: No pages are demoted before oom.
> stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1,2
>
> Fixes: 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Bing Jiao <bingjiao@google.com>
> ---
> include/linux/cpuset.h | 6 +++---
> include/linux/memcontrol.h | 6 +++---
> kernel/cgroup/cpuset.c | 16 ++++++++--------
> mm/memcontrol.c | 6 ++++--
> mm/vmscan.c | 35 +++++++++++++++++++++++------------
> 5 files changed, 41 insertions(+), 28 deletions(-)
>
> diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h
> index a98d3330385c..eb358c3aa9c0 100644
> --- a/include/linux/cpuset.h
> +++ b/include/linux/cpuset.h
> @@ -174,7 +174,7 @@ static inline void set_mems_allowed(nodemask_t nodemask)
> task_unlock(current);
> }
>
> -extern bool cpuset_node_allowed(struct cgroup *cgroup, int nid);
> +extern nodemask_t cpuset_node_get_allowed(struct cgroup *cgroup);
> #else /* !CONFIG_CPUSETS */
>
> static inline bool cpusets_enabled(void) { return false; }
> @@ -301,9 +301,9 @@ static inline bool read_mems_allowed_retry(unsigned int seq)
> return false;
> }
>
> -static inline bool cpuset_node_allowed(struct cgroup *cgroup, int nid)
> +static inline nodemask_t cpuset_node_get_allowed(struct cgroup *cgroup)
> {
> - return true;
> + return node_possible_map;
> }
The nodemask_t type can be large depending on the setting of
CONFIG_NODES_SHIFT. Passing a large data structure on stack may not be a
good idea. You can return a pointer to nodemask_t instead. In that case,
you will have a add a "const" qualifier to the return type to make sure
that the node mask won't get accidentally modified. Alternatively, you
can pass a nodemask_t pointer as an output parameter and copy out the
nodemask_t data.
The name "cpuset_node_get_allowed" doesn't fit the cpuset naming
convention. There is a "cpuset_mems_allowed(struct task_struct *)" to
return "mems_allowed" of a task. This new helper is for returning the
mems_allowed defined in the cpuset. Perhaps we could just use
"cpuset_nodes_allowed(struct cgroup *)".
Cheers,
Longman
^ permalink raw reply [flat|nested] 54+ messages in thread* Re: [PATCH v3] mm/vmscan: fix demotion targets checks in reclaim/demotion
2025-12-26 20:24 ` Waiman Long
@ 2026-01-04 9:04 ` Bing Jiao
0 siblings, 0 replies; 54+ messages in thread
From: Bing Jiao @ 2026-01-04 9:04 UTC (permalink / raw)
To: Waiman Long
Cc: linux-mm, linux-kernel, akpm, gourry, hannes, mhocko,
roman.gushchin, shakeel.butt, muchun.song, tj, mkoutny, david,
zhengqi.arch, lorenzo.stoakes, axelrasmussen, chenridong, yuanchu,
weixugc, cgroups
On Fri, Dec 26, 2025 at 03:24:29PM -0500, Waiman Long wrote:
> The nodemask_t type can be large depending on the setting of
> CONFIG_NODES_SHIFT. Passing a large data structure on stack may not be a
> good idea. You can return a pointer to nodemask_t instead. In that case, you
> will have a add a "const" qualifier to the return type to make sure that the
> node mask won't get accidentally modified. Alternatively, you can pass a
> nodemask_t pointer as an output parameter and copy out the nodemask_t data.
>
> The name "cpuset_node_get_allowed" doesn't fit the cpuset naming convention.
> There is a "cpuset_mems_allowed(struct task_struct *)" to return
> "mems_allowed" of a task. This new helper is for returning the mems_allowed
> defined in the cpuset. Perhaps we could just use
> "cpuset_nodes_allowed(struct cgroup *)".
>
> Cheers,
> Longman
Thank you for the explanation and suggestion.
I have updated v4, which updates the functions to filter out nodes
rather than returning mems_allowed. In v3, the caller need to declare
a temp nodemask_t to store mems_allowed and then intersect with
lower-tier nodemask, which is unnecessarily increase the stack size.
The function name is updated as "cpuset_nodes_filter_allowed".
Do you think it is still better to use "cpuset_nodes_allowed"
when doing the filtering thing?
Thanks,
Bing
^ permalink raw reply [flat|nested] 54+ messages in thread
* [PATCH v4] mm/vmscan: fix demotion targets checks in reclaim/demotion
2025-12-23 21:19 ` [PATCH v3] mm/vmscan: fix demotion targets checks in reclaim/demotion Bing Jiao
` (4 preceding siblings ...)
2025-12-26 20:24 ` Waiman Long
@ 2026-01-04 8:54 ` Bing Jiao
2026-01-04 18:27 ` Andrew Morton
` (2 more replies)
5 siblings, 3 replies; 54+ messages in thread
From: Bing Jiao @ 2026-01-04 8:54 UTC (permalink / raw)
To: linux-mm
Cc: linux-kernel, akpm, gourry, longman, hannes, mhocko,
roman.gushchin, shakeel.butt, muchun.song, tj, mkoutny, david,
zhengqi.arch, lorenzo.stoakes, axelrasmussen, chenridong, yuanchu,
weixugc, cgroups, bingjiao
Fix two bugs in demote_folio_list() and can_demote() due to incorrect
demotion target checks in reclaim/demotion.
Commit 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
introduces the cpuset.mems_effective check and applies it to
can_demote(). However:
1. It does not apply this check in demote_folio_list(), which leads
to situations where pages are demoted to nodes that are
explicitly excluded from the task's cpuset.mems.
2. It checks only the nodes in the immediate next demotion hierarchy
and does not check all allowed demotion targets in can_demote().
This can cause pages to never be demoted if the nodes in the next
demotion hierarchy are not set in mems_effective.
These bugs break resource isolation provided by cpuset.mems.
This is visible from userspace because pages can either fail to be
demoted entirely or are demoted to nodes that are not allowed
in multi-tier memory systems.
To address these bugs, update cpuset_node_allowed() and
mem_cgroup_node_allowed() to return effective_mems, allowing directly
logic-and operation against demotion targets. Also update can_demote()
and demote_folio_list() accordingly.
Bug 1 reproduction:
Assume a system with 4 nodes, where nodes 0-1 are top-tier and
nodes 2-3 are far-tier memory. All nodes have equal capacity.
Test script:
echo 1 > /sys/kernel/mm/numa/demotion_enabled
mkdir /sys/fs/cgroup/test
echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
echo "0-2" > /sys/fs/cgroup/test/cpuset.mems
echo $$ > /sys/fs/cgroup/test/cgroup.procs
swapoff -a
# Expectation: Should respect node 0-2 limit.
# Observation: Node 3 shows significant allocation (MemFree drops)
stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1
Bug 2 reproduction:
Assume a system with 6 nodes, where nodes 0-2 are top-tier,
node 3 is a far-tier node, and nodes 4-5 are the farthest-tier nodes.
All nodes have equal capacity.
Test script:
echo 1 > /sys/kernel/mm/numa/demotion_enabled
mkdir /sys/fs/cgroup/test
echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
echo "0-2,4-5" > /sys/fs/cgroup/test/cpuset.mems
echo $$ > /sys/fs/cgroup/test/cgroup.procs
swapoff -a
# Expectation: Pages are demoted to Nodes 4-5
# Observation: No pages are demoted before oom.
stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1,2
Fixes: 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
Cc: <stable@vger.kernel.org>
Signed-off-by: Bing Jiao <bingjiao@google.com>
---
v3 -> v4:
Update functions to filter out nodes that are not in cgroup's
mems_allowed rather than returning mems_allowed directly.
It minimizes stack usage and remains versatile enough to return
mems_allowed when all possible nodes are set in the passed
nodemask_t pointer.
---
include/linux/cpuset.h | 7 ++++---
include/linux/memcontrol.h | 6 +++---
kernel/cgroup/cpuset.c | 24 +++++++++++++++---------
mm/memcontrol.c | 5 +++--
mm/vmscan.c | 32 +++++++++++++++++++++-----------
5 files changed, 46 insertions(+), 28 deletions(-)
diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h
index a98d3330385c..c937537f318a 100644
--- a/include/linux/cpuset.h
+++ b/include/linux/cpuset.h
@@ -174,7 +174,8 @@ static inline void set_mems_allowed(nodemask_t nodemask)
task_unlock(current);
}
-extern bool cpuset_node_allowed(struct cgroup *cgroup, int nid);
+extern void cpuset_nodes_filter_allowed(struct cgroup *cgroup,
+ nodemask_t *mask);
#else /* !CONFIG_CPUSETS */
static inline bool cpusets_enabled(void) { return false; }
@@ -301,9 +302,9 @@ static inline bool read_mems_allowed_retry(unsigned int seq)
return false;
}
-static inline bool cpuset_node_allowed(struct cgroup *cgroup, int nid)
+static inline void cpuset_nodes_filter_allowed(struct cgroup *cgroup,
+ nodemask_t *mask)
{
- return true;
}
#endif /* !CONFIG_CPUSETS */
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index fd400082313a..911e0c71453e 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -1740,7 +1740,7 @@ static inline void count_objcg_events(struct obj_cgroup *objcg,
rcu_read_unlock();
}
-bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid);
+void mem_cgroup_node_filter_allowed(struct mem_cgroup *memcg, nodemask_t *mask);
void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg);
@@ -1811,9 +1811,9 @@ static inline ino_t page_cgroup_ino(struct page *page)
return 0;
}
-static inline bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid)
+static inline void mem_cgroup_node_filter_allowed(struct mem_cgroup *memcg,
+ nodemask_t *mask)
{
- return true;
}
static inline void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg)
diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index 6e6eb09b8db6..cc0e1d42611c 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -4416,27 +4416,34 @@ bool cpuset_current_node_allowed(int node, gfp_t gfp_mask)
return allowed;
}
-bool cpuset_node_allowed(struct cgroup *cgroup, int nid)
+/**
+ * cpuset_nodes_filter_allowed - filter out nodes not in cgroup's mems_allowed.
+ * @cgroup: pointer to struct cgroup.
+ * @mask: pointer to struct nodemask_t to be filtered.
+ *
+ * Description: Filters out nodes that are not in mems_allowed for @cgroup.
+ * Nodes returned in @mask are not guaranteed to be online.
+ **/
+void cpuset_nodes_filter_allowed(struct cgroup *cgroup, nodemask_t *mask)
{
struct cgroup_subsys_state *css;
struct cpuset *cs;
- bool allowed;
/*
* In v1, mem_cgroup and cpuset are unlikely in the same hierarchy
* and mems_allowed is likely to be empty even if we could get to it,
- * so return true to avoid taking a global lock on the empty check.
+ * so return directly to avoid taking a global lock on the empty check.
*/
- if (!cpuset_v2())
- return true;
+ if (!cgroup || !cpuset_v2())
+ return;
css = cgroup_get_e_css(cgroup, &cpuset_cgrp_subsys);
if (!css)
- return true;
+ return;
/*
* Normally, accessing effective_mems would require the cpuset_mutex
- * or callback_lock - but node_isset is atomic and the reference
+ * or callback_lock - but not doing so is acceptable and the reference
* taken via cgroup_get_e_css is sufficient to protect css.
*
* Since this interface is intended for use by migration paths, we
@@ -4447,9 +4454,8 @@ bool cpuset_node_allowed(struct cgroup *cgroup, int nid)
* cannot make strong isolation guarantees, so this is acceptable.
*/
cs = container_of(css, struct cpuset, css);
- allowed = node_isset(nid, cs->effective_mems);
+ nodes_and(*mask, *mask, cs->effective_mems);
css_put(css);
- return allowed;
}
/**
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 75fc22a33b28..4c850805b7a9 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -5597,9 +5597,10 @@ subsys_initcall(mem_cgroup_swap_init);
#endif /* CONFIG_SWAP */
-bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid)
+void mem_cgroup_node_filter_allowed(struct mem_cgroup *memcg, nodemask_t *mask)
{
- return memcg ? cpuset_node_allowed(memcg->css.cgroup, nid) : true;
+ if (memcg)
+ cpuset_nodes_filter_allowed(memcg->css.cgroup, mask);
}
void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg)
diff --git a/mm/vmscan.c b/mm/vmscan.c
index ac16b6b984ab..919e116ddaf3 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -345,18 +345,24 @@ static bool can_demote(int nid, struct scan_control *sc,
struct mem_cgroup *memcg)
{
int demotion_nid;
+ struct pglist_data *pgdat = NODE_DATA(nid);
+ nodemask_t allowed_mask;
- if (!numa_demotion_enabled)
+ if (!pgdat || !numa_demotion_enabled)
return false;
if (sc && sc->no_demotion)
return false;
- demotion_nid = next_demotion_node(nid);
- if (demotion_nid == NUMA_NO_NODE)
+ node_get_allowed_targets(pgdat, &allowed_mask);
+ if (nodes_empty(allowed_mask))
+ return false;
+
+ /* Filter out nodes that are not in cgroup's mems_allowed. */
+ mem_cgroup_node_filter_allowed(memcg, &allowed_mask);
+ if (nodes_empty(allowed_mask))
return false;
- /* If demotion node isn't in the cgroup's mems_allowed, fall back */
- if (mem_cgroup_node_allowed(memcg, demotion_nid)) {
+ for_each_node_mask(demotion_nid, allowed_mask) {
int z;
struct zone *zone;
struct pglist_data *pgdat = NODE_DATA(demotion_nid);
@@ -1029,7 +1035,8 @@ static struct folio *alloc_demote_folio(struct folio *src,
* Folios which are not demoted are left on @demote_folios.
*/
static unsigned int demote_folio_list(struct list_head *demote_folios,
- struct pglist_data *pgdat)
+ struct pglist_data *pgdat,
+ struct mem_cgroup *memcg)
{
int target_nid = next_demotion_node(pgdat->node_id);
unsigned int nr_succeeded;
@@ -1043,7 +1050,6 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
*/
.gfp_mask = (GFP_HIGHUSER_MOVABLE & ~__GFP_RECLAIM) |
__GFP_NOMEMALLOC | GFP_NOWAIT,
- .nid = target_nid,
.nmask = &allowed_mask,
.reason = MR_DEMOTION,
};
@@ -1051,10 +1057,14 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
if (list_empty(demote_folios))
return 0;
- if (target_nid == NUMA_NO_NODE)
- return 0;
-
node_get_allowed_targets(pgdat, &allowed_mask);
+ mem_cgroup_node_filter_allowed(memcg, &allowed_mask);
+ if (nodes_empty(allowed_mask))
+ return false;
+
+ if (!node_isset(target_nid, allowed_mask))
+ target_nid = node_random(&allowed_mask);
+ mtc.nid = target_nid;
/* Demotion ignores all cpuset and mempolicy settings */
migrate_pages(demote_folios, alloc_demote_folio, NULL,
@@ -1576,7 +1586,7 @@ static unsigned int shrink_folio_list(struct list_head *folio_list,
/* 'folio_list' is always empty here */
/* Migrate folios selected for demotion */
- nr_demoted = demote_folio_list(&demote_folios, pgdat);
+ nr_demoted = demote_folio_list(&demote_folios, pgdat, memcg);
nr_reclaimed += nr_demoted;
stat->nr_demoted += nr_demoted;
/* Folios that could not be demoted are still in @demote_folios */
--
2.52.0.358.g0dd7633a29-goog
^ permalink raw reply related [flat|nested] 54+ messages in thread* Re: [PATCH v4] mm/vmscan: fix demotion targets checks in reclaim/demotion
2026-01-04 8:54 ` [PATCH v4] " Bing Jiao
@ 2026-01-04 18:27 ` Andrew Morton
2026-01-05 5:08 ` Bing Jiao
2026-01-05 2:48 ` Chen Ridong
2026-01-05 5:01 ` [PATCH v5] " Bing Jiao
2 siblings, 1 reply; 54+ messages in thread
From: Andrew Morton @ 2026-01-04 18:27 UTC (permalink / raw)
To: Bing Jiao
Cc: linux-mm, linux-kernel, gourry, longman, hannes, mhocko,
roman.gushchin, shakeel.butt, muchun.song, tj, mkoutny, david,
zhengqi.arch, lorenzo.stoakes, axelrasmussen, chenridong, yuanchu,
weixugc, cgroups, Akinobu Mita
On Sun, 4 Jan 2026 08:54:05 +0000 Bing Jiao <bingjiao@google.com> wrote:
> Fix two bugs in demote_folio_list() and can_demote() due to incorrect
> demotion target checks in reclaim/demotion.
Thanks.
> Commit 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
> introduces the cpuset.mems_effective check and applies it to
> can_demote(). However:
>
> 1. It does not apply this check in demote_folio_list(), which leads
> to situations where pages are demoted to nodes that are
> explicitly excluded from the task's cpuset.mems.
>
> 2. It checks only the nodes in the immediate next demotion hierarchy
> and does not check all allowed demotion targets in can_demote().
> This can cause pages to never be demoted if the nodes in the next
> demotion hierarchy are not set in mems_effective.
>
> These bugs break resource isolation provided by cpuset.mems.
> This is visible from userspace because pages can either fail to be
> demoted entirely or are demoted to nodes that are not allowed
> in multi-tier memory systems.
>
> To address these bugs, update cpuset_node_allowed() and
> mem_cgroup_node_allowed() to return effective_mems, allowing directly
> logic-and operation against demotion targets. Also update can_demote()
> and demote_folio_list() accordingly.
>
> Bug 1 reproduction:
> Assume a system with 4 nodes, where nodes 0-1 are top-tier and
> nodes 2-3 are far-tier memory. All nodes have equal capacity.
>
> Test script:
> echo 1 > /sys/kernel/mm/numa/demotion_enabled
> mkdir /sys/fs/cgroup/test
> echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
> echo "0-2" > /sys/fs/cgroup/test/cpuset.mems
> echo $$ > /sys/fs/cgroup/test/cgroup.procs
> swapoff -a
> # Expectation: Should respect node 0-2 limit.
> # Observation: Node 3 shows significant allocation (MemFree drops)
> stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1
>
> Bug 2 reproduction:
> Assume a system with 6 nodes, where nodes 0-2 are top-tier,
> node 3 is a far-tier node, and nodes 4-5 are the farthest-tier nodes.
> All nodes have equal capacity.
>
> Test script:
> echo 1 > /sys/kernel/mm/numa/demotion_enabled
> mkdir /sys/fs/cgroup/test
> echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
> echo "0-2,4-5" > /sys/fs/cgroup/test/cpuset.mems
> echo $$ > /sys/fs/cgroup/test/cgroup.procs
> swapoff -a
> # Expectation: Pages are demoted to Nodes 4-5
> # Observation: No pages are demoted before oom.
> stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1,2
>
> Fixes: 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
> Cc: <stable@vger.kernel.org>
We'll want to fix these things in 6.16.X and later, but you've prepared
this patch against "mm/vmscan: don't demote if there is not enough free
memory in the lower memory tier", which is presently under test/review
in mm.git's mm-unstable branch.
This seems to be incorrect ordering - this fix should go ahead of
Akinobu Mita's series "mm: fix oom-killer not being invoked when
demotion is enabled v2".
So can you please redo this patch against current mainline? And please
also review the "mm: fix oom-killer not being invoked when demotion is
enabled" series to ensure that things will work together nicely when
that time comes.
^ permalink raw reply [flat|nested] 54+ messages in thread* Re: [PATCH v4] mm/vmscan: fix demotion targets checks in reclaim/demotion
2026-01-04 18:27 ` Andrew Morton
@ 2026-01-05 5:08 ` Bing Jiao
0 siblings, 0 replies; 54+ messages in thread
From: Bing Jiao @ 2026-01-05 5:08 UTC (permalink / raw)
To: Andrew Morton
Cc: linux-mm, linux-kernel, gourry, longman, hannes, mhocko,
roman.gushchin, shakeel.butt, muchun.song, tj, mkoutny, david,
zhengqi.arch, lorenzo.stoakes, axelrasmussen, chenridong, yuanchu,
weixugc, cgroups, Akinobu Mita
On Sun, Jan 04, 2026 at 10:27:45AM -0800, Andrew Morton wrote:
> We'll want to fix these things in 6.16.X and later, but you've prepared
> this patch against "mm/vmscan: don't demote if there is not enough free
> memory in the lower memory tier", which is presently under test/review
> in mm.git's mm-unstable branch.
>
> This seems to be incorrect ordering - this fix should go ahead of
> Akinobu Mita's series "mm: fix oom-killer not being invoked when
> demotion is enabled v2".
>
> So can you please redo this patch against current mainline? And please
> also review the "mm: fix oom-killer not being invoked when demotion is
> enabled" series to ensure that things will work together nicely when
> that time comes.
Hi Andrew,
Thank you for the detailed explanation. Patch v4 has been sent.
V4 is patched against the mainline. Tested on both the mainline and
mm-everything (after Akinobu Mita's series "mm: fix oom-killer not
being invoked when demotion is enabled v2"), and passed.
Best,
Bing
^ permalink raw reply [flat|nested] 54+ messages in thread
* Re: [PATCH v4] mm/vmscan: fix demotion targets checks in reclaim/demotion
2026-01-04 8:54 ` [PATCH v4] " Bing Jiao
2026-01-04 18:27 ` Andrew Morton
@ 2026-01-05 2:48 ` Chen Ridong
2026-01-05 5:10 ` Bing Jiao
2026-01-05 5:01 ` [PATCH v5] " Bing Jiao
2 siblings, 1 reply; 54+ messages in thread
From: Chen Ridong @ 2026-01-05 2:48 UTC (permalink / raw)
To: Bing Jiao, linux-mm
Cc: linux-kernel, akpm, gourry, longman, hannes, mhocko,
roman.gushchin, shakeel.butt, muchun.song, tj, mkoutny, david,
zhengqi.arch, lorenzo.stoakes, axelrasmussen, yuanchu, weixugc,
cgroups
On 2026/1/4 16:54, Bing Jiao wrote:
> Fix two bugs in demote_folio_list() and can_demote() due to incorrect
> demotion target checks in reclaim/demotion.
>
> Commit 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
> introduces the cpuset.mems_effective check and applies it to
> can_demote(). However:
>
> 1. It does not apply this check in demote_folio_list(), which leads
> to situations where pages are demoted to nodes that are
> explicitly excluded from the task's cpuset.mems.
>
> 2. It checks only the nodes in the immediate next demotion hierarchy
> and does not check all allowed demotion targets in can_demote().
> This can cause pages to never be demoted if the nodes in the next
> demotion hierarchy are not set in mems_effective.
>
> These bugs break resource isolation provided by cpuset.mems.
> This is visible from userspace because pages can either fail to be
> demoted entirely or are demoted to nodes that are not allowed
> in multi-tier memory systems.
>
> To address these bugs, update cpuset_node_allowed() and
> mem_cgroup_node_allowed() to return effective_mems, allowing directly
> logic-and operation against demotion targets. Also update can_demote()
> and demote_folio_list() accordingly.
>
> Bug 1 reproduction:
> Assume a system with 4 nodes, where nodes 0-1 are top-tier and
> nodes 2-3 are far-tier memory. All nodes have equal capacity.
>
> Test script:
> echo 1 > /sys/kernel/mm/numa/demotion_enabled
> mkdir /sys/fs/cgroup/test
> echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
> echo "0-2" > /sys/fs/cgroup/test/cpuset.mems
> echo $$ > /sys/fs/cgroup/test/cgroup.procs
> swapoff -a
> # Expectation: Should respect node 0-2 limit.
> # Observation: Node 3 shows significant allocation (MemFree drops)
> stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1
>
> Bug 2 reproduction:
> Assume a system with 6 nodes, where nodes 0-2 are top-tier,
> node 3 is a far-tier node, and nodes 4-5 are the farthest-tier nodes.
> All nodes have equal capacity.
>
> Test script:
> echo 1 > /sys/kernel/mm/numa/demotion_enabled
> mkdir /sys/fs/cgroup/test
> echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
> echo "0-2,4-5" > /sys/fs/cgroup/test/cpuset.mems
> echo $$ > /sys/fs/cgroup/test/cgroup.procs
> swapoff -a
> # Expectation: Pages are demoted to Nodes 4-5
> # Observation: No pages are demoted before oom.
> stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1,2
>
> Fixes: 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Bing Jiao <bingjiao@google.com>
>
> ---
> v3 -> v4:
> Update functions to filter out nodes that are not in cgroup's
> mems_allowed rather than returning mems_allowed directly.
> It minimizes stack usage and remains versatile enough to return
> mems_allowed when all possible nodes are set in the passed
> nodemask_t pointer.
> ---
>
> include/linux/cpuset.h | 7 ++++---
> include/linux/memcontrol.h | 6 +++---
> kernel/cgroup/cpuset.c | 24 +++++++++++++++---------
> mm/memcontrol.c | 5 +++--
> mm/vmscan.c | 32 +++++++++++++++++++++-----------
> 5 files changed, 46 insertions(+), 28 deletions(-)
>
> diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h
> index a98d3330385c..c937537f318a 100644
> --- a/include/linux/cpuset.h
> +++ b/include/linux/cpuset.h
> @@ -174,7 +174,8 @@ static inline void set_mems_allowed(nodemask_t nodemask)
> task_unlock(current);
> }
>
> -extern bool cpuset_node_allowed(struct cgroup *cgroup, int nid);
> +extern void cpuset_nodes_filter_allowed(struct cgroup *cgroup,
> + nodemask_t *mask);
> #else /* !CONFIG_CPUSETS */
>
> static inline bool cpusets_enabled(void) { return false; }
> @@ -301,9 +302,9 @@ static inline bool read_mems_allowed_retry(unsigned int seq)
> return false;
> }
>
> -static inline bool cpuset_node_allowed(struct cgroup *cgroup, int nid)
> +static inline void cpuset_nodes_filter_allowed(struct cgroup *cgroup,
> + nodemask_t *mask)
> {
> - return true;
> }
> #endif /* !CONFIG_CPUSETS */
>
> diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
> index fd400082313a..911e0c71453e 100644
> --- a/include/linux/memcontrol.h
> +++ b/include/linux/memcontrol.h
> @@ -1740,7 +1740,7 @@ static inline void count_objcg_events(struct obj_cgroup *objcg,
> rcu_read_unlock();
> }
>
> -bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid);
> +void mem_cgroup_node_filter_allowed(struct mem_cgroup *memcg, nodemask_t *mask);
>
> void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg);
>
> @@ -1811,9 +1811,9 @@ static inline ino_t page_cgroup_ino(struct page *page)
> return 0;
> }
>
> -static inline bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid)
> +static inline void mem_cgroup_node_filter_allowed(struct mem_cgroup *memcg,
> + nodemask_t *mask)
> {
> - return true;
> }
>
> static inline void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg)
> diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
> index 6e6eb09b8db6..cc0e1d42611c 100644
> --- a/kernel/cgroup/cpuset.c
> +++ b/kernel/cgroup/cpuset.c
> @@ -4416,27 +4416,34 @@ bool cpuset_current_node_allowed(int node, gfp_t gfp_mask)
> return allowed;
> }
>
> -bool cpuset_node_allowed(struct cgroup *cgroup, int nid)
> +/**
> + * cpuset_nodes_filter_allowed - filter out nodes not in cgroup's mems_allowed.
> + * @cgroup: pointer to struct cgroup.
> + * @mask: pointer to struct nodemask_t to be filtered.
> + *
> + * Description: Filters out nodes that are not in mems_allowed for @cgroup.
> + * Nodes returned in @mask are not guaranteed to be online.
> + **/
> +void cpuset_nodes_filter_allowed(struct cgroup *cgroup, nodemask_t *mask)
> {
> struct cgroup_subsys_state *css;
> struct cpuset *cs;
> - bool allowed;
>
> /*
> * In v1, mem_cgroup and cpuset are unlikely in the same hierarchy
> * and mems_allowed is likely to be empty even if we could get to it,
> - * so return true to avoid taking a global lock on the empty check.
> + * so return directly to avoid taking a global lock on the empty check.
> */
> - if (!cpuset_v2())
> - return true;
> + if (!cgroup || !cpuset_v2())
> + return;
>
> css = cgroup_get_e_css(cgroup, &cpuset_cgrp_subsys);
> if (!css)
> - return true;
> + return;
>
> /*
> * Normally, accessing effective_mems would require the cpuset_mutex
> - * or callback_lock - but node_isset is atomic and the reference
> + * or callback_lock - but not doing so is acceptable and the reference
> * taken via cgroup_get_e_css is sufficient to protect css.
> *
> * Since this interface is intended for use by migration paths, we
> @@ -4447,9 +4454,8 @@ bool cpuset_node_allowed(struct cgroup *cgroup, int nid)
> * cannot make strong isolation guarantees, so this is acceptable.
> */
> cs = container_of(css, struct cpuset, css);
> - allowed = node_isset(nid, cs->effective_mems);
> + nodes_and(*mask, *mask, cs->effective_mems);
Why do we need the and operation? Can't we just copy cs->effective_mems to mask directly?
Per Longman's suggestion, name it cpuset_nodes_allowed and handle the filtering in
mem_cgroup_node_filter_allowed. Please keep the allowed nodes retrieval logic common.
> css_put(css);
> - return allowed;
> }
>
> /**
> diff --git a/mm/memcontrol.c b/mm/memcontrol.c
> index 75fc22a33b28..4c850805b7a9 100644
> --- a/mm/memcontrol.c
> +++ b/mm/memcontrol.c
> @@ -5597,9 +5597,10 @@ subsys_initcall(mem_cgroup_swap_init);
>
> #endif /* CONFIG_SWAP */
>
> -bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid)
> +void mem_cgroup_node_filter_allowed(struct mem_cgroup *memcg, nodemask_t *mask)
> {
> - return memcg ? cpuset_node_allowed(memcg->css.cgroup, nid) : true;
> + if (memcg)
> + cpuset_nodes_filter_allowed(memcg->css.cgroup, mask);
> }
>
> void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg)
> diff --git a/mm/vmscan.c b/mm/vmscan.c
> index ac16b6b984ab..919e116ddaf3 100644
> --- a/mm/vmscan.c
> +++ b/mm/vmscan.c
> @@ -345,18 +345,24 @@ static bool can_demote(int nid, struct scan_control *sc,
> struct mem_cgroup *memcg)
> {
> int demotion_nid;
> + struct pglist_data *pgdat = NODE_DATA(nid);
> + nodemask_t allowed_mask;
>
> - if (!numa_demotion_enabled)
> + if (!pgdat || !numa_demotion_enabled)
> return false;
> if (sc && sc->no_demotion)
> return false;
>
> - demotion_nid = next_demotion_node(nid);
> - if (demotion_nid == NUMA_NO_NODE)
> + node_get_allowed_targets(pgdat, &allowed_mask);
> + if (nodes_empty(allowed_mask))
> + return false;
> +
> + /* Filter out nodes that are not in cgroup's mems_allowed. */
> + mem_cgroup_node_filter_allowed(memcg, &allowed_mask);
> + if (nodes_empty(allowed_mask))
> return false;
>
> - /* If demotion node isn't in the cgroup's mems_allowed, fall back */
> - if (mem_cgroup_node_allowed(memcg, demotion_nid)) {
> + for_each_node_mask(demotion_nid, allowed_mask) {
> int z;
> struct zone *zone;
> struct pglist_data *pgdat = NODE_DATA(demotion_nid);
> @@ -1029,7 +1035,8 @@ static struct folio *alloc_demote_folio(struct folio *src,
> * Folios which are not demoted are left on @demote_folios.
> */
> static unsigned int demote_folio_list(struct list_head *demote_folios,
> - struct pglist_data *pgdat)
> + struct pglist_data *pgdat,
> + struct mem_cgroup *memcg)
> {
> int target_nid = next_demotion_node(pgdat->node_id);
> unsigned int nr_succeeded;
> @@ -1043,7 +1050,6 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
> */
> .gfp_mask = (GFP_HIGHUSER_MOVABLE & ~__GFP_RECLAIM) |
> __GFP_NOMEMALLOC | GFP_NOWAIT,
> - .nid = target_nid,
> .nmask = &allowed_mask,
> .reason = MR_DEMOTION,
> };
> @@ -1051,10 +1057,14 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
> if (list_empty(demote_folios))
> return 0;
>
> - if (target_nid == NUMA_NO_NODE)
> - return 0;
> -
> node_get_allowed_targets(pgdat, &allowed_mask);
> + mem_cgroup_node_filter_allowed(memcg, &allowed_mask);
> + if (nodes_empty(allowed_mask))
> + return false;
> +
> + if (!node_isset(target_nid, allowed_mask))
> + target_nid = node_random(&allowed_mask);
> + mtc.nid = target_nid;
>
> /* Demotion ignores all cpuset and mempolicy settings */
> migrate_pages(demote_folios, alloc_demote_folio, NULL,
> @@ -1576,7 +1586,7 @@ static unsigned int shrink_folio_list(struct list_head *folio_list,
> /* 'folio_list' is always empty here */
>
> /* Migrate folios selected for demotion */
> - nr_demoted = demote_folio_list(&demote_folios, pgdat);
> + nr_demoted = demote_folio_list(&demote_folios, pgdat, memcg);
> nr_reclaimed += nr_demoted;
> stat->nr_demoted += nr_demoted;
> /* Folios that could not be demoted are still in @demote_folios */
> --
> 2.52.0.358.g0dd7633a29-goog
--
Best regards,
Ridong
^ permalink raw reply [flat|nested] 54+ messages in thread* Re: [PATCH v4] mm/vmscan: fix demotion targets checks in reclaim/demotion
2026-01-05 2:48 ` Chen Ridong
@ 2026-01-05 5:10 ` Bing Jiao
0 siblings, 0 replies; 54+ messages in thread
From: Bing Jiao @ 2026-01-05 5:10 UTC (permalink / raw)
To: Chen Ridong
Cc: linux-mm, linux-kernel, akpm, gourry, longman, hannes, mhocko,
roman.gushchin, shakeel.butt, muchun.song, tj, mkoutny, david,
zhengqi.arch, lorenzo.stoakes, axelrasmussen, yuanchu, weixugc,
cgroups
On Mon, Jan 05, 2026 at 10:48:09AM +0800, Chen Ridong wrote:
> > cs = container_of(css, struct cpuset, css);
> > - allowed = node_isset(nid, cs->effective_mems);
> > + nodes_and(*mask, *mask, cs->effective_mems);
>
> Why do we need the and operation? Can't we just copy cs->effective_mems to mask directly?
>
> Per Longman's suggestion, name it cpuset_nodes_allowed and handle the filtering in
> mem_cgroup_node_filter_allowed. Please keep the allowed nodes retrieval logic common.
>
> Best regards,
> Ridong
Thank you for the explanation and suggestions.
Patch v5 has been sent with the corresponding updates.
Best,
Bing
^ permalink raw reply [flat|nested] 54+ messages in thread
* [PATCH v5] mm/vmscan: fix demotion targets checks in reclaim/demotion
2026-01-04 8:54 ` [PATCH v4] " Bing Jiao
2026-01-04 18:27 ` Andrew Morton
2026-01-05 2:48 ` Chen Ridong
@ 2026-01-05 5:01 ` Bing Jiao
2026-01-05 15:54 ` Gregory Price
2026-01-06 7:56 ` [PATCH v6] " Bing Jiao
2 siblings, 2 replies; 54+ messages in thread
From: Bing Jiao @ 2026-01-05 5:01 UTC (permalink / raw)
To: linux-mm
Cc: linux-kernel, akpm, gourry, longman, hannes, mhocko,
roman.gushchin, shakeel.butt, muchun.song, tj, mkoutny, david,
zhengqi.arch, lorenzo.stoakes, axelrasmussen, chenridong, yuanchu,
weixugc, cgroups, bingjiao
Fix two bugs in demote_folio_list() and can_demote() due to incorrect
demotion target checks in reclaim/demotion.
Commit 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
introduces the cpuset.mems_effective check and applies it to
can_demote(). However:
1. It does not apply this check in demote_folio_list(), which leads
to situations where pages are demoted to nodes that are
explicitly excluded from the task's cpuset.mems.
2. It checks only the nodes in the immediate next demotion hierarchy
and does not check all allowed demotion targets in can_demote().
This can cause pages to never be demoted if the nodes in the next
demotion hierarchy are not set in mems_effective.
These bugs break resource isolation provided by cpuset.mems.
This is visible from userspace because pages can either fail to be
demoted entirely or are demoted to nodes that are not allowed
in multi-tier memory systems.
To address these bugs, update cpuset_node_allowed() and
mem_cgroup_node_allowed() to return effective_mems, allowing directly
logic-and operation against demotion targets. Also update can_demote()
and demote_folio_list() accordingly.
Bug 1 reproduction:
Assume a system with 4 nodes, where nodes 0-1 are top-tier and
nodes 2-3 are far-tier memory. All nodes have equal capacity.
Test script:
echo 1 > /sys/kernel/mm/numa/demotion_enabled
mkdir /sys/fs/cgroup/test
echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
echo "0-2" > /sys/fs/cgroup/test/cpuset.mems
echo $$ > /sys/fs/cgroup/test/cgroup.procs
swapoff -a
# Expectation: Should respect node 0-2 limit.
# Observation: Node 3 shows significant allocation (MemFree drops)
stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1
Bug 2 reproduction:
Assume a system with 6 nodes, where nodes 0-2 are top-tier,
node 3 is a far-tier node, and nodes 4-5 are the farthest-tier nodes.
All nodes have equal capacity.
Test script:
echo 1 > /sys/kernel/mm/numa/demotion_enabled
mkdir /sys/fs/cgroup/test
echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
echo "0-2,4-5" > /sys/fs/cgroup/test/cpuset.mems
echo $$ > /sys/fs/cgroup/test/cgroup.procs
swapoff -a
# Expectation: Pages are demoted to Nodes 4-5
# Observation: No pages are demoted before oom.
stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1,2
Fixes: 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
Cc: <stable@vger.kernel.org>
Signed-off-by: Bing Jiao <bingjiao@google.com>
---
Patch against the linux mainline.
Tested on the mainline and passed. Pages can be demoted to correct nodes
on a VM with emulated 3-tiers far memory nodes.
Tested on mm-everyting, after Akinobu Mita's series "mm: fix oom-killer
not being invoked when demotion is enabled v2", and passed. OOM can be
triggered properly when far nodes are oom.
---
include/linux/cpuset.h | 6 +++---
include/linux/memcontrol.h | 6 +++---
kernel/cgroup/cpuset.c | 33 +++++++++++++++++++++++----------
mm/memcontrol.c | 10 ++++++++--
mm/vmscan.c | 30 ++++++++++++++++++------------
5 files changed, 55 insertions(+), 30 deletions(-)
diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h
index a98d3330385c..631577384677 100644
--- a/include/linux/cpuset.h
+++ b/include/linux/cpuset.h
@@ -174,7 +174,7 @@ static inline void set_mems_allowed(nodemask_t nodemask)
task_unlock(current);
}
-extern bool cpuset_node_allowed(struct cgroup *cgroup, int nid);
+extern void cpuset_nodes_allowed(struct cgroup *cgroup, nodemask_t *mask);
#else /* !CONFIG_CPUSETS */
static inline bool cpusets_enabled(void) { return false; }
@@ -301,9 +301,9 @@ static inline bool read_mems_allowed_retry(unsigned int seq)
return false;
}
-static inline bool cpuset_node_allowed(struct cgroup *cgroup, int nid)
+static inline void cpuset_nodes_allowed(struct cgroup *cgroup, nodemask_t *mask)
{
- return true;
+ nodes_copy(*mask, node_states[N_MEMORY]);
}
#endif /* !CONFIG_CPUSETS */
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 0651865a4564..412db7663357 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -1744,7 +1744,7 @@ static inline void count_objcg_events(struct obj_cgroup *objcg,
rcu_read_unlock();
}
-bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid);
+void mem_cgroup_node_filter_allowed(struct mem_cgroup *memcg, nodemask_t *mask);
void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg);
@@ -1815,9 +1815,9 @@ static inline ino_t page_cgroup_ino(struct page *page)
return 0;
}
-static inline bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid)
+static inline void mem_cgroup_node_filter_allowed(struct mem_cgroup *memcg,
+ nodemask_t *mask)
{
- return true;
}
static inline void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg)
diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index 3e8cc34d8d50..5bbd1d2fe5f6 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -4427,27 +4427,41 @@ bool cpuset_current_node_allowed(int node, gfp_t gfp_mask)
return allowed;
}
-bool cpuset_node_allowed(struct cgroup *cgroup, int nid)
+/**
+ * cpuset_nodes_allowed - return mems_allowed mask from a cgroup cpuset.
+ * @cgroup: pointer to struct cgroup.
+ * @mask: pointer to struct nodemask_t to be returned.
+ *
+ * Returns mems_allowed mask from a cgroup cpuset if it is cgroup v2 and
+ * has cpuset subsys. Otherwise, returns node_states[N_MEMORY].
+ *
+ * Returned @mask may be empty, and nodes in @mask are not guaranteed
+ * to be online.
+ **/
+void cpuset_nodes_allowed(struct cgroup *cgroup, nodemask_t *mask)
{
struct cgroup_subsys_state *css;
struct cpuset *cs;
- bool allowed;
/*
* In v1, mem_cgroup and cpuset are unlikely in the same hierarchy
* and mems_allowed is likely to be empty even if we could get to it,
- * so return true to avoid taking a global lock on the empty check.
+ * so return directly to avoid taking a global lock on the empty check.
*/
- if (!cpuset_v2())
- return true;
+ if (!cgroup || !cpuset_v2()) {
+ nodes_copy(*mask, node_states[N_MEMORY]);
+ return;
+ }
css = cgroup_get_e_css(cgroup, &cpuset_cgrp_subsys);
- if (!css)
- return true;
+ if (!css) {
+ nodes_copy(*mask, node_states[N_MEMORY]);
+ return;
+ }
/*
* Normally, accessing effective_mems would require the cpuset_mutex
- * or callback_lock - but node_isset is atomic and the reference
+ * or callback_lock - but not doing so is acceptable and the reference
* taken via cgroup_get_e_css is sufficient to protect css.
*
* Since this interface is intended for use by migration paths, we
@@ -4458,9 +4472,8 @@ bool cpuset_node_allowed(struct cgroup *cgroup, int nid)
* cannot make strong isolation guarantees, so this is acceptable.
*/
cs = container_of(css, struct cpuset, css);
- allowed = node_isset(nid, cs->effective_mems);
+ nodes_copy(*mask, cs->effective_mems);
css_put(css);
- return allowed;
}
/**
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 86f43b7e5f71..252cc456714a 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -5624,9 +5624,15 @@ subsys_initcall(mem_cgroup_swap_init);
#endif /* CONFIG_SWAP */
-bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid)
+void mem_cgroup_node_filter_allowed(struct mem_cgroup *memcg, nodemask_t *mask)
{
- return memcg ? cpuset_node_allowed(memcg->css.cgroup, nid) : true;
+ nodemask_t allowed;
+
+ if (!memcg)
+ return;
+
+ cpuset_nodes_allowed(memcg->css.cgroup, &allowed);
+ nodes_and(*mask, *mask, allowed);
}
void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg)
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 670fe9fae5ba..eed1becfcb34 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -344,19 +344,21 @@ static void flush_reclaim_state(struct scan_control *sc)
static bool can_demote(int nid, struct scan_control *sc,
struct mem_cgroup *memcg)
{
- int demotion_nid;
+ struct pglist_data *pgdat = NODE_DATA(nid);
+ nodemask_t allowed_mask;
- if (!numa_demotion_enabled)
+ if (!pgdat || !numa_demotion_enabled)
return false;
if (sc && sc->no_demotion)
return false;
- demotion_nid = next_demotion_node(nid);
- if (demotion_nid == NUMA_NO_NODE)
+ node_get_allowed_targets(pgdat, &allowed_mask);
+ if (nodes_empty(allowed_mask))
return false;
- /* If demotion node isn't in the cgroup's mems_allowed, fall back */
- return mem_cgroup_node_allowed(memcg, demotion_nid);
+ /* Filter out nodes that are not in cgroup's mems_allowed. */
+ mem_cgroup_node_filter_allowed(memcg, &allowed_mask);
+ return !nodes_empty(allowed_mask);
}
static inline bool can_reclaim_anon_pages(struct mem_cgroup *memcg,
@@ -1019,7 +1021,8 @@ static struct folio *alloc_demote_folio(struct folio *src,
* Folios which are not demoted are left on @demote_folios.
*/
static unsigned int demote_folio_list(struct list_head *demote_folios,
- struct pglist_data *pgdat)
+ struct pglist_data *pgdat,
+ struct mem_cgroup *memcg)
{
int target_nid = next_demotion_node(pgdat->node_id);
unsigned int nr_succeeded;
@@ -1033,7 +1036,6 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
*/
.gfp_mask = (GFP_HIGHUSER_MOVABLE & ~__GFP_RECLAIM) |
__GFP_NOMEMALLOC | GFP_NOWAIT,
- .nid = target_nid,
.nmask = &allowed_mask,
.reason = MR_DEMOTION,
};
@@ -1041,10 +1043,14 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
if (list_empty(demote_folios))
return 0;
- if (target_nid == NUMA_NO_NODE)
- return 0;
-
node_get_allowed_targets(pgdat, &allowed_mask);
+ mem_cgroup_node_filter_allowed(memcg, &allowed_mask);
+ if (nodes_empty(allowed_mask))
+ return false;
+
+ if (!node_isset(target_nid, allowed_mask))
+ target_nid = node_random(&allowed_mask);
+ mtc.nid = target_nid;
/* Demotion ignores all cpuset and mempolicy settings */
migrate_pages(demote_folios, alloc_demote_folio, NULL,
@@ -1566,7 +1572,7 @@ static unsigned int shrink_folio_list(struct list_head *folio_list,
/* 'folio_list' is always empty here */
/* Migrate folios selected for demotion */
- nr_demoted = demote_folio_list(&demote_folios, pgdat);
+ nr_demoted = demote_folio_list(&demote_folios, pgdat, memcg);
nr_reclaimed += nr_demoted;
stat->nr_demoted += nr_demoted;
/* Folios that could not be demoted are still in @demote_folios */
--
2.52.0.358.g0dd7633a29-goog
^ permalink raw reply related [flat|nested] 54+ messages in thread* Re: [PATCH v5] mm/vmscan: fix demotion targets checks in reclaim/demotion
2026-01-05 5:01 ` [PATCH v5] " Bing Jiao
@ 2026-01-05 15:54 ` Gregory Price
2026-01-05 21:34 ` Bing Jiao
2026-01-06 7:56 ` [PATCH v6] " Bing Jiao
1 sibling, 1 reply; 54+ messages in thread
From: Gregory Price @ 2026-01-05 15:54 UTC (permalink / raw)
To: Bing Jiao
Cc: linux-mm, linux-kernel, akpm, longman, hannes, mhocko,
roman.gushchin, shakeel.butt, muchun.song, tj, mkoutny, david,
zhengqi.arch, lorenzo.stoakes, axelrasmussen, chenridong, yuanchu,
weixugc, cgroups
On Mon, Jan 05, 2026 at 05:01:52AM +0000, Bing Jiao wrote:
... snip ...
> +/**
> + * cpuset_nodes_allowed - return mems_allowed mask from a cgroup cpuset.
> + * @cgroup: pointer to struct cgroup.
> + * @mask: pointer to struct nodemask_t to be returned.
> + *
> + * Returns mems_allowed mask from a cgroup cpuset if it is cgroup v2 and
> + * has cpuset subsys. Otherwise, returns node_states[N_MEMORY].
> + *
> + * Returned @mask may be empty, and nodes in @mask are not guaranteed
> + * to be online.
> + **/
> +void cpuset_nodes_allowed(struct cgroup *cgroup, nodemask_t *mask)
> +void cpuset_nodes_allowed(struct cgroup *cgroup, nodemask_t *mask)
> {
... snip ...
> /*
> * Normally, accessing effective_mems would require the cpuset_mutex
> - * or callback_lock - but node_isset is atomic and the reference
> + * or callback_lock - but not doing so is acceptable and the reference
"node_isset is atomic" is an argument that not taking cpuset_mutex is
acceptable since it's a singular operation against a nodemask (one bit
it checked) - and therefore for a moment in time the node is either
allowed or not (and we make no absolute guarantee of corrected when this
race occurs, we just note that we're corrected).
nodes_copy is not atomic, and in fact this can result in returning an
empty nodemask if cs->effective_mems is being recalculated at the time
this copy occurs.
Rather than just saying "not doing so is acceptable" - can you please
change this comment to explain the implications of not acquiring the
mutex a little more clearly?
Example:
```
We do not acquire cpuset_mutex during this check because the correctness
of this information is stale immediately after the query anyway - this
saves lock contention in exchange for racing against mems_allowed rebinds.
As a result, @mask may be empty because cs->effective_mems can be rebound
during this call. Callers must check the mask for validity on return.
```
The rest of the comments in the function explains a about this, but I
think with this update the comments need a little more rework.
~Gregory
^ permalink raw reply [flat|nested] 54+ messages in thread* Re: [PATCH v5] mm/vmscan: fix demotion targets checks in reclaim/demotion
2026-01-05 15:54 ` Gregory Price
@ 2026-01-05 21:34 ` Bing Jiao
0 siblings, 0 replies; 54+ messages in thread
From: Bing Jiao @ 2026-01-05 21:34 UTC (permalink / raw)
To: Gregory Price
Cc: linux-mm, linux-kernel, akpm, longman, hannes, mhocko,
roman.gushchin, shakeel.butt, muchun.song, tj, mkoutny, david,
zhengqi.arch, lorenzo.stoakes, axelrasmussen, chenridong, yuanchu,
weixugc, cgroups
On Mon, Jan 05, 2026 at 10:54:05AM -0500, Gregory Price wrote:
> On Mon, Jan 05, 2026 at 05:01:52AM +0000, Bing Jiao wrote:
> ... snip ...
> > +/**
> > + * cpuset_nodes_allowed - return mems_allowed mask from a cgroup cpuset.
> > + * @cgroup: pointer to struct cgroup.
> > + * @mask: pointer to struct nodemask_t to be returned.
> > + *
> > + * Returns mems_allowed mask from a cgroup cpuset if it is cgroup v2 and
> > + * has cpuset subsys. Otherwise, returns node_states[N_MEMORY].
> > + *
> > + * Returned @mask may be empty, and nodes in @mask are not guaranteed
> > + * to be online.
> > + **/
> > +void cpuset_nodes_allowed(struct cgroup *cgroup, nodemask_t *mask)
> > +void cpuset_nodes_allowed(struct cgroup *cgroup, nodemask_t *mask)
> > {
> ... snip ...
> > /*
> > * Normally, accessing effective_mems would require the cpuset_mutex
> > - * or callback_lock - but node_isset is atomic and the reference
> > + * or callback_lock - but not doing so is acceptable and the reference
>
>
> "node_isset is atomic" is an argument that not taking cpuset_mutex is
> acceptable since it's a singular operation against a nodemask (one bit
> it checked) - and therefore for a moment in time the node is either
> allowed or not (and we make no absolute guarantee of corrected when this
> race occurs, we just note that we're corrected).
>
> nodes_copy is not atomic, and in fact this can result in returning an
> empty nodemask if cs->effective_mems is being recalculated at the time
> this copy occurs.
>
> Rather than just saying "not doing so is acceptable" - can you please
> change this comment to explain the implications of not acquiring the
> mutex a little more clearly?
>
> Example:
> ```
> We do not acquire cpuset_mutex during this check because the correctness
> of this information is stale immediately after the query anyway - this
> saves lock contention in exchange for racing against mems_allowed rebinds.
>
> As a result, @mask may be empty because cs->effective_mems can be rebound
> during this call. Callers must check the mask for validity on return.
> ```
>
> The rest of the comments in the function explains a about this, but I
> think with this update the comments need a little more rework.
>
> ~Gregory
Thanks for the suggestions. I will reword the comment in V6.
Best,
Bing
^ permalink raw reply [flat|nested] 54+ messages in thread
* [PATCH v6] mm/vmscan: fix demotion targets checks in reclaim/demotion
2026-01-05 5:01 ` [PATCH v5] " Bing Jiao
2026-01-05 15:54 ` Gregory Price
@ 2026-01-06 7:56 ` Bing Jiao
2026-01-06 14:23 ` Gregory Price
` (3 more replies)
1 sibling, 4 replies; 54+ messages in thread
From: Bing Jiao @ 2026-01-06 7:56 UTC (permalink / raw)
To: linux-mm
Cc: linux-kernel, akpm, gourry, longman, hannes, mhocko,
roman.gushchin, shakeel.butt, muchun.song, tj, mkoutny, david,
zhengqi.arch, lorenzo.stoakes, axelrasmussen, chenridong, yuanchu,
weixugc, cgroups, bingjiao
Fix two bugs in demote_folio_list() and can_demote() due to incorrect
demotion target checks in reclaim/demotion.
Commit 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
introduces the cpuset.mems_effective check and applies it to
can_demote(). However:
1. It does not apply this check in demote_folio_list(), which leads
to situations where pages are demoted to nodes that are
explicitly excluded from the task's cpuset.mems.
2. It checks only the nodes in the immediate next demotion hierarchy
and does not check all allowed demotion targets in can_demote().
This can cause pages to never be demoted if the nodes in the next
demotion hierarchy are not set in mems_effective.
These bugs break resource isolation provided by cpuset.mems.
This is visible from userspace because pages can either fail to be
demoted entirely or are demoted to nodes that are not allowed
in multi-tier memory systems.
To address these bugs, update cpuset_node_allowed() and
mem_cgroup_node_allowed() to return effective_mems, allowing directly
logic-and operation against demotion targets. Also update can_demote()
and demote_folio_list() accordingly.
Bug 1 reproduction:
Assume a system with 4 nodes, where nodes 0-1 are top-tier and
nodes 2-3 are far-tier memory. All nodes have equal capacity.
Test script:
echo 1 > /sys/kernel/mm/numa/demotion_enabled
mkdir /sys/fs/cgroup/test
echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
echo "0-2" > /sys/fs/cgroup/test/cpuset.mems
echo $$ > /sys/fs/cgroup/test/cgroup.procs
swapoff -a
# Expectation: Should respect node 0-2 limit.
# Observation: Node 3 shows significant allocation (MemFree drops)
stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1
Bug 2 reproduction:
Assume a system with 6 nodes, where nodes 0-2 are top-tier,
node 3 is a far-tier node, and nodes 4-5 are the farthest-tier nodes.
All nodes have equal capacity.
Test script:
echo 1 > /sys/kernel/mm/numa/demotion_enabled
mkdir /sys/fs/cgroup/test
echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
echo "0-2,4-5" > /sys/fs/cgroup/test/cpuset.mems
echo $$ > /sys/fs/cgroup/test/cgroup.procs
swapoff -a
# Expectation: Pages are demoted to Nodes 4-5
# Observation: No pages are demoted before oom.
stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1,2
Fixes: 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
Cc: <stable@vger.kernel.org>
Signed-off-by: Bing Jiao <bingjiao@google.com>
---
Patch against the linux mainline.
Tested on the mainline and passed.
Tested on mm-everyting, after Akinobu Mita's series "mm: fix oom-killer
not being invoked when demotion is enabled v2", and passed.
v5 -> v6: update cpuset_nodes_allowed()'s comments; move some comments
from cpuset_nodes_allowed() to mem_cgroup_node_filter_allowed().
---
include/linux/cpuset.h | 6 ++---
include/linux/memcontrol.h | 6 ++---
kernel/cgroup/cpuset.c | 54 +++++++++++++++++++++++++-------------
mm/memcontrol.c | 16 +++++++++--
mm/vmscan.c | 30 ++++++++++++---------
5 files changed, 74 insertions(+), 38 deletions(-)
diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h
index a98d3330385c..631577384677 100644
--- a/include/linux/cpuset.h
+++ b/include/linux/cpuset.h
@@ -174,7 +174,7 @@ static inline void set_mems_allowed(nodemask_t nodemask)
task_unlock(current);
}
-extern bool cpuset_node_allowed(struct cgroup *cgroup, int nid);
+extern void cpuset_nodes_allowed(struct cgroup *cgroup, nodemask_t *mask);
#else /* !CONFIG_CPUSETS */
static inline bool cpusets_enabled(void) { return false; }
@@ -301,9 +301,9 @@ static inline bool read_mems_allowed_retry(unsigned int seq)
return false;
}
-static inline bool cpuset_node_allowed(struct cgroup *cgroup, int nid)
+static inline void cpuset_nodes_allowed(struct cgroup *cgroup, nodemask_t *mask)
{
- return true;
+ nodes_copy(*mask, node_states[N_MEMORY]);
}
#endif /* !CONFIG_CPUSETS */
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 0651865a4564..412db7663357 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -1744,7 +1744,7 @@ static inline void count_objcg_events(struct obj_cgroup *objcg,
rcu_read_unlock();
}
-bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid);
+void mem_cgroup_node_filter_allowed(struct mem_cgroup *memcg, nodemask_t *mask);
void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg);
@@ -1815,9 +1815,9 @@ static inline ino_t page_cgroup_ino(struct page *page)
return 0;
}
-static inline bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid)
+static inline void mem_cgroup_node_filter_allowed(struct mem_cgroup *memcg,
+ nodemask_t *mask)
{
- return true;
}
static inline void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg)
diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index 3e8cc34d8d50..76d7d0fa8137 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -4427,40 +4427,58 @@ bool cpuset_current_node_allowed(int node, gfp_t gfp_mask)
return allowed;
}
-bool cpuset_node_allowed(struct cgroup *cgroup, int nid)
+/**
+ * cpuset_nodes_allowed - return effective_mems mask from a cgroup cpuset.
+ * @cgroup: pointer to struct cgroup.
+ * @mask: pointer to struct nodemask_t to be returned.
+ *
+ * Returns effective_mems mask from a cgroup cpuset if it is cgroup v2 and
+ * has cpuset subsys. Otherwise, returns node_states[N_MEMORY].
+ *
+ * This function intentionally avoids taking the cpuset_mutex or callback_lock
+ * when accessing effective_mems. This is because the obtained effective_mems
+ * is stale immediately after the query anyway (e.g., effective_mems is updated
+ * immediately after releasing the lock but before returning).
+ *
+ * As a result, returned @mask may be empty because cs->effective_mems can be
+ * rebound during this call. Besides, nodes in @mask are not guaranteed to be
+ * online due to hot plugins. Callers should check the mask for validity on
+ * return based on its subsequent use.
+ **/
+void cpuset_nodes_allowed(struct cgroup *cgroup, nodemask_t *mask)
{
struct cgroup_subsys_state *css;
struct cpuset *cs;
- bool allowed;
/*
* In v1, mem_cgroup and cpuset are unlikely in the same hierarchy
* and mems_allowed is likely to be empty even if we could get to it,
- * so return true to avoid taking a global lock on the empty check.
+ * so return directly to avoid taking a global lock on the empty check.
*/
- if (!cpuset_v2())
- return true;
+ if (!cgroup || !cpuset_v2()) {
+ nodes_copy(*mask, node_states[N_MEMORY]);
+ return;
+ }
css = cgroup_get_e_css(cgroup, &cpuset_cgrp_subsys);
- if (!css)
- return true;
+ if (!css) {
+ nodes_copy(*mask, node_states[N_MEMORY]);
+ return;
+ }
/*
- * Normally, accessing effective_mems would require the cpuset_mutex
- * or callback_lock - but node_isset is atomic and the reference
- * taken via cgroup_get_e_css is sufficient to protect css.
- *
- * Since this interface is intended for use by migration paths, we
- * relax locking here to avoid taking global locks - while accepting
- * there may be rare scenarios where the result may be innaccurate.
+ * The reference taken via cgroup_get_e_css is sufficient to
+ * protect css, but it does not imply safe accesses to effective_mems.
*
- * Reclaim and migration are subject to these same race conditions, and
- * cannot make strong isolation guarantees, so this is acceptable.
+ * Normally, accessing effective_mems would require the cpuset_mutex
+ * or callback_lock - but the correctness of this information is stale
+ * immediately after the query anyway. We do not acquire the lock
+ * during this process to save lock contention in exchange for racing
+ * against mems_allowed rebinds.
*/
cs = container_of(css, struct cpuset, css);
- allowed = node_isset(nid, cs->effective_mems);
+ nodes_copy(*mask, cs->effective_mems);
css_put(css);
- return allowed;
}
/**
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 86f43b7e5f71..702c3db624a0 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -5624,9 +5624,21 @@ subsys_initcall(mem_cgroup_swap_init);
#endif /* CONFIG_SWAP */
-bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid)
+void mem_cgroup_node_filter_allowed(struct mem_cgroup *memcg, nodemask_t *mask)
{
- return memcg ? cpuset_node_allowed(memcg->css.cgroup, nid) : true;
+ nodemask_t allowed;
+
+ if (!memcg)
+ return;
+
+ /*
+ * Since this interface is intended for use by migration paths, and
+ * reclaim and migration are subject to race conditions such as changes
+ * in effective_mems and hot-unpluging of nodes, inaccurate allowed
+ * mask is acceptable.
+ */
+ cpuset_nodes_allowed(memcg->css.cgroup, &allowed);
+ nodes_and(*mask, *mask, allowed);
}
void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg)
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 670fe9fae5ba..eed1becfcb34 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -344,19 +344,21 @@ static void flush_reclaim_state(struct scan_control *sc)
static bool can_demote(int nid, struct scan_control *sc,
struct mem_cgroup *memcg)
{
- int demotion_nid;
+ struct pglist_data *pgdat = NODE_DATA(nid);
+ nodemask_t allowed_mask;
- if (!numa_demotion_enabled)
+ if (!pgdat || !numa_demotion_enabled)
return false;
if (sc && sc->no_demotion)
return false;
- demotion_nid = next_demotion_node(nid);
- if (demotion_nid == NUMA_NO_NODE)
+ node_get_allowed_targets(pgdat, &allowed_mask);
+ if (nodes_empty(allowed_mask))
return false;
- /* If demotion node isn't in the cgroup's mems_allowed, fall back */
- return mem_cgroup_node_allowed(memcg, demotion_nid);
+ /* Filter out nodes that are not in cgroup's mems_allowed. */
+ mem_cgroup_node_filter_allowed(memcg, &allowed_mask);
+ return !nodes_empty(allowed_mask);
}
static inline bool can_reclaim_anon_pages(struct mem_cgroup *memcg,
@@ -1019,7 +1021,8 @@ static struct folio *alloc_demote_folio(struct folio *src,
* Folios which are not demoted are left on @demote_folios.
*/
static unsigned int demote_folio_list(struct list_head *demote_folios,
- struct pglist_data *pgdat)
+ struct pglist_data *pgdat,
+ struct mem_cgroup *memcg)
{
int target_nid = next_demotion_node(pgdat->node_id);
unsigned int nr_succeeded;
@@ -1033,7 +1036,6 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
*/
.gfp_mask = (GFP_HIGHUSER_MOVABLE & ~__GFP_RECLAIM) |
__GFP_NOMEMALLOC | GFP_NOWAIT,
- .nid = target_nid,
.nmask = &allowed_mask,
.reason = MR_DEMOTION,
};
@@ -1041,10 +1043,14 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
if (list_empty(demote_folios))
return 0;
- if (target_nid == NUMA_NO_NODE)
- return 0;
-
node_get_allowed_targets(pgdat, &allowed_mask);
+ mem_cgroup_node_filter_allowed(memcg, &allowed_mask);
+ if (nodes_empty(allowed_mask))
+ return false;
+
+ if (!node_isset(target_nid, allowed_mask))
+ target_nid = node_random(&allowed_mask);
+ mtc.nid = target_nid;
/* Demotion ignores all cpuset and mempolicy settings */
migrate_pages(demote_folios, alloc_demote_folio, NULL,
@@ -1566,7 +1572,7 @@ static unsigned int shrink_folio_list(struct list_head *folio_list,
/* 'folio_list' is always empty here */
/* Migrate folios selected for demotion */
- nr_demoted = demote_folio_list(&demote_folios, pgdat);
+ nr_demoted = demote_folio_list(&demote_folios, pgdat, memcg);
nr_reclaimed += nr_demoted;
stat->nr_demoted += nr_demoted;
/* Folios that could not be demoted are still in @demote_folios */
--
2.52.0.358.g0dd7633a29-goog
^ permalink raw reply related [flat|nested] 54+ messages in thread* Re: [PATCH v6] mm/vmscan: fix demotion targets checks in reclaim/demotion
2026-01-06 7:56 ` [PATCH v6] " Bing Jiao
@ 2026-01-06 14:23 ` Gregory Price
2026-01-06 19:36 ` Andrew Morton
` (2 subsequent siblings)
3 siblings, 0 replies; 54+ messages in thread
From: Gregory Price @ 2026-01-06 14:23 UTC (permalink / raw)
To: Bing Jiao
Cc: linux-mm, linux-kernel, akpm, longman, hannes, mhocko,
roman.gushchin, shakeel.butt, muchun.song, tj, mkoutny, david,
zhengqi.arch, lorenzo.stoakes, axelrasmussen, chenridong, yuanchu,
weixugc, cgroups
On Tue, Jan 06, 2026 at 07:56:54AM +0000, Bing Jiao wrote:
>
> Bug 1 reproduction:
> Assume a system with 4 nodes, where nodes 0-1 are top-tier and
> nodes 2-3 are far-tier memory. All nodes have equal capacity.
>
> Test script:
> echo 1 > /sys/kernel/mm/numa/demotion_enabled
> mkdir /sys/fs/cgroup/test
> echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
> echo "0-2" > /sys/fs/cgroup/test/cpuset.mems
> echo $$ > /sys/fs/cgroup/test/cgroup.procs
> swapoff -a
> # Expectation: Should respect node 0-2 limit.
> # Observation: Node 3 shows significant allocation (MemFree drops)
> stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1
>
> Bug 2 reproduction:
> Assume a system with 6 nodes, where nodes 0-2 are top-tier,
> node 3 is a far-tier node, and nodes 4-5 are the farthest-tier nodes.
> All nodes have equal capacity.
>
> Test script:
> echo 1 > /sys/kernel/mm/numa/demotion_enabled
> mkdir /sys/fs/cgroup/test
> echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
> echo "0-2,4-5" > /sys/fs/cgroup/test/cpuset.mems
> echo $$ > /sys/fs/cgroup/test/cgroup.procs
> swapoff -a
> # Expectation: Pages are demoted to Nodes 4-5
> # Observation: No pages are demoted before oom.
> stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1,2
>
> Fixes: 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Bing Jiao <bingjiao@google.com>
This looks ok now, haven't tested it myself yet, but looks good.
Thank you for the fix.
Reviewed-by: Gregory Price <gourry@gourry.net>
~Gregory
^ permalink raw reply [flat|nested] 54+ messages in thread* Re: [PATCH v6] mm/vmscan: fix demotion targets checks in reclaim/demotion
2026-01-06 7:56 ` [PATCH v6] " Bing Jiao
2026-01-06 14:23 ` Gregory Price
@ 2026-01-06 19:36 ` Andrew Morton
2026-01-07 1:27 ` Chen Ridong
2026-01-08 3:32 ` [PATCH v7 0/2] " Bing Jiao
3 siblings, 0 replies; 54+ messages in thread
From: Andrew Morton @ 2026-01-06 19:36 UTC (permalink / raw)
To: Bing Jiao
Cc: linux-mm, linux-kernel, gourry, longman, hannes, mhocko,
roman.gushchin, shakeel.butt, muchun.song, tj, mkoutny, david,
zhengqi.arch, lorenzo.stoakes, axelrasmussen, chenridong, yuanchu,
weixugc, cgroups
On Tue, 6 Jan 2026 07:56:54 +0000 Bing Jiao <bingjiao@google.com> wrote:
> Fix two bugs in demote_folio_list() and can_demote() due to incorrect
> demotion target checks in reclaim/demotion.
>
> Commit 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
> introduces the cpuset.mems_effective check and applies it to
> can_demote(). However:
>
> 1. It does not apply this check in demote_folio_list(), which leads
> to situations where pages are demoted to nodes that are
> explicitly excluded from the task's cpuset.mems.
>
> 2. It checks only the nodes in the immediate next demotion hierarchy
> and does not check all allowed demotion targets in can_demote().
> This can cause pages to never be demoted if the nodes in the next
> demotion hierarchy are not set in mems_effective.
>
> These bugs break resource isolation provided by cpuset.mems.
> This is visible from userspace because pages can either fail to be
> demoted entirely or are demoted to nodes that are not allowed
> in multi-tier memory systems.
>
> To address these bugs, update cpuset_node_allowed() and
> mem_cgroup_node_allowed() to return effective_mems, allowing directly
> logic-and operation against demotion targets. Also update can_demote()
> and demote_folio_list() accordingly.
>
> Bug 1 reproduction:
> Assume a system with 4 nodes, where nodes 0-1 are top-tier and
> nodes 2-3 are far-tier memory. All nodes have equal capacity.
>
> Test script:
> echo 1 > /sys/kernel/mm/numa/demotion_enabled
> mkdir /sys/fs/cgroup/test
> echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
> echo "0-2" > /sys/fs/cgroup/test/cpuset.mems
> echo $$ > /sys/fs/cgroup/test/cgroup.procs
> swapoff -a
> # Expectation: Should respect node 0-2 limit.
> # Observation: Node 3 shows significant allocation (MemFree drops)
> stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1
>
> Bug 2 reproduction:
> Assume a system with 6 nodes, where nodes 0-2 are top-tier,
> node 3 is a far-tier node, and nodes 4-5 are the farthest-tier nodes.
> All nodes have equal capacity.
>
> Test script:
> echo 1 > /sys/kernel/mm/numa/demotion_enabled
> mkdir /sys/fs/cgroup/test
> echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
> echo "0-2,4-5" > /sys/fs/cgroup/test/cpuset.mems
> echo $$ > /sys/fs/cgroup/test/cgroup.procs
> swapoff -a
> # Expectation: Pages are demoted to Nodes 4-5
> # Observation: No pages are demoted before oom.
> stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1,2
Thanks.
I'm not confident in my attempts to resolve Akinobu Mita's "mm/vmscan:
don't demote if there is not enough free memory in the lower memory
tier" against this. In can_demote(). So I'll drop Akinobu's series,
sorry.
Akinobu, can you please redo that series against tomorrow's linux-next?
it looks like it needs a resend anyway to try to create some reviewer
input.
^ permalink raw reply [flat|nested] 54+ messages in thread* Re: [PATCH v6] mm/vmscan: fix demotion targets checks in reclaim/demotion
2026-01-06 7:56 ` [PATCH v6] " Bing Jiao
2026-01-06 14:23 ` Gregory Price
2026-01-06 19:36 ` Andrew Morton
@ 2026-01-07 1:27 ` Chen Ridong
2026-01-08 3:32 ` [PATCH v7 0/2] " Bing Jiao
3 siblings, 0 replies; 54+ messages in thread
From: Chen Ridong @ 2026-01-07 1:27 UTC (permalink / raw)
To: Bing Jiao, linux-mm
Cc: linux-kernel, akpm, gourry, longman, hannes, mhocko,
roman.gushchin, shakeel.butt, muchun.song, tj, mkoutny, david,
zhengqi.arch, lorenzo.stoakes, axelrasmussen, yuanchu, weixugc,
cgroups
On 2026/1/6 15:56, Bing Jiao wrote:
> Fix two bugs in demote_folio_list() and can_demote() due to incorrect
> demotion target checks in reclaim/demotion.
>
> Commit 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
> introduces the cpuset.mems_effective check and applies it to
> can_demote(). However:
>
> 1. It does not apply this check in demote_folio_list(), which leads
> to situations where pages are demoted to nodes that are
> explicitly excluded from the task's cpuset.mems.
>
> 2. It checks only the nodes in the immediate next demotion hierarchy
> and does not check all allowed demotion targets in can_demote().
> This can cause pages to never be demoted if the nodes in the next
> demotion hierarchy are not set in mems_effective.
>
> These bugs break resource isolation provided by cpuset.mems.
> This is visible from userspace because pages can either fail to be
> demoted entirely or are demoted to nodes that are not allowed
> in multi-tier memory systems.
>
> To address these bugs, update cpuset_node_allowed() and
> mem_cgroup_node_allowed() to return effective_mems, allowing directly
> logic-and operation against demotion targets. Also update can_demote()
> and demote_folio_list() accordingly.
>
> Bug 1 reproduction:
> Assume a system with 4 nodes, where nodes 0-1 are top-tier and
> nodes 2-3 are far-tier memory. All nodes have equal capacity.
>
> Test script:
> echo 1 > /sys/kernel/mm/numa/demotion_enabled
> mkdir /sys/fs/cgroup/test
> echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
> echo "0-2" > /sys/fs/cgroup/test/cpuset.mems
> echo $$ > /sys/fs/cgroup/test/cgroup.procs
> swapoff -a
> # Expectation: Should respect node 0-2 limit.
> # Observation: Node 3 shows significant allocation (MemFree drops)
> stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1
>
> Bug 2 reproduction:
> Assume a system with 6 nodes, where nodes 0-2 are top-tier,
> node 3 is a far-tier node, and nodes 4-5 are the farthest-tier nodes.
> All nodes have equal capacity.
>
> Test script:
> echo 1 > /sys/kernel/mm/numa/demotion_enabled
> mkdir /sys/fs/cgroup/test
> echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
> echo "0-2,4-5" > /sys/fs/cgroup/test/cpuset.mems
> echo $$ > /sys/fs/cgroup/test/cgroup.procs
> swapoff -a
> # Expectation: Pages are demoted to Nodes 4-5
> # Observation: No pages are demoted before oom.
> stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1,2
>
> Fixes: 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Bing Jiao <bingjiao@google.com>
> ---
>
> Patch against the linux mainline.
> Tested on the mainline and passed.
> Tested on mm-everyting, after Akinobu Mita's series "mm: fix oom-killer
> not being invoked when demotion is enabled v2", and passed.
>
> v5 -> v6: update cpuset_nodes_allowed()'s comments; move some comments
> from cpuset_nodes_allowed() to mem_cgroup_node_filter_allowed().
>
> ---
> include/linux/cpuset.h | 6 ++---
> include/linux/memcontrol.h | 6 ++---
> kernel/cgroup/cpuset.c | 54 +++++++++++++++++++++++++-------------
> mm/memcontrol.c | 16 +++++++++--
> mm/vmscan.c | 30 ++++++++++++---------
> 5 files changed, 74 insertions(+), 38 deletions(-)
>
> diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h
> index a98d3330385c..631577384677 100644
> --- a/include/linux/cpuset.h
> +++ b/include/linux/cpuset.h
> @@ -174,7 +174,7 @@ static inline void set_mems_allowed(nodemask_t nodemask)
> task_unlock(current);
> }
>
> -extern bool cpuset_node_allowed(struct cgroup *cgroup, int nid);
> +extern void cpuset_nodes_allowed(struct cgroup *cgroup, nodemask_t *mask);
> #else /* !CONFIG_CPUSETS */
>
> static inline bool cpusets_enabled(void) { return false; }
> @@ -301,9 +301,9 @@ static inline bool read_mems_allowed_retry(unsigned int seq)
> return false;
> }
>
> -static inline bool cpuset_node_allowed(struct cgroup *cgroup, int nid)
> +static inline void cpuset_nodes_allowed(struct cgroup *cgroup, nodemask_t *mask)
> {
> - return true;
> + nodes_copy(*mask, node_states[N_MEMORY]);
> }
> #endif /* !CONFIG_CPUSETS */
>
> diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
> index 0651865a4564..412db7663357 100644
> --- a/include/linux/memcontrol.h
> +++ b/include/linux/memcontrol.h
> @@ -1744,7 +1744,7 @@ static inline void count_objcg_events(struct obj_cgroup *objcg,
> rcu_read_unlock();
> }
>
> -bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid);
> +void mem_cgroup_node_filter_allowed(struct mem_cgroup *memcg, nodemask_t *mask);
>
> void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg);
>
> @@ -1815,9 +1815,9 @@ static inline ino_t page_cgroup_ino(struct page *page)
> return 0;
> }
>
> -static inline bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid)
> +static inline void mem_cgroup_node_filter_allowed(struct mem_cgroup *memcg,
> + nodemask_t *mask)
> {
> - return true;
> }
>
> static inline void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg)
> diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
> index 3e8cc34d8d50..76d7d0fa8137 100644
> --- a/kernel/cgroup/cpuset.c
> +++ b/kernel/cgroup/cpuset.c
> @@ -4427,40 +4427,58 @@ bool cpuset_current_node_allowed(int node, gfp_t gfp_mask)
> return allowed;
> }
>
> -bool cpuset_node_allowed(struct cgroup *cgroup, int nid)
> +/**
> + * cpuset_nodes_allowed - return effective_mems mask from a cgroup cpuset.
> + * @cgroup: pointer to struct cgroup.
> + * @mask: pointer to struct nodemask_t to be returned.
> + *
> + * Returns effective_mems mask from a cgroup cpuset if it is cgroup v2 and
> + * has cpuset subsys. Otherwise, returns node_states[N_MEMORY].
> + *
> + * This function intentionally avoids taking the cpuset_mutex or callback_lock
> + * when accessing effective_mems. This is because the obtained effective_mems
> + * is stale immediately after the query anyway (e.g., effective_mems is updated
> + * immediately after releasing the lock but before returning).
> + *
> + * As a result, returned @mask may be empty because cs->effective_mems can be
> + * rebound during this call. Besides, nodes in @mask are not guaranteed to be
> + * online due to hot plugins. Callers should check the mask for validity on
> + * return based on its subsequent use.
> + **/
> +void cpuset_nodes_allowed(struct cgroup *cgroup, nodemask_t *mask)
> {
> struct cgroup_subsys_state *css;
> struct cpuset *cs;
> - bool allowed;
>
> /*
> * In v1, mem_cgroup and cpuset are unlikely in the same hierarchy
> * and mems_allowed is likely to be empty even if we could get to it,
> - * so return true to avoid taking a global lock on the empty check.
> + * so return directly to avoid taking a global lock on the empty check.
> */
> - if (!cpuset_v2())
> - return true;
> + if (!cgroup || !cpuset_v2()) {
> + nodes_copy(*mask, node_states[N_MEMORY]);
> + return;
> + }
>
> css = cgroup_get_e_css(cgroup, &cpuset_cgrp_subsys);
> - if (!css)
> - return true;
> + if (!css) {
> + nodes_copy(*mask, node_states[N_MEMORY]);
> + return;
> + }
>
> /*
> - * Normally, accessing effective_mems would require the cpuset_mutex
> - * or callback_lock - but node_isset is atomic and the reference
> - * taken via cgroup_get_e_css is sufficient to protect css.
> - *
> - * Since this interface is intended for use by migration paths, we
> - * relax locking here to avoid taking global locks - while accepting
> - * there may be rare scenarios where the result may be innaccurate.
> + * The reference taken via cgroup_get_e_css is sufficient to
> + * protect css, but it does not imply safe accesses to effective_mems.
> *
> - * Reclaim and migration are subject to these same race conditions, and
> - * cannot make strong isolation guarantees, so this is acceptable.
> + * Normally, accessing effective_mems would require the cpuset_mutex
> + * or callback_lock - but the correctness of this information is stale
> + * immediately after the query anyway. We do not acquire the lock
> + * during this process to save lock contention in exchange for racing
> + * against mems_allowed rebinds.
> */
> cs = container_of(css, struct cpuset, css);
> - allowed = node_isset(nid, cs->effective_mems);
> + nodes_copy(*mask, cs->effective_mems);
> css_put(css);
> - return allowed;
> }
>
> /**
> diff --git a/mm/memcontrol.c b/mm/memcontrol.c
> index 86f43b7e5f71..702c3db624a0 100644
> --- a/mm/memcontrol.c
> +++ b/mm/memcontrol.c
> @@ -5624,9 +5624,21 @@ subsys_initcall(mem_cgroup_swap_init);
>
> #endif /* CONFIG_SWAP */
>
> -bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid)
> +void mem_cgroup_node_filter_allowed(struct mem_cgroup *memcg, nodemask_t *mask)
> {
> - return memcg ? cpuset_node_allowed(memcg->css.cgroup, nid) : true;
> + nodemask_t allowed;
> +
> + if (!memcg)
> + return;
> +
> + /*
> + * Since this interface is intended for use by migration paths, and
> + * reclaim and migration are subject to race conditions such as changes
> + * in effective_mems and hot-unpluging of nodes, inaccurate allowed
> + * mask is acceptable.
> + */
> + cpuset_nodes_allowed(memcg->css.cgroup, &allowed);
> + nodes_and(*mask, *mask, allowed);
> }
>
If this is acceptable, it looks good to me.
> void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg)
> diff --git a/mm/vmscan.c b/mm/vmscan.c
> index 670fe9fae5ba..eed1becfcb34 100644
> --- a/mm/vmscan.c
> +++ b/mm/vmscan.c
> @@ -344,19 +344,21 @@ static void flush_reclaim_state(struct scan_control *sc)
> static bool can_demote(int nid, struct scan_control *sc,
> struct mem_cgroup *memcg)
> {
> - int demotion_nid;
> + struct pglist_data *pgdat = NODE_DATA(nid);
> + nodemask_t allowed_mask;
>
> - if (!numa_demotion_enabled)
> + if (!pgdat || !numa_demotion_enabled)
> return false;
> if (sc && sc->no_demotion)
> return false;
>
> - demotion_nid = next_demotion_node(nid);
> - if (demotion_nid == NUMA_NO_NODE)
> + node_get_allowed_targets(pgdat, &allowed_mask);
> + if (nodes_empty(allowed_mask))
> return false;
>
> - /* If demotion node isn't in the cgroup's mems_allowed, fall back */
> - return mem_cgroup_node_allowed(memcg, demotion_nid);
> + /* Filter out nodes that are not in cgroup's mems_allowed. */
> + mem_cgroup_node_filter_allowed(memcg, &allowed_mask);
> + return !nodes_empty(allowed_mask);
> }
>
> static inline bool can_reclaim_anon_pages(struct mem_cgroup *memcg,
> @@ -1019,7 +1021,8 @@ static struct folio *alloc_demote_folio(struct folio *src,
> * Folios which are not demoted are left on @demote_folios.
> */
> static unsigned int demote_folio_list(struct list_head *demote_folios,
> - struct pglist_data *pgdat)
> + struct pglist_data *pgdat,
> + struct mem_cgroup *memcg)
> {
> int target_nid = next_demotion_node(pgdat->node_id);
> unsigned int nr_succeeded;
> @@ -1033,7 +1036,6 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
> */
> .gfp_mask = (GFP_HIGHUSER_MOVABLE & ~__GFP_RECLAIM) |
> __GFP_NOMEMALLOC | GFP_NOWAIT,
> - .nid = target_nid,
> .nmask = &allowed_mask,
> .reason = MR_DEMOTION,
> };
> @@ -1041,10 +1043,14 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
> if (list_empty(demote_folios))
> return 0;
>
> - if (target_nid == NUMA_NO_NODE)
> - return 0;
> -
> node_get_allowed_targets(pgdat, &allowed_mask);
> + mem_cgroup_node_filter_allowed(memcg, &allowed_mask);
> + if (nodes_empty(allowed_mask))
> + return false;
> +
> + if (!node_isset(target_nid, allowed_mask))
> + target_nid = node_random(&allowed_mask);
> + mtc.nid = target_nid;
>
> /* Demotion ignores all cpuset and mempolicy settings */
> migrate_pages(demote_folios, alloc_demote_folio, NULL,
> @@ -1566,7 +1572,7 @@ static unsigned int shrink_folio_list(struct list_head *folio_list,
> /* 'folio_list' is always empty here */
>
> /* Migrate folios selected for demotion */
> - nr_demoted = demote_folio_list(&demote_folios, pgdat);
> + nr_demoted = demote_folio_list(&demote_folios, pgdat, memcg);
> nr_reclaimed += nr_demoted;
> stat->nr_demoted += nr_demoted;
> /* Folios that could not be demoted are still in @demote_folios */
> --
> 2.52.0.358.g0dd7633a29-goog
Reviewed-by: Chen Ridong <chenridong@huawei.com>
--
Best regards,
Ridong
^ permalink raw reply [flat|nested] 54+ messages in thread* [PATCH v7 0/2] mm/vmscan: fix demotion targets checks in reclaim/demotion
2026-01-06 7:56 ` [PATCH v6] " Bing Jiao
` (2 preceding siblings ...)
2026-01-07 1:27 ` Chen Ridong
@ 2026-01-08 3:32 ` Bing Jiao
2026-01-08 3:32 ` [PATCH v7 1/2] " Bing Jiao
` (2 more replies)
3 siblings, 3 replies; 54+ messages in thread
From: Bing Jiao @ 2026-01-08 3:32 UTC (permalink / raw)
To: linux-mm
Cc: linux-kernel, akpm, gourry, longman, hannes, mhocko,
roman.gushchin, shakeel.butt, muchun.song, tj, mkoutny, david,
zhengqi.arch, lorenzo.stoakes, axelrasmussen, chenridong, yuanchu,
weixugc, cgroups, joshua.hahnjy, bingjiao
Hi Andrew,
I am sorry for issuing a new patch version after v6 has been merged into
mm-hotfixes-unstable.
Main updates in v7:
1. Fixed a bug in v6.
Specifically, next_demotion_node() may return NUMA_NO_NODE if nodes
were hot-unplugged. V6 directly checks
node_isset(target_nid, allowed_mask), which will cause out-of-boundary
bug if target_nid is NUMA_NO_NODE (-1).
2. Preferred node selection.
[Patch 1/2] originally implemented a random selection from
allowed nodes if the preferred node from next_demotion_node()
was missing from mems_allowed. This behavior contradicts the
purpose of migration_target_control.nid, which is intended to
identify the preferred node nearest to the source.
To resolve this inconsistency, incorporat the preferred node
selection patch into this series.
If there is a consensus among reviewers to backport Patch 2/2
alongside Patch 1/2, they can be combined.
Otherwise, I will post Patch 2/2 in another series.
Many thanks!
Best regards,
Bing
Bing Jiao (2):
mm/vmscan: fix demotion targets checks in reclaim/demotion
mm/vmscan: select the closest preferred node in demote_folio_list()
include/linux/cpuset.h | 6 ++--
include/linux/memcontrol.h | 6 ++--
include/linux/memory-tiers.h | 6 ++--
kernel/cgroup/cpuset.c | 54 ++++++++++++++++++++++++------------
mm/memcontrol.c | 16 +++++++++--
mm/memory-tiers.c | 11 +++++---
mm/vmscan.c | 49 +++++++++++++++++++++++++-------
7 files changed, 105 insertions(+), 43 deletions(-)
--
2.52.0.457.g6b5491de43-goog
^ permalink raw reply [flat|nested] 54+ messages in thread* [PATCH v7 1/2] mm/vmscan: fix demotion targets checks in reclaim/demotion
2026-01-08 3:32 ` [PATCH v7 0/2] " Bing Jiao
@ 2026-01-08 3:32 ` Bing Jiao
2026-01-08 3:32 ` [PATCH v7 2/2] mm/vmscan: select the closest preferred node in demote_folio_list() Bing Jiao
2026-01-14 6:59 ` [PATCH v8 0/2] mm/vmscan: select the closest preferred node " Bing Jiao
2 siblings, 0 replies; 54+ messages in thread
From: Bing Jiao @ 2026-01-08 3:32 UTC (permalink / raw)
To: linux-mm
Cc: linux-kernel, akpm, gourry, longman, hannes, mhocko,
roman.gushchin, shakeel.butt, muchun.song, tj, mkoutny, david,
zhengqi.arch, lorenzo.stoakes, axelrasmussen, chenridong, yuanchu,
weixugc, cgroups, joshua.hahnjy, bingjiao
Fix two bugs in demote_folio_list() and can_demote() due to incorrect
demotion target checks in reclaim/demotion.
Commit 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
introduces the cpuset.mems_effective check and applies it to can_demote().
However:
1. It does not apply this check in demote_folio_list(), which leads
to situations where pages are demoted to nodes that are
explicitly excluded from the task's cpuset.mems.
2. It checks only the nodes in the immediate next demotion hierarchy
and does not check all allowed demotion targets in can_demote().
This can cause pages to never be demoted if the nodes in the next
demotion hierarchy are not set in mems_effective.
These bugs break resource isolation provided by cpuset.mems. This is
visible from userspace because pages can either fail to be demoted
entirely or are demoted to nodes that are not allowed in multi-tier memory
systems.
To address these bugs, update cpuset_node_allowed() to return
effective_mems and mem_cgroup_node_allowed() to filter out nodes
that are not set in effective_mems. Also update can_demote()
and demote_folio_list() accordingly.
Bug 1 reproduction:
Assume a system with 4 nodes, where nodes 0-1 are top-tier and
nodes 2-3 are far-tier memory. All nodes have equal capacity.
Test script:
echo 1 > /sys/kernel/mm/numa/demotion_enabled
mkdir /sys/fs/cgroup/test
echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
echo "0-2" > /sys/fs/cgroup/test/cpuset.mems
echo $$ > /sys/fs/cgroup/test/cgroup.procs
swapoff -a
# Expectation: Should respect node 0-2 limit.
# Observation: Node 3 shows significant allocation (MemFree drops)
stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1
Bug 2 reproduction:
Assume a system with 6 nodes, where nodes 0-2 are top-tier,
node 3 is a far-tier node, and nodes 4-5 are the farthest-tier nodes.
All nodes have equal capacity.
Test script:
echo 1 > /sys/kernel/mm/numa/demotion_enabled
mkdir /sys/fs/cgroup/test
echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
echo "0-2,4-5" > /sys/fs/cgroup/test/cpuset.mems
echo $$ > /sys/fs/cgroup/test/cgroup.procs
swapoff -a
# Expectation: Pages are demoted to Nodes 4-5
# Observation: No pages are demoted before oom.
stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1,2
Fixes: 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
Signed-off-by: Bing Jiao <bingjiao@google.com>
Cc: <stable@vger.kernel.org>
---
v6 -> v7: fix buggy code in v6.
Specifically, next_demotion_node() may return NUMA_NO_NODE if nodes were
hot-unplugged. V6 directly checks node_isset(target_nid, allowed_mask),
which will cause out-of-boundary bug if target_nid is NUMA_NO_NODE (-1).
---
include/linux/cpuset.h | 6 ++---
include/linux/memcontrol.h | 6 ++---
kernel/cgroup/cpuset.c | 54 +++++++++++++++++++++++++-------------
mm/memcontrol.c | 16 +++++++++--
mm/vmscan.c | 28 +++++++++++++-------
5 files changed, 75 insertions(+), 35 deletions(-)
diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h
index a98d3330385c..631577384677 100644
--- a/include/linux/cpuset.h
+++ b/include/linux/cpuset.h
@@ -174,7 +174,7 @@ static inline void set_mems_allowed(nodemask_t nodemask)
task_unlock(current);
}
-extern bool cpuset_node_allowed(struct cgroup *cgroup, int nid);
+extern void cpuset_nodes_allowed(struct cgroup *cgroup, nodemask_t *mask);
#else /* !CONFIG_CPUSETS */
static inline bool cpusets_enabled(void) { return false; }
@@ -301,9 +301,9 @@ static inline bool read_mems_allowed_retry(unsigned int seq)
return false;
}
-static inline bool cpuset_node_allowed(struct cgroup *cgroup, int nid)
+static inline void cpuset_nodes_allowed(struct cgroup *cgroup, nodemask_t *mask)
{
- return true;
+ nodes_copy(*mask, node_states[N_MEMORY]);
}
#endif /* !CONFIG_CPUSETS */
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 0651865a4564..412db7663357 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -1744,7 +1744,7 @@ static inline void count_objcg_events(struct obj_cgroup *objcg,
rcu_read_unlock();
}
-bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid);
+void mem_cgroup_node_filter_allowed(struct mem_cgroup *memcg, nodemask_t *mask);
void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg);
@@ -1815,9 +1815,9 @@ static inline ino_t page_cgroup_ino(struct page *page)
return 0;
}
-static inline bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid)
+static inline void mem_cgroup_node_filter_allowed(struct mem_cgroup *memcg,
+ nodemask_t *mask)
{
- return true;
}
static inline void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg)
diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index 6e6eb09b8db6..289fb1a72550 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -4416,40 +4416,58 @@ bool cpuset_current_node_allowed(int node, gfp_t gfp_mask)
return allowed;
}
-bool cpuset_node_allowed(struct cgroup *cgroup, int nid)
+/**
+ * cpuset_nodes_allowed - return effective_mems mask from a cgroup cpuset.
+ * @cgroup: pointer to struct cgroup.
+ * @mask: pointer to struct nodemask_t to be returned.
+ *
+ * Returns effective_mems mask from a cgroup cpuset if it is cgroup v2 and
+ * has cpuset subsys. Otherwise, returns node_states[N_MEMORY].
+ *
+ * This function intentionally avoids taking the cpuset_mutex or callback_lock
+ * when accessing effective_mems. This is because the obtained effective_mems
+ * is stale immediately after the query anyway (e.g., effective_mems is updated
+ * immediately after releasing the lock but before returning).
+ *
+ * As a result, returned @mask may be empty because cs->effective_mems can be
+ * rebound during this call. Besides, nodes in @mask are not guaranteed to be
+ * online due to hot plugins. Callers should check the mask for validity on
+ * return based on its subsequent use.
+ **/
+void cpuset_nodes_allowed(struct cgroup *cgroup, nodemask_t *mask)
{
struct cgroup_subsys_state *css;
struct cpuset *cs;
- bool allowed;
/*
* In v1, mem_cgroup and cpuset are unlikely in the same hierarchy
* and mems_allowed is likely to be empty even if we could get to it,
- * so return true to avoid taking a global lock on the empty check.
+ * so return directly to avoid taking a global lock on the empty check.
*/
- if (!cpuset_v2())
- return true;
+ if (!cgroup || !cpuset_v2()) {
+ nodes_copy(*mask, node_states[N_MEMORY]);
+ return;
+ }
css = cgroup_get_e_css(cgroup, &cpuset_cgrp_subsys);
- if (!css)
- return true;
+ if (!css) {
+ nodes_copy(*mask, node_states[N_MEMORY]);
+ return;
+ }
/*
- * Normally, accessing effective_mems would require the cpuset_mutex
- * or callback_lock - but node_isset is atomic and the reference
- * taken via cgroup_get_e_css is sufficient to protect css.
- *
- * Since this interface is intended for use by migration paths, we
- * relax locking here to avoid taking global locks - while accepting
- * there may be rare scenarios where the result may be innaccurate.
+ * The reference taken via cgroup_get_e_css is sufficient to
+ * protect css, but it does not imply safe accesses to effective_mems.
*
- * Reclaim and migration are subject to these same race conditions, and
- * cannot make strong isolation guarantees, so this is acceptable.
+ * Normally, accessing effective_mems would require the cpuset_mutex
+ * or callback_lock - but the correctness of this information is stale
+ * immediately after the query anyway. We do not acquire the lock
+ * during this process to save lock contention in exchange for racing
+ * against mems_allowed rebinds.
*/
cs = container_of(css, struct cpuset, css);
- allowed = node_isset(nid, cs->effective_mems);
+ nodes_copy(*mask, cs->effective_mems);
css_put(css);
- return allowed;
}
/**
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 86f43b7e5f71..702c3db624a0 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -5624,9 +5624,21 @@ subsys_initcall(mem_cgroup_swap_init);
#endif /* CONFIG_SWAP */
-bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid)
+void mem_cgroup_node_filter_allowed(struct mem_cgroup *memcg, nodemask_t *mask)
{
- return memcg ? cpuset_node_allowed(memcg->css.cgroup, nid) : true;
+ nodemask_t allowed;
+
+ if (!memcg)
+ return;
+
+ /*
+ * Since this interface is intended for use by migration paths, and
+ * reclaim and migration are subject to race conditions such as changes
+ * in effective_mems and hot-unpluging of nodes, inaccurate allowed
+ * mask is acceptable.
+ */
+ cpuset_nodes_allowed(memcg->css.cgroup, &allowed);
+ nodes_and(*mask, *mask, allowed);
}
void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg)
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 670fe9fae5ba..94ff5aa7c4fb 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -344,19 +344,21 @@ static void flush_reclaim_state(struct scan_control *sc)
static bool can_demote(int nid, struct scan_control *sc,
struct mem_cgroup *memcg)
{
- int demotion_nid;
+ struct pglist_data *pgdat = NODE_DATA(nid);
+ nodemask_t allowed_mask;
- if (!numa_demotion_enabled)
+ if (!pgdat || !numa_demotion_enabled)
return false;
if (sc && sc->no_demotion)
return false;
- demotion_nid = next_demotion_node(nid);
- if (demotion_nid == NUMA_NO_NODE)
+ node_get_allowed_targets(pgdat, &allowed_mask);
+ if (nodes_empty(allowed_mask))
return false;
- /* If demotion node isn't in the cgroup's mems_allowed, fall back */
- return mem_cgroup_node_allowed(memcg, demotion_nid);
+ /* Filter out nodes that are not in cgroup's mems_allowed. */
+ mem_cgroup_node_filter_allowed(memcg, &allowed_mask);
+ return !nodes_empty(allowed_mask);
}
static inline bool can_reclaim_anon_pages(struct mem_cgroup *memcg,
@@ -1019,7 +1021,8 @@ static struct folio *alloc_demote_folio(struct folio *src,
* Folios which are not demoted are left on @demote_folios.
*/
static unsigned int demote_folio_list(struct list_head *demote_folios,
- struct pglist_data *pgdat)
+ struct pglist_data *pgdat,
+ struct mem_cgroup *memcg)
{
int target_nid = next_demotion_node(pgdat->node_id);
unsigned int nr_succeeded;
@@ -1033,7 +1036,6 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
*/
.gfp_mask = (GFP_HIGHUSER_MOVABLE & ~__GFP_RECLAIM) |
__GFP_NOMEMALLOC | GFP_NOWAIT,
- .nid = target_nid,
.nmask = &allowed_mask,
.reason = MR_DEMOTION,
};
@@ -1042,9 +1044,17 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
return 0;
if (target_nid == NUMA_NO_NODE)
+ /* No lower-tier nodes or nodes were hot-unplugged. */
return 0;
node_get_allowed_targets(pgdat, &allowed_mask);
+ mem_cgroup_node_filter_allowed(memcg, &allowed_mask);
+ if (nodes_empty(allowed_mask))
+ return 0;
+
+ if (!node_isset(target_nid, allowed_mask))
+ target_nid = node_random(&allowed_mask);
+ mtc.nid = target_nid;
/* Demotion ignores all cpuset and mempolicy settings */
migrate_pages(demote_folios, alloc_demote_folio, NULL,
@@ -1566,7 +1576,7 @@ static unsigned int shrink_folio_list(struct list_head *folio_list,
/* 'folio_list' is always empty here */
/* Migrate folios selected for demotion */
- nr_demoted = demote_folio_list(&demote_folios, pgdat);
+ nr_demoted = demote_folio_list(&demote_folios, pgdat, memcg);
nr_reclaimed += nr_demoted;
stat->nr_demoted += nr_demoted;
/* Folios that could not be demoted are still in @demote_folios */
--
2.52.0.457.g6b5491de43-goog
^ permalink raw reply related [flat|nested] 54+ messages in thread* [PATCH v7 2/2] mm/vmscan: select the closest preferred node in demote_folio_list()
2026-01-08 3:32 ` [PATCH v7 0/2] " Bing Jiao
2026-01-08 3:32 ` [PATCH v7 1/2] " Bing Jiao
@ 2026-01-08 3:32 ` Bing Jiao
2026-01-10 3:00 ` [PATCH] mm/vmscan: fix uninitialized variable " Bing Jiao
2026-01-10 3:38 ` Bing Jiao
2026-01-14 6:59 ` [PATCH v8 0/2] mm/vmscan: select the closest preferred node " Bing Jiao
2 siblings, 2 replies; 54+ messages in thread
From: Bing Jiao @ 2026-01-08 3:32 UTC (permalink / raw)
To: linux-mm
Cc: linux-kernel, akpm, gourry, longman, hannes, mhocko,
roman.gushchin, shakeel.butt, muchun.song, tj, mkoutny, david,
zhengqi.arch, lorenzo.stoakes, axelrasmussen, chenridong, yuanchu,
weixugc, cgroups, joshua.hahnjy, bingjiao
The preferred demotion node (migration_target_control.nid) should be
the one closest to the source node to minimize migration latency.
Currently, a discrepancy exists where demote_folio_list() randomly
selects an allowed node if the preferred node from next_demotion_node()
is not set in mems_allowed.
To address it, update next_demotion_node() to return preferred nodes,
allowing the caller to select the preferred one.
Also update demote_folio_list() to traverse the demotion targets
hierarchically until a preferred node within mems_allowed is found.
It ensures that the selected demotion target is consistently
the closest available node.
Signed-off-by: Bing Jiao <bingjiao@google.com>
---
include/linux/memory-tiers.h | 6 +++---
mm/memory-tiers.c | 11 +++++++----
mm/vmscan.c | 25 ++++++++++++++++++++++---
3 files changed, 32 insertions(+), 10 deletions(-)
diff --git a/include/linux/memory-tiers.h b/include/linux/memory-tiers.h
index 7a805796fcfd..87652042f2c2 100644
--- a/include/linux/memory-tiers.h
+++ b/include/linux/memory-tiers.h
@@ -53,11 +53,11 @@ struct memory_dev_type *mt_find_alloc_memory_type(int adist,
struct list_head *memory_types);
void mt_put_memory_types(struct list_head *memory_types);
#ifdef CONFIG_MIGRATION
-int next_demotion_node(int node);
+int next_demotion_node(int node, nodemask_t *preferred_nodes);
void node_get_allowed_targets(pg_data_t *pgdat, nodemask_t *targets);
bool node_is_toptier(int node);
#else
-static inline int next_demotion_node(int node)
+static inline int next_demotion_node(int node, nodemask_t *preferred_nodes)
{
return NUMA_NO_NODE;
}
@@ -101,7 +101,7 @@ static inline void clear_node_memory_type(int node, struct memory_dev_type *memt
}
-static inline int next_demotion_node(int node)
+static inline int next_demotion_node(int node, nodemask_t *preferred_nodes)
{
return NUMA_NO_NODE;
}
diff --git a/mm/memory-tiers.c b/mm/memory-tiers.c
index 864811fff409..286e4b5fa0e5 100644
--- a/mm/memory-tiers.c
+++ b/mm/memory-tiers.c
@@ -320,13 +320,14 @@ void node_get_allowed_targets(pg_data_t *pgdat, nodemask_t *targets)
/**
* next_demotion_node() - Get the next node in the demotion path
* @node: The starting node to lookup the next node
+ * @preferred_nodes: The pointer to nodemask of all preferred nodes to return
*
* Return: node id for next memory node in the demotion path hierarchy
- * from @node; NUMA_NO_NODE if @node is terminal. This does not keep
- * @node online or guarantee that it *continues* to be the next demotion
- * target.
+ * from @node; NUMA_NO_NODE if @node is terminal. Also returns all preferred
+ * nodes in @preferred_nodes. This does not keep @node online or guarantee
+ * that it *continues* to be the next demotion target.
*/
-int next_demotion_node(int node)
+int next_demotion_node(int node, nodemask_t *preferred_nodes)
{
struct demotion_nodes *nd;
int target;
@@ -357,6 +358,8 @@ int next_demotion_node(int node)
* target node randomly seems better until now.
*/
target = node_random(&nd->preferred);
+ if (preferred_nodes)
+ nodes_copy(*preferred_nodes, nd->preferred);
rcu_read_unlock();
return target;
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 94ff5aa7c4fb..213ee75b3306 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1024,9 +1024,10 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
struct pglist_data *pgdat,
struct mem_cgroup *memcg)
{
- int target_nid = next_demotion_node(pgdat->node_id);
+ int target_nid;
unsigned int nr_succeeded;
nodemask_t allowed_mask;
+ nodemask_t preferred;
struct migration_target_control mtc = {
/*
@@ -1052,8 +1053,26 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
if (nodes_empty(allowed_mask))
return 0;
- if (!node_isset(target_nid, allowed_mask))
- target_nid = node_random(&allowed_mask);
+ target_nid = next_demotion_node(pgdat->node_id, &preferred);
+ while (target_nid != NUMA_NO_NODE &&
+ !node_isset(target_nid, allowed_mask)) {
+ /* Filter out preferred nodes that are not in allowed. */
+ nodes_and(preferred, preferred, allowed_mask);
+ if (!nodes_empty(preferred)) {
+ /* Randomly select one node from preferred. */
+ target_nid = node_random(&preferred);
+ break;
+ }
+ /*
+ * Preferred nodes in the lower tier are not set in allowed.
+ * Recursively get preferred from the next lower tier.
+ */
+ target_nid = next_demotion_node(target_nid, &preferred);
+ }
+
+ if (target_nid == NUMA_NO_NODE)
+ /* Nodes are gone (e.g., hot-unplugged). */
+ return 0;
mtc.nid = target_nid;
/* Demotion ignores all cpuset and mempolicy settings */
--
2.52.0.457.g6b5491de43-goog
^ permalink raw reply related [flat|nested] 54+ messages in thread* [PATCH] mm/vmscan: fix uninitialized variable in demote_folio_list()
2026-01-08 3:32 ` [PATCH v7 2/2] mm/vmscan: select the closest preferred node in demote_folio_list() Bing Jiao
@ 2026-01-10 3:00 ` Bing Jiao
2026-01-10 3:38 ` Bing Jiao
1 sibling, 0 replies; 54+ messages in thread
From: Bing Jiao @ 2026-01-10 3:00 UTC (permalink / raw)
To: akpm
Cc: linux-mm, gourry, longman, hannes, mhocko, roman.gushchin,
shakeel.butt, muchun.song, tj, mkoutny, david, zhengqi.arch,
lorenzo.stoakes, axelrasmussen, chenridong, yuanchu, weixugc,
joshua.hahnjy, sj, bingjiao
Commit d92027a5f30a6c ("mm/vmscan: select the closest preferred node in
demote_folio_list()") refactored the selection logic for demotion target
nodes. However, it removed the initial assignment of 'target_nid' while
leaving a premature check for 'NUMA_NO_NODE' in place.
Since 'target_nid' is now assigned further down in the function based on
preferred and allowed node masks, the initial check at line 1046 is
redundant.
Remove the redundant check to resolve the compiler warning.
Link: https://lkml.kernel.org/r/20260109055937.3739860-1-bingjiao@google.com
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202601091037.vUSHeJCH-lkp@intel.com/
Fixes: d92027a5f30a6c ("mm/vmscan: select the closest preferred node in demote_folio_list()")
Signed-off-by: Bing Jiao <bingjiao@google.com>
Reviewed-by: SeongJae Park <sj@kernel.org>
---
Hi Andrew,
Sorry for bother you again in my patch series.
There is a broken commit in mm-new branch, which is introduced by this
patch series, Commit d92027a5f30a6c ("mm/vmscan: select the closest
preferred node in demote_folio_list()").
As the broken commit is currently only in *mm-new*, could you please
squash the fix into the broken commit before it is pulled into
the mainline?
Thanks for your time!
Best regards,
Bing
---
mm/vmscan.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 213ee75b3306..590ab3ec1998 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1044,10 +1044,6 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
if (list_empty(demote_folios))
return 0;
- if (target_nid == NUMA_NO_NODE)
- /* No lower-tier nodes or nodes were hot-unplugged. */
- return 0;
-
node_get_allowed_targets(pgdat, &allowed_mask);
mem_cgroup_node_filter_allowed(memcg, &allowed_mask);
if (nodes_empty(allowed_mask))
--
2.52.0.457.g6b5491de43-goog
^ permalink raw reply related [flat|nested] 54+ messages in thread* [PATCH] mm/vmscan: fix uninitialized variable in demote_folio_list()
2026-01-08 3:32 ` [PATCH v7 2/2] mm/vmscan: select the closest preferred node in demote_folio_list() Bing Jiao
2026-01-10 3:00 ` [PATCH] mm/vmscan: fix uninitialized variable " Bing Jiao
@ 2026-01-10 3:38 ` Bing Jiao
1 sibling, 0 replies; 54+ messages in thread
From: Bing Jiao @ 2026-01-10 3:38 UTC (permalink / raw)
To: linux-mm
Cc: akpm, gourry, longman, hannes, mhocko, roman.gushchin,
shakeel.butt, muchun.song, tj, mkoutny, david, zhengqi.arch,
lorenzo.stoakes, axelrasmussen, chenridong, yuanchu, weixugc,
joshua.hahnjy, sj, bingjiao
Commit d92027a5f30a6c ("mm/vmscan: select the closest preferred node in
demote_folio_list()") refactored the selection logic for demotion target
nodes. However, it removed the initial assignment of 'target_nid' while
leaving a premature check for 'NUMA_NO_NODE' in place.
Since 'target_nid' is now assigned further down in the function based on
preferred and allowed node masks, the initial check at line 1046 is
redundant.
Remove the redundant check to resolve the compiler warning.
Link: https://lkml.kernel.org/r/20260109055937.3739860-1-bingjiao@google.com
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202601091037.vUSHeJCH-lkp@intel.com/
Fixes: d92027a5f30a6c ("mm/vmscan: select the closest preferred node in demote_folio_list()")
Signed-off-by: Bing Jiao <bingjiao@google.com>
Reviewed-by: SeongJae Park <sj@kernel.org>
---
Hi Andrew,
Sorry for bother you again in my patch series.
There is a broken commit in mm-new branch, which is introduced by this
patch series, Commit d92027a5f30a6c ("mm/vmscan: select the closest
preferred node in demote_folio_list()").
As the broken commit is currently only in *mm-new*, could you please
squash the fix into the broken commit before it is pulled into
the mainline?
Thanks for your time!
Best regards,
Bing
---
mm/vmscan.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 213ee75b3306..590ab3ec1998 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1044,10 +1044,6 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
if (list_empty(demote_folios))
return 0;
- if (target_nid == NUMA_NO_NODE)
- /* No lower-tier nodes or nodes were hot-unplugged. */
- return 0;
-
node_get_allowed_targets(pgdat, &allowed_mask);
mem_cgroup_node_filter_allowed(memcg, &allowed_mask);
if (nodes_empty(allowed_mask))
--
2.52.0.457.g6b5491de43-goog
^ permalink raw reply related [flat|nested] 54+ messages in thread
* [PATCH v8 0/2] mm/vmscan: select the closest preferred node in demote_folio_list()
2026-01-08 3:32 ` [PATCH v7 0/2] " Bing Jiao
2026-01-08 3:32 ` [PATCH v7 1/2] " Bing Jiao
2026-01-08 3:32 ` [PATCH v7 2/2] mm/vmscan: select the closest preferred node in demote_folio_list() Bing Jiao
@ 2026-01-14 6:59 ` Bing Jiao
2026-01-14 6:59 ` [PATCH v8 2/2] " Bing Jiao
2026-01-14 20:53 ` [PATCH v9 0/2] mm/vmscan: fix demotion targets checks in reclaim/demotion Bing Jiao
2 siblings, 2 replies; 54+ messages in thread
From: Bing Jiao @ 2026-01-14 6:59 UTC (permalink / raw)
To: bingjiao
Cc: Andrew Morton, David Hildenbrand, Lorenzo Stoakes,
Liam R. Howlett, Vlastimil Babka, Mike Rapoport,
Suren Baghdasaryan, Michal Hocko, Axel Rasmussen, Yuanchu Xie,
Wei Xu, Johannes Weiner, Qi Zheng, Shakeel Butt, Gregory Price,
Joshua Hahn, chenridong, linux-mm, linux-kernel
[Patch v7 2/2] tries to traverse the demotion targets hierarchically
until a preferred node within mems_allowed is found.
However, node_demotion[node].preferred may not contain all nodes in the
next memory tier. For example, in the below typograph:
Top-tier Node 0 ---- Node 1
| |
| |
Far-tier Node 2 Node 3
node_demotion[0].preferred: [2]
node_demotion[1].preferred: [3]
node_demotion[2].preferred: []
node_demotion[3].preferred: []
If mems_allowed is [3], demote_folio_list() cannot find a valid demotion
target when demoting pages from Node 0. Because next_demotion_node(0)
returns Node 2 and [2], which are not in mems_allowed; the second call
to next_demotion_node(2) returns NUMA_NO_NODE.
This patch uses find_next_best_node() to find the closest node when all
preferred nodes are not in mems_allowed, mimicking the logic
of establish_demotion_targets().
Hi Andrew,
Could you please remove Commit fd8cb9a8cedc ("mm/vmscan: select the closest
preferred node in demote_folio_list()") and Commit 127714c76c46
("mm/vmscan: fix uninitialized variable in demote_folio_list()") from
the mm-unstable branch, as this patch serves as a full replacement for
both.
I suggest allowing some time for this to be thoroughly reviewed in case
there are any remaining edge cases or issues I overlooked.
Because no modifications to [Patch v7 1/2], I did not attach a new
version of it.
Thanks!
Best regards,
Bing
Bing Jiao (1):
mm/vmscan: select the closest preferred node in demote_folio_list()
include/linux/memory-tiers.h | 6 +++---
mm/memory-tiers.c | 11 +++++++----
mm/vmscan.c | 30 +++++++++++++++++++++++-------
3 files changed, 33 insertions(+), 14 deletions(-)
--
2.52.0.457.g6b5491de43-goog
^ permalink raw reply [flat|nested] 54+ messages in thread* [PATCH v8 2/2] mm/vmscan: select the closest preferred node in demote_folio_list()
2026-01-14 6:59 ` [PATCH v8 0/2] mm/vmscan: select the closest preferred node " Bing Jiao
@ 2026-01-14 6:59 ` Bing Jiao
2026-01-14 20:53 ` [PATCH v9 0/2] mm/vmscan: fix demotion targets checks in reclaim/demotion Bing Jiao
1 sibling, 0 replies; 54+ messages in thread
From: Bing Jiao @ 2026-01-14 6:59 UTC (permalink / raw)
To: bingjiao
Cc: Andrew Morton, David Hildenbrand, Lorenzo Stoakes,
Liam R. Howlett, Vlastimil Babka, Mike Rapoport,
Suren Baghdasaryan, Michal Hocko, Axel Rasmussen, Yuanchu Xie,
Wei Xu, Johannes Weiner, Qi Zheng, Shakeel Butt, Gregory Price,
Joshua Hahn, chenridong, linux-mm, linux-kernel
The preferred demotion node (migration_target_control.nid) should be the
one closest to the source node to minimize migration latency. Currently,
a discrepancy exists where demote_folio_list() randomly selects an allowed
node if the preferred node from next_demotion_node() is not set in
mems_allowed.
To address it, update next_demotion_node() to return preferred nodes,
allowing the caller to select the preferred one. Also update
demote_folio_list() to get the closest node from allowed if all
preferred nodes are not set in mems_allowed.
It ensures that the preferred demotion target is consistently the closest
available node to the source node.
Signed-off-by: Bing Jiao <bingjiao@google.com>
---
include/linux/memory-tiers.h | 6 +++---
mm/memory-tiers.c | 11 +++++++----
mm/vmscan.c | 30 +++++++++++++++++++++++-------
3 files changed, 33 insertions(+), 14 deletions(-)
diff --git a/include/linux/memory-tiers.h b/include/linux/memory-tiers.h
index 7a805796fcfd..87652042f2c2 100644
--- a/include/linux/memory-tiers.h
+++ b/include/linux/memory-tiers.h
@@ -53,11 +53,11 @@ struct memory_dev_type *mt_find_alloc_memory_type(int adist,
struct list_head *memory_types);
void mt_put_memory_types(struct list_head *memory_types);
#ifdef CONFIG_MIGRATION
-int next_demotion_node(int node);
+int next_demotion_node(int node, nodemask_t *preferred_nodes);
void node_get_allowed_targets(pg_data_t *pgdat, nodemask_t *targets);
bool node_is_toptier(int node);
#else
-static inline int next_demotion_node(int node)
+static inline int next_demotion_node(int node, nodemask_t *preferred_nodes)
{
return NUMA_NO_NODE;
}
@@ -101,7 +101,7 @@ static inline void clear_node_memory_type(int node, struct memory_dev_type *memt
}
-static inline int next_demotion_node(int node)
+static inline int next_demotion_node(int node, nodemask_t *preferred_nodes)
{
return NUMA_NO_NODE;
}
diff --git a/mm/memory-tiers.c b/mm/memory-tiers.c
index 20aab9c19c5e..c71a865e9dd8 100644
--- a/mm/memory-tiers.c
+++ b/mm/memory-tiers.c
@@ -320,13 +320,14 @@ void node_get_allowed_targets(pg_data_t *pgdat, nodemask_t *targets)
/**
* next_demotion_node() - Get the next node in the demotion path
* @node: The starting node to lookup the next node
+ * @preferred_nodes: The pointer to nodemask of all preferred nodes to return
*
* Return: node id for next memory node in the demotion path hierarchy
- * from @node; NUMA_NO_NODE if @node is terminal. This does not keep
- * @node online or guarantee that it *continues* to be the next demotion
- * target.
+ * from @node; NUMA_NO_NODE if @node is terminal. Also returns all preferred
+ * nodes in @preferred_nodes. This does not keep @node online or guarantee
+ * that it *continues* to be the next demotion target.
*/
-int next_demotion_node(int node)
+int next_demotion_node(int node, nodemask_t *preferred_nodes)
{
struct demotion_nodes *nd;
int target;
@@ -357,6 +358,8 @@ int next_demotion_node(int node)
* target node randomly seems better until now.
*/
target = node_random(&nd->preferred);
+ if (preferred_nodes)
+ nodes_copy(*preferred_nodes, nd->preferred);
rcu_read_unlock();
return target;
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 71617891bcde..18f4425bd750 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1023,9 +1023,10 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
struct pglist_data *pgdat,
struct mem_cgroup *memcg)
{
- int target_nid = next_demotion_node(pgdat->node_id);
+ int target_nid;
unsigned int nr_succeeded;
nodemask_t allowed_mask;
+ nodemask_t preferred;
struct migration_target_control mtc = {
/*
@@ -1042,17 +1043,32 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
if (list_empty(demote_folios))
return 0;
- if (target_nid == NUMA_NO_NODE)
- /* No lower-tier nodes or nodes were hot-unplugged. */
- return 0;
-
node_get_allowed_targets(pgdat, &allowed_mask);
mem_cgroup_node_filter_allowed(memcg, &allowed_mask);
if (nodes_empty(allowed_mask))
return 0;
- if (!node_isset(target_nid, allowed_mask))
- target_nid = node_random(&allowed_mask);
+ target_nid = next_demotion_node(pgdat->node_id, &preferred);
+ if (target_nid == NUMA_NO_NODE)
+ /* No lower-tier nodes (e.g., nodes were hot-unplugged) */
+ return 0;
+
+ if (!node_isset(target_nid, allowed_mask)) {
+ /* Filter out preferred nodes that are not in allowed. */
+ nodes_and(preferred, preferred, allowed_mask);
+ if (!nodes_empty(preferred)) {
+ /* Randomly select one node from preferred. */
+ target_nid = node_random(&preferred);
+ } else {
+ /* Get the closest node from allowed. */
+ nodes_complement(preferred, allowed_mask);
+ target_nid = find_next_best_node(pgdat->node_id,
+ &preferred);
+ if (target_nid == NUMA_NO_NODE)
+ return 0;
+ }
+ }
+
mtc.nid = target_nid;
/* Demotion ignores all cpuset and mempolicy settings */
--
2.52.0.457.g6b5491de43-goog
^ permalink raw reply related [flat|nested] 54+ messages in thread* [PATCH v9 0/2] mm/vmscan: fix demotion targets checks in reclaim/demotion
2026-01-14 6:59 ` [PATCH v8 0/2] mm/vmscan: select the closest preferred node " Bing Jiao
2026-01-14 6:59 ` [PATCH v8 2/2] " Bing Jiao
@ 2026-01-14 20:53 ` Bing Jiao
2026-01-14 20:53 ` [PATCH v9 1/2] " Bing Jiao
` (3 more replies)
1 sibling, 4 replies; 54+ messages in thread
From: Bing Jiao @ 2026-01-14 20:53 UTC (permalink / raw)
To: bingjiao
Cc: Andrew Morton, David Hildenbrand, Lorenzo Stoakes,
Liam R. Howlett, Vlastimil Babka, Mike Rapoport,
Suren Baghdasaryan, Michal Hocko, Axel Rasmussen, Yuanchu Xie,
Wei Xu, Johannes Weiner, Qi Zheng, Shakeel Butt, Gregory Price,
Joshua Hahn, muchun.song, roman.gushchin, tj, longman, chenridong,
linux-mm, linux-kernel, cgroups
This patch series addresses two issues in demote_folio_list(),
can_demote(), and next_demotion_node() in reclaim/demotion.
1. demote_folio_list() and can_demote() do not correctly check demotion
target against cpuset.mems_effective, which will cause (a) pages are
demoted to not-allowed nodes and (b) pages are failed to demote even
if the system still have allowed demotion nodes.
Patch 1 fixes this bug by update cpuset_node_allowed() and
mem_cgroup_node_allowed() to return effective_mems, allowing directly
logic-and operation against demotion targets.
2. next_demotion_node() returns a preferred demotion target, but it does
check the node against allowed nodes.
Patch 2 ensures that next_demotion_node() filters against the allowed
node mask and selects the closest demotion target to the source node.
===
Hi Andrew,
Sorry for the extra noise in your inbox.
I’m resubmitting the full refreshed patch series together this time.
I just realized it is better to include the unmodified patches alongside
the modified ones to ensure compatibility with upstream automated tools
and to simplify your review process.
The refreshed patch series replaces some commits in mm-untable,
including:
- Commit 809cc3db1831 ("mm/vmscan: fix demotion targets checks in
reclaim/demotion")
- Commit fd8cb9a8cedc ("mm/vmscan: select the closest preferred node
in demote_folio_list()")
- Commit 127714c76c46 ("mm/vmscan: fix uninitialized variable in
demote_folio_list()")
Thanks!
Best regards,
Bing
Bing Jiao (2):
mm/vmscan: fix demotion targets checks in reclaim/demotion
mm/vmscan: select the closest perferred node in demote_folio_list()
include/linux/cpuset.h | 6 ++--
include/linux/memcontrol.h | 6 ++--
include/linux/memory-tiers.h | 6 ++--
kernel/cgroup/cpuset.c | 54 ++++++++++++++++++++++++------------
mm/memcontrol.c | 16 +++++++++--
mm/memory-tiers.c | 21 ++++++++++----
mm/vmscan.c | 31 +++++++++++++--------
7 files changed, 95 insertions(+), 45 deletions(-)
--
2.52.0.457.g6b5491de43-goog
^ permalink raw reply [flat|nested] 54+ messages in thread* [PATCH v9 1/2] mm/vmscan: fix demotion targets checks in reclaim/demotion
2026-01-14 20:53 ` [PATCH v9 0/2] mm/vmscan: fix demotion targets checks in reclaim/demotion Bing Jiao
@ 2026-01-14 20:53 ` Bing Jiao
2026-02-02 4:15 ` Shakeel Butt
2026-01-14 20:53 ` [PATCH v9 2/2] mm/vmscan: select the closest perferred node in demote_folio_list() Bing Jiao
` (2 subsequent siblings)
3 siblings, 1 reply; 54+ messages in thread
From: Bing Jiao @ 2026-01-14 20:53 UTC (permalink / raw)
To: bingjiao
Cc: Andrew Morton, David Hildenbrand, Lorenzo Stoakes,
Liam R. Howlett, Vlastimil Babka, Mike Rapoport,
Suren Baghdasaryan, Michal Hocko, Axel Rasmussen, Yuanchu Xie,
Wei Xu, Johannes Weiner, Qi Zheng, Shakeel Butt, Gregory Price,
Joshua Hahn, muchun.song, roman.gushchin, tj, longman, chenridong,
linux-mm, linux-kernel, cgroups
Fix two bugs in demote_folio_list() and can_demote() due to incorrect
demotion target checks against cpuset.mems_effective in reclaim/demotion.
Commit 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
introduces the cpuset.mems_effective check and applies it to can_demote().
However:
1. It does not apply this check in demote_folio_list(), which leads
to situations where pages are demoted to nodes that are
explicitly excluded from the task's cpuset.mems.
2. It checks only the nodes in the immediate next demotion hierarchy
and does not check all allowed demotion targets in can_demote().
This can cause pages to never be demoted if the nodes in the next
demotion hierarchy are not set in mems_effective.
These bugs break resource isolation provided by cpuset.mems. This is
visible from userspace because pages can either fail to be demoted
entirely or are demoted to nodes that are not allowed in multi-tier memory
systems.
To address these bugs, update cpuset_node_allowed() and
mem_cgroup_node_allowed() to return effective_mems, allowing directly
logic-and operation against demotion targets. Also update can_demote()
and demote_folio_list() accordingly.
Bug 1 reproduction:
Assume a system with 4 nodes, where nodes 0-1 are top-tier and
nodes 2-3 are far-tier memory. All nodes have equal capacity.
Test script:
echo 1 > /sys/kernel/mm/numa/demotion_enabled
mkdir /sys/fs/cgroup/test
echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
echo "0-2" > /sys/fs/cgroup/test/cpuset.mems
echo $$ > /sys/fs/cgroup/test/cgroup.procs
swapoff -a
# Expectation: Should respect node 0-2 limit.
# Observation: Node 3 shows significant allocation (MemFree drops)
stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1
Bug 2 reproduction:
Assume a system with 6 nodes, where nodes 0-2 are top-tier,
node 3 is a far-tier node, and nodes 4-5 are the farthest-tier nodes.
All nodes have equal capacity.
Test script:
echo 1 > /sys/kernel/mm/numa/demotion_enabled
mkdir /sys/fs/cgroup/test
echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
echo "0-2,4-5" > /sys/fs/cgroup/test/cpuset.mems
echo $$ > /sys/fs/cgroup/test/cgroup.procs
swapoff -a
# Expectation: Pages are demoted to Nodes 4-5
# Observation: No pages are demoted before oom.
stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1,2
Fixes: 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
Signed-off-by: Bing Jiao <bingjiao@google.com>
Cc: <stable@vger.kernel.org>
---
v7 -> v9:
Minor updates in demote_folio_list() for better code logic.
include/linux/cpuset.h | 6 ++---
include/linux/memcontrol.h | 6 ++---
kernel/cgroup/cpuset.c | 54 +++++++++++++++++++++++++-------------
mm/memcontrol.c | 16 +++++++++--
mm/vmscan.c | 34 +++++++++++++++---------
5 files changed, 78 insertions(+), 38 deletions(-)
diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h
index a98d3330385c..631577384677 100644
--- a/include/linux/cpuset.h
+++ b/include/linux/cpuset.h
@@ -174,7 +174,7 @@ static inline void set_mems_allowed(nodemask_t nodemask)
task_unlock(current);
}
-extern bool cpuset_node_allowed(struct cgroup *cgroup, int nid);
+extern void cpuset_nodes_allowed(struct cgroup *cgroup, nodemask_t *mask);
#else /* !CONFIG_CPUSETS */
static inline bool cpusets_enabled(void) { return false; }
@@ -301,9 +301,9 @@ static inline bool read_mems_allowed_retry(unsigned int seq)
return false;
}
-static inline bool cpuset_node_allowed(struct cgroup *cgroup, int nid)
+static inline void cpuset_nodes_allowed(struct cgroup *cgroup, nodemask_t *mask)
{
- return true;
+ nodes_copy(*mask, node_states[N_MEMORY]);
}
#endif /* !CONFIG_CPUSETS */
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 0651865a4564..412db7663357 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -1744,7 +1744,7 @@ static inline void count_objcg_events(struct obj_cgroup *objcg,
rcu_read_unlock();
}
-bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid);
+void mem_cgroup_node_filter_allowed(struct mem_cgroup *memcg, nodemask_t *mask);
void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg);
@@ -1815,9 +1815,9 @@ static inline ino_t page_cgroup_ino(struct page *page)
return 0;
}
-static inline bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid)
+static inline void mem_cgroup_node_filter_allowed(struct mem_cgroup *memcg,
+ nodemask_t *mask)
{
- return true;
}
static inline void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg)
diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index 6e6eb09b8db6..289fb1a72550 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -4416,40 +4416,58 @@ bool cpuset_current_node_allowed(int node, gfp_t gfp_mask)
return allowed;
}
-bool cpuset_node_allowed(struct cgroup *cgroup, int nid)
+/**
+ * cpuset_nodes_allowed - return effective_mems mask from a cgroup cpuset.
+ * @cgroup: pointer to struct cgroup.
+ * @mask: pointer to struct nodemask_t to be returned.
+ *
+ * Returns effective_mems mask from a cgroup cpuset if it is cgroup v2 and
+ * has cpuset subsys. Otherwise, returns node_states[N_MEMORY].
+ *
+ * This function intentionally avoids taking the cpuset_mutex or callback_lock
+ * when accessing effective_mems. This is because the obtained effective_mems
+ * is stale immediately after the query anyway (e.g., effective_mems is updated
+ * immediately after releasing the lock but before returning).
+ *
+ * As a result, returned @mask may be empty because cs->effective_mems can be
+ * rebound during this call. Besides, nodes in @mask are not guaranteed to be
+ * online due to hot plugins. Callers should check the mask for validity on
+ * return based on its subsequent use.
+ **/
+void cpuset_nodes_allowed(struct cgroup *cgroup, nodemask_t *mask)
{
struct cgroup_subsys_state *css;
struct cpuset *cs;
- bool allowed;
/*
* In v1, mem_cgroup and cpuset are unlikely in the same hierarchy
* and mems_allowed is likely to be empty even if we could get to it,
- * so return true to avoid taking a global lock on the empty check.
+ * so return directly to avoid taking a global lock on the empty check.
*/
- if (!cpuset_v2())
- return true;
+ if (!cgroup || !cpuset_v2()) {
+ nodes_copy(*mask, node_states[N_MEMORY]);
+ return;
+ }
css = cgroup_get_e_css(cgroup, &cpuset_cgrp_subsys);
- if (!css)
- return true;
+ if (!css) {
+ nodes_copy(*mask, node_states[N_MEMORY]);
+ return;
+ }
/*
- * Normally, accessing effective_mems would require the cpuset_mutex
- * or callback_lock - but node_isset is atomic and the reference
- * taken via cgroup_get_e_css is sufficient to protect css.
- *
- * Since this interface is intended for use by migration paths, we
- * relax locking here to avoid taking global locks - while accepting
- * there may be rare scenarios where the result may be innaccurate.
+ * The reference taken via cgroup_get_e_css is sufficient to
+ * protect css, but it does not imply safe accesses to effective_mems.
*
- * Reclaim and migration are subject to these same race conditions, and
- * cannot make strong isolation guarantees, so this is acceptable.
+ * Normally, accessing effective_mems would require the cpuset_mutex
+ * or callback_lock - but the correctness of this information is stale
+ * immediately after the query anyway. We do not acquire the lock
+ * during this process to save lock contention in exchange for racing
+ * against mems_allowed rebinds.
*/
cs = container_of(css, struct cpuset, css);
- allowed = node_isset(nid, cs->effective_mems);
+ nodes_copy(*mask, cs->effective_mems);
css_put(css);
- return allowed;
}
/**
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 86f43b7e5f71..702c3db624a0 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -5624,9 +5624,21 @@ subsys_initcall(mem_cgroup_swap_init);
#endif /* CONFIG_SWAP */
-bool mem_cgroup_node_allowed(struct mem_cgroup *memcg, int nid)
+void mem_cgroup_node_filter_allowed(struct mem_cgroup *memcg, nodemask_t *mask)
{
- return memcg ? cpuset_node_allowed(memcg->css.cgroup, nid) : true;
+ nodemask_t allowed;
+
+ if (!memcg)
+ return;
+
+ /*
+ * Since this interface is intended for use by migration paths, and
+ * reclaim and migration are subject to race conditions such as changes
+ * in effective_mems and hot-unpluging of nodes, inaccurate allowed
+ * mask is acceptable.
+ */
+ cpuset_nodes_allowed(memcg->css.cgroup, &allowed);
+ nodes_and(*mask, *mask, allowed);
}
void mem_cgroup_show_protected_memory(struct mem_cgroup *memcg)
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 670fe9fae5ba..5ea1dd2b8cce 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -344,19 +344,21 @@ static void flush_reclaim_state(struct scan_control *sc)
static bool can_demote(int nid, struct scan_control *sc,
struct mem_cgroup *memcg)
{
- int demotion_nid;
+ struct pglist_data *pgdat = NODE_DATA(nid);
+ nodemask_t allowed_mask;
- if (!numa_demotion_enabled)
+ if (!pgdat || !numa_demotion_enabled)
return false;
if (sc && sc->no_demotion)
return false;
- demotion_nid = next_demotion_node(nid);
- if (demotion_nid == NUMA_NO_NODE)
+ node_get_allowed_targets(pgdat, &allowed_mask);
+ if (nodes_empty(allowed_mask))
return false;
- /* If demotion node isn't in the cgroup's mems_allowed, fall back */
- return mem_cgroup_node_allowed(memcg, demotion_nid);
+ /* Filter out nodes that are not in cgroup's mems_allowed. */
+ mem_cgroup_node_filter_allowed(memcg, &allowed_mask);
+ return !nodes_empty(allowed_mask);
}
static inline bool can_reclaim_anon_pages(struct mem_cgroup *memcg,
@@ -1019,9 +1021,10 @@ static struct folio *alloc_demote_folio(struct folio *src,
* Folios which are not demoted are left on @demote_folios.
*/
static unsigned int demote_folio_list(struct list_head *demote_folios,
- struct pglist_data *pgdat)
+ struct pglist_data *pgdat,
+ struct mem_cgroup *memcg)
{
- int target_nid = next_demotion_node(pgdat->node_id);
+ int target_nid;
unsigned int nr_succeeded;
nodemask_t allowed_mask;
@@ -1033,7 +1036,6 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
*/
.gfp_mask = (GFP_HIGHUSER_MOVABLE & ~__GFP_RECLAIM) |
__GFP_NOMEMALLOC | GFP_NOWAIT,
- .nid = target_nid,
.nmask = &allowed_mask,
.reason = MR_DEMOTION,
};
@@ -1041,10 +1043,18 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
if (list_empty(demote_folios))
return 0;
- if (target_nid == NUMA_NO_NODE)
+ node_get_allowed_targets(pgdat, &allowed_mask);
+ mem_cgroup_node_filter_allowed(memcg, &allowed_mask);
+ if (nodes_empty(allowed_mask))
return 0;
- node_get_allowed_targets(pgdat, &allowed_mask);
+ target_nid = next_demotion_node(pgdat->node_id);
+ if (target_nid == NUMA_NO_NODE)
+ /* No lower-tier nodes or nodes were hot-unplugged. */
+ return 0;
+ if (!node_isset(target_nid, allowed_mask))
+ target_nid = node_random(&allowed_mask);
+ mtc.nid = target_nid;
/* Demotion ignores all cpuset and mempolicy settings */
migrate_pages(demote_folios, alloc_demote_folio, NULL,
@@ -1566,7 +1576,7 @@ static unsigned int shrink_folio_list(struct list_head *folio_list,
/* 'folio_list' is always empty here */
/* Migrate folios selected for demotion */
- nr_demoted = demote_folio_list(&demote_folios, pgdat);
+ nr_demoted = demote_folio_list(&demote_folios, pgdat, memcg);
nr_reclaimed += nr_demoted;
stat->nr_demoted += nr_demoted;
/* Folios that could not be demoted are still in @demote_folios */
--
2.52.0.457.g6b5491de43-goog
^ permalink raw reply related [flat|nested] 54+ messages in thread* Re: [PATCH v9 1/2] mm/vmscan: fix demotion targets checks in reclaim/demotion
2026-01-14 20:53 ` [PATCH v9 1/2] " Bing Jiao
@ 2026-02-02 4:15 ` Shakeel Butt
0 siblings, 0 replies; 54+ messages in thread
From: Shakeel Butt @ 2026-02-02 4:15 UTC (permalink / raw)
To: Bing Jiao
Cc: Andrew Morton, David Hildenbrand, Lorenzo Stoakes,
Liam R. Howlett, Vlastimil Babka, Mike Rapoport,
Suren Baghdasaryan, Michal Hocko, Axel Rasmussen, Yuanchu Xie,
Wei Xu, Johannes Weiner, Qi Zheng, Gregory Price, Joshua Hahn,
muchun.song, roman.gushchin, tj, longman, chenridong, linux-mm,
linux-kernel, cgroups
On Wed, Jan 14, 2026 at 08:53:02PM +0000, Bing Jiao wrote:
> Fix two bugs in demote_folio_list() and can_demote() due to incorrect
> demotion target checks against cpuset.mems_effective in reclaim/demotion.
>
> Commit 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
> introduces the cpuset.mems_effective check and applies it to can_demote().
> However:
>
> 1. It does not apply this check in demote_folio_list(), which leads
> to situations where pages are demoted to nodes that are
> explicitly excluded from the task's cpuset.mems.
>
> 2. It checks only the nodes in the immediate next demotion hierarchy
> and does not check all allowed demotion targets in can_demote().
> This can cause pages to never be demoted if the nodes in the next
> demotion hierarchy are not set in mems_effective.
>
> These bugs break resource isolation provided by cpuset.mems. This is
> visible from userspace because pages can either fail to be demoted
> entirely or are demoted to nodes that are not allowed in multi-tier memory
> systems.
>
> To address these bugs, update cpuset_node_allowed() and
> mem_cgroup_node_allowed() to return effective_mems, allowing directly
> logic-and operation against demotion targets. Also update can_demote()
> and demote_folio_list() accordingly.
>
> Bug 1 reproduction:
> Assume a system with 4 nodes, where nodes 0-1 are top-tier and
> nodes 2-3 are far-tier memory. All nodes have equal capacity.
>
> Test script:
> echo 1 > /sys/kernel/mm/numa/demotion_enabled
> mkdir /sys/fs/cgroup/test
> echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
> echo "0-2" > /sys/fs/cgroup/test/cpuset.mems
> echo $$ > /sys/fs/cgroup/test/cgroup.procs
> swapoff -a
> # Expectation: Should respect node 0-2 limit.
> # Observation: Node 3 shows significant allocation (MemFree drops)
> stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1
>
> Bug 2 reproduction:
> Assume a system with 6 nodes, where nodes 0-2 are top-tier,
> node 3 is a far-tier node, and nodes 4-5 are the farthest-tier nodes.
> All nodes have equal capacity.
>
> Test script:
> echo 1 > /sys/kernel/mm/numa/demotion_enabled
> mkdir /sys/fs/cgroup/test
> echo +cpuset > /sys/fs/cgroup/cgroup.subtree_control
> echo "0-2,4-5" > /sys/fs/cgroup/test/cpuset.mems
> echo $$ > /sys/fs/cgroup/test/cgroup.procs
> swapoff -a
> # Expectation: Pages are demoted to Nodes 4-5
> # Observation: No pages are demoted before oom.
> stress-ng --oomable --vm 1 --vm-bytes 150% --mbind 0,1,2
>
> Fixes: 7d709f49babc ("vmscan,cgroup: apply mems_effective to reclaim")
> Signed-off-by: Bing Jiao <bingjiao@google.com>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
^ permalink raw reply [flat|nested] 54+ messages in thread
* [PATCH v9 2/2] mm/vmscan: select the closest perferred node in demote_folio_list()
2026-01-14 20:53 ` [PATCH v9 0/2] mm/vmscan: fix demotion targets checks in reclaim/demotion Bing Jiao
2026-01-14 20:53 ` [PATCH v9 1/2] " Bing Jiao
@ 2026-01-14 20:53 ` Bing Jiao
2026-02-06 18:52 ` Shakeel Butt
2026-01-16 0:00 ` [PATCH v9 0/2] mm/vmscan: fix demotion targets checks in reclaim/demotion Andrew Morton
2026-01-30 23:35 ` Shakeel Butt
3 siblings, 1 reply; 54+ messages in thread
From: Bing Jiao @ 2026-01-14 20:53 UTC (permalink / raw)
To: bingjiao
Cc: Andrew Morton, David Hildenbrand, Lorenzo Stoakes,
Liam R. Howlett, Vlastimil Babka, Mike Rapoport,
Suren Baghdasaryan, Michal Hocko, Axel Rasmussen, Yuanchu Xie,
Wei Xu, Johannes Weiner, Qi Zheng, Shakeel Butt, Gregory Price,
Joshua Hahn, muchun.song, roman.gushchin, tj, longman, chenridong,
linux-mm, linux-kernel, cgroups
The preferred demotion node (migration_target_control.nid) should be the
one closest to the source node to minimize migration latency. Currently,
a discrepancy exists where demote_folio_list() randomly selects an allowed
node if the preferred node from next_demotion_node() is not set in
mems_effective.
To address it, update next_demotion_node() to select a preferred target
against allowed nodes; and to return the closest demotion target if all
preferred nodes are not in mems_effective via next_demotion_node().
It ensures that the preferred demotion target is consistently the closest
available node to the source node.
Signed-off-by: Bing Jiao <bingjiao@google.com>
---
v7 -> v8:
Fix bugs in v7.
Remove the while loop of getting the preferred node via
next_demotion_node().
Use find_next_best_node() to find the closest demotion target.
v8 -> v9:
Move allowed node checks and identification of the closest demotion
target into next_demotion_node() for better function splitting.
include/linux/memory-tiers.h | 6 +++---
mm/memory-tiers.c | 21 ++++++++++++++++-----
mm/vmscan.c | 5 ++---
3 files changed, 21 insertions(+), 11 deletions(-)
diff --git a/include/linux/memory-tiers.h b/include/linux/memory-tiers.h
index 7a805796fcfd..96987d9d95a8 100644
--- a/include/linux/memory-tiers.h
+++ b/include/linux/memory-tiers.h
@@ -53,11 +53,11 @@ struct memory_dev_type *mt_find_alloc_memory_type(int adist,
struct list_head *memory_types);
void mt_put_memory_types(struct list_head *memory_types);
#ifdef CONFIG_MIGRATION
-int next_demotion_node(int node);
+int next_demotion_node(int node, const nodemask_t *allowed_mask);
void node_get_allowed_targets(pg_data_t *pgdat, nodemask_t *targets);
bool node_is_toptier(int node);
#else
-static inline int next_demotion_node(int node)
+static inline int next_demotion_node(int node, const nodemask_t *allowed_mask)
{
return NUMA_NO_NODE;
}
@@ -101,7 +101,7 @@ static inline void clear_node_memory_type(int node, struct memory_dev_type *memt
}
-static inline int next_demotion_node(int node)
+static inline int next_demotion_node(int node, const nodemask_t *allowed_mask)
{
return NUMA_NO_NODE;
}
diff --git a/mm/memory-tiers.c b/mm/memory-tiers.c
index 864811fff409..2d6c3754e6a8 100644
--- a/mm/memory-tiers.c
+++ b/mm/memory-tiers.c
@@ -320,16 +320,17 @@ void node_get_allowed_targets(pg_data_t *pgdat, nodemask_t *targets)
/**
* next_demotion_node() - Get the next node in the demotion path
* @node: The starting node to lookup the next node
+ * @allowed_mask: The pointer to allowed node mask
*
* Return: node id for next memory node in the demotion path hierarchy
* from @node; NUMA_NO_NODE if @node is terminal. This does not keep
* @node online or guarantee that it *continues* to be the next demotion
* target.
*/
-int next_demotion_node(int node)
+int next_demotion_node(int node, const nodemask_t *allowed_mask)
{
struct demotion_nodes *nd;
- int target;
+ nodemask_t mask;
if (!node_demotion)
return NUMA_NO_NODE;
@@ -344,6 +345,10 @@ int next_demotion_node(int node)
* node_demotion[] reads need to be consistent.
*/
rcu_read_lock();
+ /* Filter out nodes that are not in allowed_mask. */
+ nodes_and(mask, nd->preferred, *allowed_mask);
+ rcu_read_unlock();
+
/*
* If there are multiple target nodes, just select one
* target node randomly.
@@ -356,10 +361,16 @@ int next_demotion_node(int node)
* caching issue, which seems more complicated. So selecting
* target node randomly seems better until now.
*/
- target = node_random(&nd->preferred);
- rcu_read_unlock();
+ if (!nodes_empty(mask))
+ return node_random(&mask);
- return target;
+ /*
+ * Preferred nodes are not in allowed_mask. Filp bits in
+ * allowed_mask as used node mask. Then, use it to get the
+ * closest demotion target.
+ */
+ nodes_complement(mask, *allowed_mask);
+ return find_next_best_node(node, &mask);
}
static void disable_all_demotion_targets(void)
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 5ea1dd2b8cce..7a631de46064 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1048,12 +1048,11 @@ static unsigned int demote_folio_list(struct list_head *demote_folios,
if (nodes_empty(allowed_mask))
return 0;
- target_nid = next_demotion_node(pgdat->node_id);
+ target_nid = next_demotion_node(pgdat->node_id, &allowed_mask);
if (target_nid == NUMA_NO_NODE)
/* No lower-tier nodes or nodes were hot-unplugged. */
return 0;
- if (!node_isset(target_nid, allowed_mask))
- target_nid = node_random(&allowed_mask);
+
mtc.nid = target_nid;
/* Demotion ignores all cpuset and mempolicy settings */
--
2.52.0.457.g6b5491de43-goog
^ permalink raw reply related [flat|nested] 54+ messages in thread* Re: [PATCH v9 2/2] mm/vmscan: select the closest perferred node in demote_folio_list()
2026-01-14 20:53 ` [PATCH v9 2/2] mm/vmscan: select the closest perferred node in demote_folio_list() Bing Jiao
@ 2026-02-06 18:52 ` Shakeel Butt
0 siblings, 0 replies; 54+ messages in thread
From: Shakeel Butt @ 2026-02-06 18:52 UTC (permalink / raw)
To: Bing Jiao
Cc: Andrew Morton, David Hildenbrand, Lorenzo Stoakes,
Liam R. Howlett, Vlastimil Babka, Mike Rapoport,
Suren Baghdasaryan, Michal Hocko, Axel Rasmussen, Yuanchu Xie,
Wei Xu, Johannes Weiner, Qi Zheng, Gregory Price, Joshua Hahn,
muchun.song, roman.gushchin, tj, longman, chenridong, linux-mm,
linux-kernel, cgroups
On Wed, Jan 14, 2026 at 08:53:03PM +0000, Bing Jiao wrote:
> The preferred demotion node (migration_target_control.nid) should be the
> one closest to the source node to minimize migration latency. Currently,
> a discrepancy exists where demote_folio_list() randomly selects an allowed
> node if the preferred node from next_demotion_node() is not set in
> mems_effective.
>
> To address it, update next_demotion_node() to select a preferred target
> against allowed nodes; and to return the closest demotion target if all
> preferred nodes are not in mems_effective via next_demotion_node().
>
> It ensures that the preferred demotion target is consistently the closest
> available node to the source node.
>
> Signed-off-by: Bing Jiao <bingjiao@google.com>
One nit below:
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
[...]
> @@ -320,16 +320,17 @@ void node_get_allowed_targets(pg_data_t *pgdat, nodemask_t *targets)
> /**
> * next_demotion_node() - Get the next node in the demotion path
> * @node: The starting node to lookup the next node
> + * @allowed_mask: The pointer to allowed node mask
> *
> * Return: node id for next memory node in the demotion path hierarchy
> * from @node; NUMA_NO_NODE if @node is terminal. This does not keep
> * @node online or guarantee that it *continues* to be the next demotion
> * target.
> */
> -int next_demotion_node(int node)
> +int next_demotion_node(int node, const nodemask_t *allowed_mask)
> {
> struct demotion_nodes *nd;
> - int target;
> + nodemask_t mask;
>
> if (!node_demotion)
> return NUMA_NO_NODE;
> @@ -344,6 +345,10 @@ int next_demotion_node(int node)
> * node_demotion[] reads need to be consistent.
> */
> rcu_read_lock();
> + /* Filter out nodes that are not in allowed_mask. */
> + nodes_and(mask, nd->preferred, *allowed_mask);
> + rcu_read_unlock();
> +
> /*
> * If there are multiple target nodes, just select one
> * target node randomly.
> @@ -356,10 +361,16 @@ int next_demotion_node(int node)
> * caching issue, which seems more complicated. So selecting
> * target node randomly seems better until now.
> */
> - target = node_random(&nd->preferred);
> - rcu_read_unlock();
> + if (!nodes_empty(mask))
> + return node_random(&mask);
>
> - return target;
> + /*
> + * Preferred nodes are not in allowed_mask. Filp bits in
Filp -> Flip
> + * allowed_mask as used node mask. Then, use it to get the
> + * closest demotion target.
> + */
> + nodes_complement(mask, *allowed_mask);
> + return find_next_best_node(node, &mask);
> }
>
^ permalink raw reply [flat|nested] 54+ messages in thread
* Re: [PATCH v9 0/2] mm/vmscan: fix demotion targets checks in reclaim/demotion
2026-01-14 20:53 ` [PATCH v9 0/2] mm/vmscan: fix demotion targets checks in reclaim/demotion Bing Jiao
2026-01-14 20:53 ` [PATCH v9 1/2] " Bing Jiao
2026-01-14 20:53 ` [PATCH v9 2/2] mm/vmscan: select the closest perferred node in demote_folio_list() Bing Jiao
@ 2026-01-16 0:00 ` Andrew Morton
2026-01-16 7:00 ` Bing Jiao
2026-01-30 23:35 ` Shakeel Butt
3 siblings, 1 reply; 54+ messages in thread
From: Andrew Morton @ 2026-01-16 0:00 UTC (permalink / raw)
To: Bing Jiao
Cc: David Hildenbrand, Lorenzo Stoakes, Liam R. Howlett,
Vlastimil Babka, Mike Rapoport, Suren Baghdasaryan, Michal Hocko,
Axel Rasmussen, Yuanchu Xie, Wei Xu, Johannes Weiner, Qi Zheng,
Shakeel Butt, Gregory Price, Joshua Hahn, muchun.song,
roman.gushchin, tj, longman, chenridong, linux-mm, linux-kernel,
cgroups
On Wed, 14 Jan 2026 20:53:01 +0000 Bing Jiao <bingjiao@google.com> wrote:
> I’m resubmitting the full refreshed patch series together this time.
> I just realized it is better to include the unmodified patches alongside
> the modified ones to ensure compatibility with upstream automated tools
> and to simplify your review process.
No probs.
[1/2] is cc:stable whereas [2/2] is not. Ordinarily that means I must
split the series apart (they take different routes) and often discard
the [0/n].
In this case I think I'll leave things as-is, so [1/2]'s entry into the
-stable pipeline will occur a few weeks later. I don't think the
problem is serious enough to need super-fast-tracking?
Hopefully this approach means we'll get some Reviewed-bys ;)
^ permalink raw reply [flat|nested] 54+ messages in thread
* Re: [PATCH v9 0/2] mm/vmscan: fix demotion targets checks in reclaim/demotion
2026-01-16 0:00 ` [PATCH v9 0/2] mm/vmscan: fix demotion targets checks in reclaim/demotion Andrew Morton
@ 2026-01-16 7:00 ` Bing Jiao
0 siblings, 0 replies; 54+ messages in thread
From: Bing Jiao @ 2026-01-16 7:00 UTC (permalink / raw)
To: Andrew Morton
Cc: David Hildenbrand, Lorenzo Stoakes, Liam R. Howlett,
Vlastimil Babka, Mike Rapoport, Suren Baghdasaryan, Michal Hocko,
Axel Rasmussen, Yuanchu Xie, Wei Xu, Johannes Weiner, Qi Zheng,
Shakeel Butt, Gregory Price, Joshua Hahn, muchun.song,
roman.gushchin, tj, longman, chenridong, linux-mm, linux-kernel,
cgroups
On Thu, Jan 15, 2026 at 04:00:11PM -0800, Andrew Morton wrote:
> On Wed, 14 Jan 2026 20:53:01 +0000 Bing Jiao <bingjiao@google.com> wrote:
>
> > I’m resubmitting the full refreshed patch series together this time.
> > I just realized it is better to include the unmodified patches alongside
> > the modified ones to ensure compatibility with upstream automated tools
> > and to simplify your review process.
>
> No probs.
>
> [1/2] is cc:stable whereas [2/2] is not. Ordinarily that means I must
> split the series apart (they take different routes) and often discard
> the [0/n].
Hi Andrew,
Thank you for the explanation. I appreciate the insight into the upstream
process and the time you have taken to review this series. I wish I had
known this earlier so as not to add to your workload.
> In this case I think I'll leave things as-is, so [1/2]'s entry into the
> -stable pipeline will occur a few weeks later. I don't think the
> problem is serious enough to need super-fast-tracking?
>
> Hopefully this approach means we'll get some Reviewed-bys ;)
I agree that the issue does not require urgent fast-tracking, so leaving
the series as-is for the standard pipeline is appropriate.
Best regards,
Bing
^ permalink raw reply [flat|nested] 54+ messages in thread
* Re: [PATCH v9 0/2] mm/vmscan: fix demotion targets checks in reclaim/demotion
2026-01-14 20:53 ` [PATCH v9 0/2] mm/vmscan: fix demotion targets checks in reclaim/demotion Bing Jiao
` (2 preceding siblings ...)
2026-01-16 0:00 ` [PATCH v9 0/2] mm/vmscan: fix demotion targets checks in reclaim/demotion Andrew Morton
@ 2026-01-30 23:35 ` Shakeel Butt
2026-01-31 23:58 ` Bing Jiao
3 siblings, 1 reply; 54+ messages in thread
From: Shakeel Butt @ 2026-01-30 23:35 UTC (permalink / raw)
To: Bing Jiao
Cc: Andrew Morton, David Hildenbrand, Lorenzo Stoakes,
Liam R. Howlett, Vlastimil Babka, Mike Rapoport,
Suren Baghdasaryan, Michal Hocko, Axel Rasmussen, Yuanchu Xie,
Wei Xu, Johannes Weiner, Qi Zheng, Gregory Price, Joshua Hahn,
muchun.song, roman.gushchin, tj, longman, chenridong, linux-mm,
linux-kernel, cgroups
Hi Bing,
Please don't reply (i.e. use In-Reply-To) to older revision of your
series. Send each revision independently.
On Wed, Jan 14, 2026 at 08:53:01PM +0000, Bing Jiao wrote:
> This patch series addresses two issues in demote_folio_list(),
> can_demote(), and next_demotion_node() in reclaim/demotion.
>
> 1. demote_folio_list() and can_demote() do not correctly check demotion
> target against cpuset.mems_effective, which will cause (a) pages are
> demoted
pages to be demoted
> to not-allowed nodes and (b) pages are failed to demote
page fail to demote
> even
> if the system still have allowed demotion nodes.
>
> Patch 1 fixes this bug by update
updating
> cpuset_node_allowed() and
> mem_cgroup_node_allowed() to return effective_mems, allowing directly
> logic-and operation against demotion targets.
>
> 2. next_demotion_node() returns a preferred demotion target, but it does
does or does not?
> check the node against allowed nodes.
>
> Patch 2 ensures that next_demotion_node() filters against the allowed
> node mask and selects the closest demotion target to the source node.
>
^ permalink raw reply [flat|nested] 54+ messages in thread* Re: [PATCH v9 0/2] mm/vmscan: fix demotion targets checks in reclaim/demotion
2026-01-30 23:35 ` Shakeel Butt
@ 2026-01-31 23:58 ` Bing Jiao
0 siblings, 0 replies; 54+ messages in thread
From: Bing Jiao @ 2026-01-31 23:58 UTC (permalink / raw)
To: Shakeel Butt
Cc: Andrew Morton, David Hildenbrand, Lorenzo Stoakes,
Liam R. Howlett, Vlastimil Babka, Mike Rapoport,
Suren Baghdasaryan, Michal Hocko, Axel Rasmussen, Yuanchu Xie,
Wei Xu, Johannes Weiner, Qi Zheng, Gregory Price, Joshua Hahn,
muchun.song, roman.gushchin, tj, longman, chenridong, linux-mm,
linux-kernel, cgroups
On Fri, Jan 30, 2026 at 03:35:26PM -0800, Shakeel Butt wrote:
> Hi Bing,
>
> Please don't reply (i.e. use In-Reply-To) to older revision of your
> series. Send each revision independently.
>
> On Wed, Jan 14, 2026 at 08:53:01PM +0000, Bing Jiao wrote:
> > This patch series addresses two issues in demote_folio_list(),
> > can_demote(), and next_demotion_node() in reclaim/demotion.
> >
> > 1. demote_folio_list() and can_demote() do not correctly check demotion
> > target against cpuset.mems_effective, which will cause (a) pages are
> > demoted
>
> pages to be demoted
>
> > to not-allowed nodes and (b) pages are failed to demote
>
> page fail to demote
>
> > even
> > if the system still have allowed demotion nodes.
> >
> > Patch 1 fixes this bug by update
>
> updating
>
> > cpuset_node_allowed() and
> > mem_cgroup_node_allowed() to return effective_mems, allowing directly
> > logic-and operation against demotion targets.
> >
> > 2. next_demotion_node() returns a preferred demotion target, but it does
>
> does or does not?
>
> > check the node against allowed nodes.
> >
> > Patch 2 ensures that next_demotion_node() filters against the allowed
> > node mask and selects the closest demotion target to the source node.
Hi Shakeel,
Thank you for taking the time to review this patch series and for the
helpful corrections. I also appreciate the reminder about the patch
replying rule and will make sure to send future revisions independently.
Have a great weekend!
Best,
Bing
^ permalink raw reply [flat|nested] 54+ messages in thread