All of lore.kernel.org
 help / color / mirror / Atom feed
From: Shakeel Butt <shakeel.butt@linux.dev>
To: Karl Erik Hofseth <karl.e.hofseth@opoint.com>
Cc: linux-mm@kvack.org, akpm@linux-foundation.org,
	qi.zheng@linux.dev,  kasong@tencent.com, baohua@kernel.org,
	axelrasmussen@google.com, yuanchu@google.com,
	 weixugc@google.com, hannes@cmpxchg.org, mhocko@kernel.org,
	roman.gushchin@linux.dev,  muchun.song@linux.dev,
	david@kernel.org, ljs@kernel.org, cgroups@vger.kernel.org,
	 regressions@lists.linux.dev, linux-kernel@vger.kernel.org
Subject: Re: [REGRESSION] mm/memcg: folio/lruvec mismatch after cgroup offline: lru_size underflow and list_del corruption (7.1)
Date: Wed, 5 Aug 2026 12:07:01 -0700	[thread overview]
Message-ID: <anOHDekdEne06P97@linux.dev> (raw)
In-Reply-To: <anMmd1ADrDVwMO6v@work>

On Wed, Aug 05, 2026 at 02:03:03PM +0200, Karl Erik Hofseth wrote:
> Hi,
> 
> The following KASAN slab-use-after-free comes from a Fedora debug kernel
> build of 7.1.6 with de4660898b7a applied on top, provoked with the
> attached script. Further down are OOPSes generated by workloads in
> production on stock Fedora kernels. MGLRU on/off makes no difference.

Hi Karl,

Thanks a lot for the report and I think I understand the issue. We are not
handling the case of folio migration causing folio having objcg different
different from its node which breaks the assumption memcg_reparent_objcgs() have
for its locking lru of child and parent per-node LRUs.

Thanks for the reproducer and I was able to reproduce with inceased workers. I
will send out the fixes soon.

thanks,
Shakeel


      parent reply	other threads:[~2026-08-05 19:07 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-05 12:03 [REGRESSION] mm/memcg: folio/lruvec mismatch after cgroup offline: lru_size underflow and list_del corruption (7.1) Karl Erik Hofseth
2026-08-05 16:35 ` Andrew Morton
2026-08-05 17:22   ` Shakeel Butt
2026-08-05 19:07 ` Shakeel Butt [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=anOHDekdEne06P97@linux.dev \
    --to=shakeel.butt@linux.dev \
    --cc=akpm@linux-foundation.org \
    --cc=axelrasmussen@google.com \
    --cc=baohua@kernel.org \
    --cc=cgroups@vger.kernel.org \
    --cc=david@kernel.org \
    --cc=hannes@cmpxchg.org \
    --cc=karl.e.hofseth@opoint.com \
    --cc=kasong@tencent.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=ljs@kernel.org \
    --cc=mhocko@kernel.org \
    --cc=muchun.song@linux.dev \
    --cc=qi.zheng@linux.dev \
    --cc=regressions@lists.linux.dev \
    --cc=roman.gushchin@linux.dev \
    --cc=weixugc@google.com \
    --cc=yuanchu@google.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.