[PATCH 0/3] mm, memcg: Miscellaneous cleanups

[PATCH 0/3] mm, memcg: Miscellaneous cleanups

[Waiman Long]

This patch series contains a number of miscellaneous cleanup for memcg. It
is based on the next-20211001 branch.

Waiman Long (3):
  mm, memcg: Don't put offlined memcg into local stock
  mm, memcg: Remove obsolete memcg_free_kmem()
  mm, memcg: Ensure valid memcg from objcg within a RCU critical section

 mm/memcontrol.c | 41 +++++++++++++++++++++--------------------
 1 file changed, 21 insertions(+), 20 deletions(-)

-- 
2.18.1

[PATCH 1/3] mm, memcg: Don't put offlined memcg into local stock

[Waiman Long]

When freeing a page associated with an offlined memcg, refill_stock()
will put it into local stock delaying its demise until another memcg
comes in to take its place in the stock. To avoid that, we now check
for offlined memcg and go directly in this case to the slowpath for
the uncharge via the repurposed cancel_charge() function.

Signed-off-by: Waiman Long <longman-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
---
 mm/memcontrol.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 4b32896d87a2..4568363062c1 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -2167,6 +2167,8 @@ static bool consume_stock(struct mem_cgroup *memcg, unsigned int nr_pages)
 	return ret;
 }
 
+static void cancel_charge(struct mem_cgroup *memcg, unsigned int nr_pages);
+
 /*
  * Returns stocks cached in percpu and reset cached information.
  */
@@ -2178,9 +2180,7 @@ static void drain_stock(struct memcg_stock_pcp *stock)
 		return;
 
 	if (stock->nr_pages) {
-		page_counter_uncharge(&old->memory, stock->nr_pages);
-		if (do_memsw_account())
-			page_counter_uncharge(&old->memsw, stock->nr_pages);
+		cancel_charge(old, stock->nr_pages);
 		stock->nr_pages = 0;
 	}
 
@@ -2219,6 +2219,14 @@ static void refill_stock(struct mem_cgroup *memcg, unsigned int nr_pages)
 	struct memcg_stock_pcp *stock;
 	unsigned long flags;
 
+	/*
+	 * An offlined memcg shouldn't be put into stock.
+	 */
+	if (unlikely(memcg->kmem_state != KMEM_ONLINE)) {
+		cancel_charge(memcg, nr_pages);
+		return;
+	}
+
 	local_irq_save(flags);
 
 	stock = this_cpu_ptr(&memcg_stock);
@@ -2732,7 +2740,6 @@ static inline int try_charge(struct mem_cgroup *memcg, gfp_t gfp_mask,
 	return try_charge_memcg(memcg, gfp_mask, nr_pages);
 }
 
-#if defined(CONFIG_MEMCG_KMEM) || defined(CONFIG_MMU)
 static void cancel_charge(struct mem_cgroup *memcg, unsigned int nr_pages)
 {
 	if (mem_cgroup_is_root(memcg))
@@ -2742,7 +2749,6 @@ static void cancel_charge(struct mem_cgroup *memcg, unsigned int nr_pages)
 	if (do_memsw_account())
 		page_counter_uncharge(&memcg->memsw, nr_pages);
 }
-#endif
 
 static void commit_charge(struct folio *folio, struct mem_cgroup *memcg)
 {
-- 
2.18.1

Re: [PATCH 1/3] mm, memcg: Don't put offlined memcg into local stock

[kernel test robot]

[-- Attachment #1: Type: text/plain, Size: 3393 bytes --]

Hi Waiman,

I love your patch! Yet something to improve:

[auto build test ERROR on hnaz-mm/master]

url:    https://github.com/0day-ci/linux/commits/Waiman-Long/mm-memcg-Miscellaneous-cleanups/20211002-031125
base:   https://github.com/hnaz/linux-mm master
config: nios2-randconfig-r024-20211001 (attached as .config)
compiler: nios2-linux-gcc (GCC) 11.2.0
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # https://github.com/0day-ci/linux/commit/321484dcb4f16ca7bd626adf390222913d188ecc
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review Waiman-Long/mm-memcg-Miscellaneous-cleanups/20211002-031125
        git checkout 321484dcb4f16ca7bd626adf390222913d188ecc
        # save the attached .config to linux build tree
        mkdir build_dir
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross O=build_dir ARCH=nios2 SHELL=/bin/bash

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>

All errors (new ones prefixed by >>):

   In file included from include/asm-generic/percpu.h:5,
                    from ./arch/nios2/include/generated/asm/percpu.h:1,
                    from include/linux/irqflags.h:17,
                    from include/asm-generic/cmpxchg.h:15,
                    from ./arch/nios2/include/generated/asm/cmpxchg.h:1,
                    from include/asm-generic/atomic.h:12,
                    from ./arch/nios2/include/generated/asm/atomic.h:1,
                    from include/linux/atomic.h:7,
                    from include/linux/page_counter.h:5,
                    from mm/memcontrol.c:28:
   mm/memcontrol.c: In function 'refill_stock':
>> mm/memcontrol.c:2225:27: error: 'struct mem_cgroup' has no member named 'kmem_state'
    2225 |         if (unlikely(memcg->kmem_state != KMEM_ONLINE)) {
         |                           ^~
   include/linux/compiler.h:78:45: note: in definition of macro 'unlikely'
      78 | # define unlikely(x)    __builtin_expect(!!(x), 0)
         |                                             ^


vim +2225 mm/memcontrol.c

  2212	
  2213	/*
  2214	 * Cache charges(val) to local per_cpu area.
  2215	 * This will be consumed by consume_stock() function, later.
  2216	 */
  2217	static void refill_stock(struct mem_cgroup *memcg, unsigned int nr_pages)
  2218	{
  2219		struct memcg_stock_pcp *stock;
  2220		unsigned long flags;
  2221	
  2222		/*
  2223		 * An offlined memcg shouldn't be put into stock.
  2224		 */
> 2225		if (unlikely(memcg->kmem_state != KMEM_ONLINE)) {
  2226			cancel_charge(memcg, nr_pages);
  2227			return;
  2228		}
  2229	
  2230		local_irq_save(flags);
  2231	
  2232		stock = this_cpu_ptr(&memcg_stock);
  2233		if (stock->cached != memcg) { /* reset if necessary */
  2234			drain_stock(stock);
  2235			css_get(&memcg->css);
  2236			stock->cached = memcg;
  2237		}
  2238		stock->nr_pages += nr_pages;
  2239	
  2240		if (stock->nr_pages > MEMCG_CHARGE_BATCH)
  2241			drain_stock(stock);
  2242	
  2243		local_irq_restore(flags);
  2244	}
  2245	

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all-hn68Rpc1hR1g9hUCZPvPmw@public.gmane.org

[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 30314 bytes --]

Re: [PATCH 1/3] mm, memcg: Don't put offlined memcg into local stock

[kernel test robot]

[-- Attachment #1: Type: text/plain, Size: 2807 bytes --]

Hi Waiman,

I love your patch! Yet something to improve:

[auto build test ERROR on hnaz-mm/master]

url:    https://github.com/0day-ci/linux/commits/Waiman-Long/mm-memcg-Miscellaneous-cleanups/20211002-031125
base:   https://github.com/hnaz/linux-mm master
config: x86_64-randconfig-a016-20211001 (attached as .config)
compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project 962e503cc8bc411f7523cc393acae8aae425b1c4)
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # https://github.com/0day-ci/linux/commit/321484dcb4f16ca7bd626adf390222913d188ecc
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review Waiman-Long/mm-memcg-Miscellaneous-cleanups/20211002-031125
        git checkout 321484dcb4f16ca7bd626adf390222913d188ecc
        # save the attached .config to linux build tree
        mkdir build_dir
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>

All errors (new ones prefixed by >>):

>> mm/memcontrol.c:2225:22: error: no member named 'kmem_state' in 'struct mem_cgroup'
           if (unlikely(memcg->kmem_state != KMEM_ONLINE)) {
                        ~~~~~  ^
   include/linux/compiler.h:78:42: note: expanded from macro 'unlikely'
   # define unlikely(x)    __builtin_expect(!!(x), 0)
                                               ^
   1 error generated.


vim +2225 mm/memcontrol.c

  2212	
  2213	/*
  2214	 * Cache charges(val) to local per_cpu area.
  2215	 * This will be consumed by consume_stock() function, later.
  2216	 */
  2217	static void refill_stock(struct mem_cgroup *memcg, unsigned int nr_pages)
  2218	{
  2219		struct memcg_stock_pcp *stock;
  2220		unsigned long flags;
  2221	
  2222		/*
  2223		 * An offlined memcg shouldn't be put into stock.
  2224		 */
> 2225		if (unlikely(memcg->kmem_state != KMEM_ONLINE)) {
  2226			cancel_charge(memcg, nr_pages);
  2227			return;
  2228		}
  2229	
  2230		local_irq_save(flags);
  2231	
  2232		stock = this_cpu_ptr(&memcg_stock);
  2233		if (stock->cached != memcg) { /* reset if necessary */
  2234			drain_stock(stock);
  2235			css_get(&memcg->css);
  2236			stock->cached = memcg;
  2237		}
  2238		stock->nr_pages += nr_pages;
  2239	
  2240		if (stock->nr_pages > MEMCG_CHARGE_BATCH)
  2241			drain_stock(stock);
  2242	
  2243		local_irq_restore(flags);
  2244	}
  2245	

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all-hn68Rpc1hR1g9hUCZPvPmw@public.gmane.org

[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 37965 bytes --]

Re: [PATCH 1/3] mm, memcg: Don't put offlined memcg into local stock

[Roman Gushchin]

On Fri, Oct 01, 2021 at 03:09:36PM -0400, Waiman Long wrote:
> When freeing a page associated with an offlined memcg, refill_stock()
> will put it into local stock delaying its demise until another memcg
> comes in to take its place in the stock. To avoid that, we now check
> for offlined memcg and go directly in this case to the slowpath for
> the uncharge via the repurposed cancel_charge() function.

Hi Waiman!

I'm afraid it can make a cleanup of a dying cgroup slower: for every
released page we'll potentially traverse the whole cgroup tree and
decrease atomic page counters.

I'm not sure I understand the benefits we get from this change which
do justify the slowdown on the cleanup path.

Thanks!

> 
> Signed-off-by: Waiman Long <longman-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
> ---
>  mm/memcontrol.c | 16 +++++++++++-----
>  1 file changed, 11 insertions(+), 5 deletions(-)
> 
> diff --git a/mm/memcontrol.c b/mm/memcontrol.c
> index 4b32896d87a2..4568363062c1 100644
> --- a/mm/memcontrol.c
> +++ b/mm/memcontrol.c
> @@ -2167,6 +2167,8 @@ static bool consume_stock(struct mem_cgroup *memcg, unsigned int nr_pages)
>  	return ret;
>  }
>  
> +static void cancel_charge(struct mem_cgroup *memcg, unsigned int nr_pages);
> +
>  /*
>   * Returns stocks cached in percpu and reset cached information.
>   */
> @@ -2178,9 +2180,7 @@ static void drain_stock(struct memcg_stock_pcp *stock)
>  		return;
>  
>  	if (stock->nr_pages) {
> -		page_counter_uncharge(&old->memory, stock->nr_pages);
> -		if (do_memsw_account())
> -			page_counter_uncharge(&old->memsw, stock->nr_pages);
> +		cancel_charge(old, stock->nr_pages);
>  		stock->nr_pages = 0;
>  	}
>  
> @@ -2219,6 +2219,14 @@ static void refill_stock(struct mem_cgroup *memcg, unsigned int nr_pages)
>  	struct memcg_stock_pcp *stock;
>  	unsigned long flags;
>  
> +	/*
> +	 * An offlined memcg shouldn't be put into stock.
> +	 */
> +	if (unlikely(memcg->kmem_state != KMEM_ONLINE)) {
> +		cancel_charge(memcg, nr_pages);
> +		return;
> +	}
> +
>  	local_irq_save(flags);
>  
>  	stock = this_cpu_ptr(&memcg_stock);
> @@ -2732,7 +2740,6 @@ static inline int try_charge(struct mem_cgroup *memcg, gfp_t gfp_mask,
>  	return try_charge_memcg(memcg, gfp_mask, nr_pages);
>  }
>  
> -#if defined(CONFIG_MEMCG_KMEM) || defined(CONFIG_MMU)
>  static void cancel_charge(struct mem_cgroup *memcg, unsigned int nr_pages)
>  {
>  	if (mem_cgroup_is_root(memcg))
> @@ -2742,7 +2749,6 @@ static void cancel_charge(struct mem_cgroup *memcg, unsigned int nr_pages)
>  	if (do_memsw_account())
>  		page_counter_uncharge(&memcg->memsw, nr_pages);
>  }
> -#endif
>  
>  static void commit_charge(struct folio *folio, struct mem_cgroup *memcg)
>  {
> -- 
> 2.18.1
> 

Re: [PATCH 1/3] mm, memcg: Don't put offlined memcg into local stock

[Waiman Long]

On 10/1/21 7:51 PM, Roman Gushchin wrote:
> On Fri, Oct 01, 2021 at 03:09:36PM -0400, Waiman Long wrote:
>> When freeing a page associated with an offlined memcg, refill_stock()
>> will put it into local stock delaying its demise until another memcg
>> comes in to take its place in the stock. To avoid that, we now check
>> for offlined memcg and go directly in this case to the slowpath for
>> the uncharge via the repurposed cancel_charge() function.
> Hi Waiman!
>
> I'm afraid it can make a cleanup of a dying cgroup slower: for every
> released page we'll potentially traverse the whole cgroup tree and
> decrease atomic page counters.
>
> I'm not sure I understand the benefits we get from this change which
> do justify the slowdown on the cleanup path.

I am debugging a problem where some dying memcgs somehow stay around for 
a long time leading to gradual increase in memory consumption over time. 
I see the per-cpu stock as one of the places where a reference to a 
dying memcg may be present. Anyway, I agree that it may not help much. I 
am going to drop it if you think it is not a good idea.

Cheers,
Longman

Re: [PATCH 1/3] mm, memcg: Don't put offlined memcg into local stock

[Waiman Long]

On 10/1/21 19:51, Roman Gushchin wrote:
> On Fri, Oct 01, 2021 at 03:09:36PM -0400, Waiman Long wrote:
>> When freeing a page associated with an offlined memcg, refill_stock()
>> will put it into local stock delaying its demise until another memcg
>> comes in to take its place in the stock. To avoid that, we now check
>> for offlined memcg and go directly in this case to the slowpath for
>> the uncharge via the repurposed cancel_charge() function.
> Hi Waiman!
>
> I'm afraid it can make a cleanup of a dying cgroup slower: for every
> released page we'll potentially traverse the whole cgroup tree and
> decrease atomic page counters.
>
> I'm not sure I understand the benefits we get from this change which
> do justify the slowdown on the cleanup path.
>
> Thanks!

I was notified of a lockdep splat that this patch may help to prevent.

[18073.102101] ======================================================
[18073.102101] WARNING: possible circular locking dependency detected
[18073.102101] 5.14.0-42.el9.x86_64+debug #1 Not tainted
[18073.102101] ------------------------------------------------------
[18073.102101] bz1567074_bin/420270 is trying to acquire lock:
[18073.102101] ffffffff9bdfc478 (css_set_lock){..-.}-{2:2}, at: 
obj_cgroup_release+0x79/0x210
[18073.102101]
[18073.102101] but task is already holding lock:
[18073.102101] ffff88806ba4ef18 (&sighand->siglock){-...}-{2:2}, at: 
force_sig_info_to_task+0x6c/0x370
[18073.102101]
[18073.102101] which lock already depends on the new lock.
[18073.102101]
[18073.102101]
[18073.102101] the existing dependency chain (in reverse order) is:
[18073.102101]
[18073.102101] -> #1 (&sighand->siglock){-...}-{2:2}:
[18073.102101]        __lock_acquire+0xb72/0x1870
[18073.102101]        lock_acquire.part.0+0x117/0x340
[18073.102101]        _raw_spin_lock_irqsave+0x43/0x90
[18073.102101]        __lock_task_sighand+0xa0/0x210
[18073.102101]        cgroup_freeze_task+0x6f/0x150
[18073.102101]        cgroup_migrate_execute+0x25f/0xf90
[18073.102101]        cgroup_update_dfl_csses+0x417/0x4f0
[18073.102101]        cgroup_subtree_control_write+0x67b/0xa10
[18073.102101]        cgroup_file_write+0x1ef/0x6a0
[18073.102101]        kernfs_fop_write_iter+0x2c7/0x460
[18073.102101]        new_sync_write+0x36f/0x610
[18073.102101]        vfs_write+0x5c6/0x890
[18073.102101]        ksys_write+0xf9/0x1d0
[18073.102101]        do_syscall_64+0x3b/0x90
[18073.102101]        entry_SYSCALL_64_after_hwframe+0x44/0xae
[18073.102101]
[18073.102101] -> #0 (css_set_lock){..-.}-{2:2}:
[18073.102101]        check_prev_add+0x15e/0x20f0
[18073.102101]        validate_chain+0xac6/0xde0
[18073.102101]        __lock_acquire+0xb72/0x1870
[18073.102101]        lock_acquire.part.0+0x117/0x340
[18073.102101]        _raw_spin_lock_irqsave+0x43/0x90
[18073.102101]        obj_cgroup_release+0x79/0x210
[18073.102101]        percpu_ref_put_many.constprop.0+0x16b/0x1a0
[18073.102101]        drain_obj_stock+0x1a8/0x310
[18073.102101]        refill_obj_stock+0xa4/0x480
[18073.102101]        obj_cgroup_charge+0x104/0x240
[18073.102101]        kmem_cache_alloc+0x94/0x400
[18073.102101]        __sigqueue_alloc+0x1b9/0x460
[18073.102101]        __send_signal+0x4b2/0xf60
[18073.102101]        force_sig_info_to_task+0x226/0x370
[18073.102101]        force_sig_fault+0xb0/0xf0
[18073.102101]        noist_exc_debug+0xec/0x110
[18073.102101]        asm_exc_debug+0x2b/0x30
[18073.102101]
[18073.102101] other info that might help us debug this:
[18073.102101]
[18073.102101]  Possible unsafe locking scenario:
[18073.102101]
[18073.102101]        CPU0                    CPU1
[18073.102101]        ----                    ----
[18073.102101]   lock(&sighand->siglock);
[18073.102101]                                lock(css_set_lock);
[18073.102101] lock(&sighand->siglock);
[18073.102101]   lock(css_set_lock);
[18073.102101]
[18073.102101]  *** DEADLOCK ***
[18073.102101]
[18073.102101] 2 locks held by bz1567074_bin/420270:
[18073.102101]  #0: ffff88806ba4ef18 (&sighand->siglock){-...}-{2:2}, 
at: force_sig_info_to_task+0x6c/0x370
[18073.102101]  #1: ffffffff9bd0ea00 (rcu_read_lock){....}-{1:2}, at: 
percpu_ref_put_many.constprop.0+0x0/0x1a0
[18073.102101]
[18073.102101] stack backtrace:
[18073.102101] CPU: 0 PID: 420270 Comm: bz1567074_bin Kdump: loaded Not 
tainted 5.14.0-42.el9.x86_64+debug #1
[18073.102101] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2007
[18073.102101] Call Trace:
[18073.102101]  dump_stack_lvl+0x57/0x7d
[18073.102101]  check_noncircular+0x26a/0x310
[18073.102101]  ? pvclock_clocksource_read+0x2b8/0x520
[18073.102101]  ? print_circular_bug+0x1f0/0x1f0
[18073.102101]  ? alloc_chain_hlocks+0x1de/0x530
[18073.102101]  check_prev_add+0x15e/0x20f0
[18073.102101]  validate_chain+0xac6/0xde0
[18073.102101]  ? check_prev_add+0x20f0/0x20f0
[18073.102101]  __lock_acquire+0xb72/0x1870
[18073.102101]  ? __lock_acquire+0xb72/0x1870
[18073.102101]  lock_acquire.part.0+0x117/0x340
[18073.102101]  ? obj_cgroup_release+0x79/0x210
[18073.102101]  ? rcu_read_unlock+0x40/0x40
[18073.102101]  ? rcu_read_lock_sched_held+0x3f/0x70
[18073.102101]  ? lock_acquire+0x224/0x2d0
[18073.102101]  ? obj_cgroup_release+0x79/0x210
[18073.102101]  _raw_spin_lock_irqsave+0x43/0x90
[18073.102101]  ? obj_cgroup_release+0x79/0x210
[18073.102101]  obj_cgroup_release+0x79/0x210
[18073.102101]  percpu_ref_put_many.constprop.0+0x16b/0x1a0
[18073.102101]  drain_obj_stock+0x1a8/0x310
[18073.102101]  refill_obj_stock+0xa4/0x480
[18073.102101]  obj_cgroup_charge+0x104/0x240
[18073.102101]  ? __sigqueue_alloc+0x1b9/0x460
[18073.102101]  kmem_cache_alloc+0x94/0x400
[18073.102101]  ? __sigqueue_alloc+0x129/0x460
[18073.102101]  __sigqueue_alloc+0x1b9/0x460
[18073.102101]  __send_signal+0x4b2/0xf60
[18073.102101]  ? send_signal+0x9f/0x580
[18073.102101]  force_sig_info_to_task+0x226/0x370
[18073.102101]  force_sig_fault+0xb0/0xf0
[18073.102101]  ? force_sig_fault_to_task+0xe0/0xe0
[18073.102101]  ? asm_exc_debug+0x23/0x30
[18073.102101]  ? notify_die+0x88/0x100
[18073.102101]  ? asm_exc_debug+0x23/0x30
[18073.102101]  noist_exc_debug+0xec/0x110
[18073.102101]  asm_exc_debug+0x2b/0x30

The &sighand->siglock => css_set_lock locking sequence is caused by a 
task holding sighand->siglock and call kmem_cache_alloc(GFP_ATOMIC) and 
the release of the obj_cgroup originally from an offlined memcg in 
percpu stock leading to the call of obj_cgroup_release() which takes the 
cs_set_lock. The chance of hitting that is very small, but it can still 
happen. So do you think addressing this possible deadlock scenario is 
worth the possible slower release of an offlined memcg?

Cheers,
Longman

>> Signed-off-by: Waiman Long <longman-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
>> ---
>>   mm/memcontrol.c | 16 +++++++++++-----
>>   1 file changed, 11 insertions(+), 5 deletions(-)
>>
>> diff --git a/mm/memcontrol.c b/mm/memcontrol.c
>> index 4b32896d87a2..4568363062c1 100644
>> --- a/mm/memcontrol.c
>> +++ b/mm/memcontrol.c
>> @@ -2167,6 +2167,8 @@ static bool consume_stock(struct mem_cgroup *memcg, unsigned int nr_pages)
>>   	return ret;
>>   }
>>   
>> +static void cancel_charge(struct mem_cgroup *memcg, unsigned int nr_pages);
>> +
>>   /*
>>    * Returns stocks cached in percpu and reset cached information.
>>    */
>> @@ -2178,9 +2180,7 @@ static void drain_stock(struct memcg_stock_pcp *stock)
>>   		return;
>>   
>>   	if (stock->nr_pages) {
>> -		page_counter_uncharge(&old->memory, stock->nr_pages);
>> -		if (do_memsw_account())
>> -			page_counter_uncharge(&old->memsw, stock->nr_pages);
>> +		cancel_charge(old, stock->nr_pages);
>>   		stock->nr_pages = 0;
>>   	}
>>   
>> @@ -2219,6 +2219,14 @@ static void refill_stock(struct mem_cgroup *memcg, unsigned int nr_pages)
>>   	struct memcg_stock_pcp *stock;
>>   	unsigned long flags;
>>   
>> +	/*
>> +	 * An offlined memcg shouldn't be put into stock.
>> +	 */
>> +	if (unlikely(memcg->kmem_state != KMEM_ONLINE)) {
>> +		cancel_charge(memcg, nr_pages);
>> +		return;
>> +	}
>> +
>>   	local_irq_save(flags);
>>   
>>   	stock = this_cpu_ptr(&memcg_stock);
>> @@ -2732,7 +2740,6 @@ static inline int try_charge(struct mem_cgroup *memcg, gfp_t gfp_mask,
>>   	return try_charge_memcg(memcg, gfp_mask, nr_pages);
>>   }
>>   
>> -#if defined(CONFIG_MEMCG_KMEM) || defined(CONFIG_MMU)
>>   static void cancel_charge(struct mem_cgroup *memcg, unsigned int nr_pages)
>>   {
>>   	if (mem_cgroup_is_root(memcg))
>> @@ -2742,7 +2749,6 @@ static void cancel_charge(struct mem_cgroup *memcg, unsigned int nr_pages)
>>   	if (do_memsw_account())
>>   		page_counter_uncharge(&memcg->memsw, nr_pages);
>>   }
>> -#endif
>>   
>>   static void commit_charge(struct folio *folio, struct mem_cgroup *memcg)
>>   {
>> -- 
>> 2.18.1
>>

Re: [PATCH 1/3] mm, memcg: Don't put offlined memcg into local stock

[Roman Gushchin]

On Sun, Jan 30, 2022 at 10:55:56PM -0500, Waiman Long wrote:
> On 10/1/21 19:51, Roman Gushchin wrote:
> > On Fri, Oct 01, 2021 at 03:09:36PM -0400, Waiman Long wrote:
> > > When freeing a page associated with an offlined memcg, refill_stock()
> > > will put it into local stock delaying its demise until another memcg
> > > comes in to take its place in the stock. To avoid that, we now check
> > > for offlined memcg and go directly in this case to the slowpath for
> > > the uncharge via the repurposed cancel_charge() function.
> > Hi Waiman!
> > 
> > I'm afraid it can make a cleanup of a dying cgroup slower: for every
> > released page we'll potentially traverse the whole cgroup tree and
> > decrease atomic page counters.
> > 
> > I'm not sure I understand the benefits we get from this change which
> > do justify the slowdown on the cleanup path.
> > 
> > Thanks!
> 
> I was notified of a lockdep splat that this patch may help to prevent.

Would you mind to test this patch:
https://www.spinics.net/lists/cgroups/msg31244.html ?

It should address this dependency.

Thanks!

Re: [PATCH 1/3] mm, memcg: Don't put offlined memcg into local stock

[Waiman Long]

On 1/31/22 12:01, Roman Gushchin wrote:
> On Sun, Jan 30, 2022 at 10:55:56PM -0500, Waiman Long wrote:
>> On 10/1/21 19:51, Roman Gushchin wrote:
>>> On Fri, Oct 01, 2021 at 03:09:36PM -0400, Waiman Long wrote:
>>>> When freeing a page associated with an offlined memcg, refill_stock()
>>>> will put it into local stock delaying its demise until another memcg
>>>> comes in to take its place in the stock. To avoid that, we now check
>>>> for offlined memcg and go directly in this case to the slowpath for
>>>> the uncharge via the repurposed cancel_charge() function.
>>> Hi Waiman!
>>>
>>> I'm afraid it can make a cleanup of a dying cgroup slower: for every
>>> released page we'll potentially traverse the whole cgroup tree and
>>> decrease atomic page counters.
>>>
>>> I'm not sure I understand the benefits we get from this change which
>>> do justify the slowdown on the cleanup path.
>>>
>>> Thanks!
>> I was notified of a lockdep splat that this patch may help to prevent.
> Would you mind to test this patch:
> https://www.spinics.net/lists/cgroups/msg31244.html ?
>
> It should address this dependency.

Thanks for the pointer. I believe that your patch should be able to 
address this circular locking dependency.

Feel free to add my

Reviewed-by: Waiman Long <longman@redhat.com>

Cheers,
Longman

Re: [PATCH 1/3] mm, memcg: Don't put offlined memcg into local stock

[Waiman Long]

On 1/31/22 12:09, Waiman Long wrote:
> On 1/31/22 12:01, Roman Gushchin wrote:
>> On Sun, Jan 30, 2022 at 10:55:56PM -0500, Waiman Long wrote:
>>> On 10/1/21 19:51, Roman Gushchin wrote:
>>>> On Fri, Oct 01, 2021 at 03:09:36PM -0400, Waiman Long wrote:
>>>>> When freeing a page associated with an offlined memcg, refill_stock()
>>>>> will put it into local stock delaying its demise until another memcg
>>>>> comes in to take its place in the stock. To avoid that, we now check
>>>>> for offlined memcg and go directly in this case to the slowpath for
>>>>> the uncharge via the repurposed cancel_charge() function.
>>>> Hi Waiman!
>>>>
>>>> I'm afraid it can make a cleanup of a dying cgroup slower: for every
>>>> released page we'll potentially traverse the whole cgroup tree and
>>>> decrease atomic page counters.
>>>>
>>>> I'm not sure I understand the benefits we get from this change which
>>>> do justify the slowdown on the cleanup path.
>>>>
>>>> Thanks!
>>> I was notified of a lockdep splat that this patch may help to prevent.
>> Would you mind to test this patch:
>> https://www.spinics.net/lists/cgroups/msg31244.html ?
>>
>> It should address this dependency.
>
> Thanks for the pointer. I believe that your patch should be able to 
> address this circular locking dependency.
>
> Feel free to add my
>
> Reviewed-by: Waiman Long <longman@redhat.com>

BTW, have you posted it to lkml? If not, would you mind doing so?

Thanks,
Longman

Re: [PATCH 1/3] mm, memcg: Don't put offlined memcg into local stock

[Roman Gushchin]

On Mon, Jan 31, 2022 at 12:15:19PM -0500, Waiman Long wrote:
> On 1/31/22 12:09, Waiman Long wrote:
> > On 1/31/22 12:01, Roman Gushchin wrote:
> > > On Sun, Jan 30, 2022 at 10:55:56PM -0500, Waiman Long wrote:
> > > > On 10/1/21 19:51, Roman Gushchin wrote:
> > > > > On Fri, Oct 01, 2021 at 03:09:36PM -0400, Waiman Long wrote:
> > > > > > When freeing a page associated with an offlined memcg, refill_stock()
> > > > > > will put it into local stock delaying its demise until another memcg
> > > > > > comes in to take its place in the stock. To avoid that, we now check
> > > > > > for offlined memcg and go directly in this case to the slowpath for
> > > > > > the uncharge via the repurposed cancel_charge() function.
> > > > > Hi Waiman!
> > > > > 
> > > > > I'm afraid it can make a cleanup of a dying cgroup slower: for every
> > > > > released page we'll potentially traverse the whole cgroup tree and
> > > > > decrease atomic page counters.
> > > > > 
> > > > > I'm not sure I understand the benefits we get from this change which
> > > > > do justify the slowdown on the cleanup path.
> > > > > 
> > > > > Thanks!
> > > > I was notified of a lockdep splat that this patch may help to prevent.
> > > Would you mind to test this patch:
> > > https://www.spinics.net/lists/cgroups/msg31244.html  ?
> > > 
> > > It should address this dependency.
> > 
> > Thanks for the pointer. I believe that your patch should be able to
> > address this circular locking dependency.
> > 
> > Feel free to add my
> > 
> > Reviewed-by: Waiman Long <longman-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
> 
> BTW, have you posted it to lkml? If not, would you mind doing so?

Not yet.

I was waiting for Alexander to confirm that it resolves the originally reported
issue. I just pinged him, will wait for tomorrow and post the patch in any case.

Thanks!

Re: [PATCH 1/3] mm, memcg: Don't put offlined memcg into local stock

[Waiman Long]

On 1/31/22 12:19, Roman Gushchin wrote:
> On Mon, Jan 31, 2022 at 12:15:19PM -0500, Waiman Long wrote:
>> On 1/31/22 12:09, Waiman Long wrote:
>>> On 1/31/22 12:01, Roman Gushchin wrote:
>>>> On Sun, Jan 30, 2022 at 10:55:56PM -0500, Waiman Long wrote:
>>>>> On 10/1/21 19:51, Roman Gushchin wrote:
>>>>>> On Fri, Oct 01, 2021 at 03:09:36PM -0400, Waiman Long wrote:
>>>>>>> When freeing a page associated with an offlined memcg, refill_stock()
>>>>>>> will put it into local stock delaying its demise until another memcg
>>>>>>> comes in to take its place in the stock. To avoid that, we now check
>>>>>>> for offlined memcg and go directly in this case to the slowpath for
>>>>>>> the uncharge via the repurposed cancel_charge() function.
>>>>>> Hi Waiman!
>>>>>>
>>>>>> I'm afraid it can make a cleanup of a dying cgroup slower: for every
>>>>>> released page we'll potentially traverse the whole cgroup tree and
>>>>>> decrease atomic page counters.
>>>>>>
>>>>>> I'm not sure I understand the benefits we get from this change which
>>>>>> do justify the slowdown on the cleanup path.
>>>>>>
>>>>>> Thanks!
>>>>> I was notified of a lockdep splat that this patch may help to prevent.
>>>> Would you mind to test this patch:
>>>> https://www.spinics.net/lists/cgroups/msg31244.html  ?
>>>>
>>>> It should address this dependency.
>>> Thanks for the pointer. I believe that your patch should be able to
>>> address this circular locking dependency.
>>>
>>> Feel free to add my
>>>
>>> Reviewed-by: Waiman Long <longman-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
>> BTW, have you posted it to lkml? If not, would you mind doing so?
> Not yet.
>
> I was waiting for Alexander to confirm that it resolves the originally reported
> issue. I just pinged him, will wait for tomorrow and post the patch in any case.
>
> Thanks!

I see. This is not a problem that is easily reproducible. You need to 
hit the right timing for the lockdep splat to appear.

Regards,
Longman

Re: [PATCH 1/3] mm, memcg: Don't put offlined memcg into local stock

[Shakeel Butt]

On Mon, Jan 31, 2022 at 9:25 AM Waiman Long <longman-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> wrote:
>
> On 1/31/22 12:19, Roman Gushchin wrote:
> > On Mon, Jan 31, 2022 at 12:15:19PM -0500, Waiman Long wrote:
> >> On 1/31/22 12:09, Waiman Long wrote:
> >>> On 1/31/22 12:01, Roman Gushchin wrote:
> >>>> On Sun, Jan 30, 2022 at 10:55:56PM -0500, Waiman Long wrote:
> >>>>> On 10/1/21 19:51, Roman Gushchin wrote:
> >>>>>> On Fri, Oct 01, 2021 at 03:09:36PM -0400, Waiman Long wrote:
> >>>>>>> When freeing a page associated with an offlined memcg, refill_stock()
> >>>>>>> will put it into local stock delaying its demise until another memcg
> >>>>>>> comes in to take its place in the stock. To avoid that, we now check
> >>>>>>> for offlined memcg and go directly in this case to the slowpath for
> >>>>>>> the uncharge via the repurposed cancel_charge() function.
> >>>>>> Hi Waiman!
> >>>>>>
> >>>>>> I'm afraid it can make a cleanup of a dying cgroup slower: for every
> >>>>>> released page we'll potentially traverse the whole cgroup tree and
> >>>>>> decrease atomic page counters.
> >>>>>>
> >>>>>> I'm not sure I understand the benefits we get from this change which
> >>>>>> do justify the slowdown on the cleanup path.
> >>>>>>
> >>>>>> Thanks!
> >>>>> I was notified of a lockdep splat that this patch may help to prevent.
> >>>> Would you mind to test this patch:
> >>>> https://www.spinics.net/lists/cgroups/msg31244.html  ?
> >>>>
> >>>> It should address this dependency.
> >>> Thanks for the pointer. I believe that your patch should be able to
> >>> address this circular locking dependency.
> >>>
> >>> Feel free to add my
> >>>
> >>> Reviewed-by: Waiman Long <longman-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
> >> BTW, have you posted it to lkml? If not, would you mind doing so?
> > Not yet.
> >
> > I was waiting for Alexander to confirm that it resolves the originally reported
> > issue. I just pinged him, will wait for tomorrow and post the patch in any case.
> >
> > Thanks!
>
> I see. This is not a problem that is easily reproducible. You need to
> hit the right timing for the lockdep splat to appear.

I agree here. The patch on its own has merits as it is reducing
dependency on an unrelated lock.

Re: [PATCH 1/3] mm, memcg: Don't put offlined memcg into local stock

[Roman Gushchin]

On Mon, Jan 31, 2022 at 12:09:09PM -0500, Waiman Long wrote:
> On 1/31/22 12:01, Roman Gushchin wrote:
> > On Sun, Jan 30, 2022 at 10:55:56PM -0500, Waiman Long wrote:
> > > On 10/1/21 19:51, Roman Gushchin wrote:
> > > > On Fri, Oct 01, 2021 at 03:09:36PM -0400, Waiman Long wrote:
> > > > > When freeing a page associated with an offlined memcg, refill_stock()
> > > > > will put it into local stock delaying its demise until another memcg
> > > > > comes in to take its place in the stock. To avoid that, we now check
> > > > > for offlined memcg and go directly in this case to the slowpath for
> > > > > the uncharge via the repurposed cancel_charge() function.
> > > > Hi Waiman!
> > > > 
> > > > I'm afraid it can make a cleanup of a dying cgroup slower: for every
> > > > released page we'll potentially traverse the whole cgroup tree and
> > > > decrease atomic page counters.
> > > > 
> > > > I'm not sure I understand the benefits we get from this change which
> > > > do justify the slowdown on the cleanup path.
> > > > 
> > > > Thanks!
> > > I was notified of a lockdep splat that this patch may help to prevent.
> > Would you mind to test this patch:
> > https://www.spinics.net/lists/cgroups/msg31244.html  ?
> > 
> > It should address this dependency.
> 
> Thanks for the pointer. I believe that your patch should be able to address
> this circular locking dependency.
> 
> Feel free to add my
> 
> Reviewed-by: Waiman Long <longman-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>

Thank you!

[PATCH 2/3] mm, memcg: Remove obsolete memcg_free_kmem()

[Waiman Long]

Since commit d648bcc7fe65 ("mm: kmem: make memcg_kmem_enabled()
irreversible"), the only thing memcg_free_kmem() does is to call
memcg_offline_kmem() when the memcg is still online. However,
memcg_offline_kmem() is only called from mem_cgroup_css_free() which
cannot be reached if the memcg hasn't been offlined first. As this
function now serves no purpose, we should just remove it.

Signed-off-by: Waiman Long <longman-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
---
 mm/memcontrol.c | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 4568363062c1..8177f253a127 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3673,13 +3673,6 @@ static void memcg_offline_kmem(struct mem_cgroup *memcg)
 
 	memcg_free_cache_id(kmemcg_id);
 }
-
-static void memcg_free_kmem(struct mem_cgroup *memcg)
-{
-	/* css_alloc() failed, offlining didn't happen */
-	if (unlikely(memcg->kmem_state == KMEM_ONLINE))
-		memcg_offline_kmem(memcg);
-}
 #else
 static int memcg_online_kmem(struct mem_cgroup *memcg)
 {
@@ -3688,9 +3681,6 @@ static int memcg_online_kmem(struct mem_cgroup *memcg)
 static void memcg_offline_kmem(struct mem_cgroup *memcg)
 {
 }
-static void memcg_free_kmem(struct mem_cgroup *memcg)
-{
-}
 #endif /* CONFIG_MEMCG_KMEM */
 
 static int memcg_update_kmem_max(struct mem_cgroup *memcg,
@@ -5325,7 +5315,6 @@ static void mem_cgroup_css_free(struct cgroup_subsys_state *css)
 	cancel_work_sync(&memcg->high_work);
 	mem_cgroup_remove_from_trees(memcg);
 	free_shrinker_info(memcg);
-	memcg_free_kmem(memcg);
 	mem_cgroup_free(memcg);
 }
 
-- 
2.18.1

Re: [PATCH 2/3] mm, memcg: Remove obsolete memcg_free_kmem()

[Roman Gushchin]

On Fri, Oct 01, 2021 at 03:09:37PM -0400, Waiman Long wrote:
> Since commit d648bcc7fe65 ("mm: kmem: make memcg_kmem_enabled()
> irreversible"), the only thing memcg_free_kmem() does is to call
> memcg_offline_kmem() when the memcg is still online. However,
> memcg_offline_kmem() is only called from mem_cgroup_css_free() which
> cannot be reached if the memcg hasn't been offlined first.

Hm, is it true? What if online_css() fails?

> As this
> function now serves no purpose, we should just remove it.

It looks like we can just use memcg_offline_kmem() instead of
memcg_free_kmem().

Thanks!

> 
> Signed-off-by: Waiman Long <longman-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
> ---
>  mm/memcontrol.c | 11 -----------
>  1 file changed, 11 deletions(-)
> 
> diff --git a/mm/memcontrol.c b/mm/memcontrol.c
> index 4568363062c1..8177f253a127 100644
> --- a/mm/memcontrol.c
> +++ b/mm/memcontrol.c
> @@ -3673,13 +3673,6 @@ static void memcg_offline_kmem(struct mem_cgroup *memcg)
>  
>  	memcg_free_cache_id(kmemcg_id);
>  }
> -
> -static void memcg_free_kmem(struct mem_cgroup *memcg)
> -{
> -	/* css_alloc() failed, offlining didn't happen */
> -	if (unlikely(memcg->kmem_state == KMEM_ONLINE))
> -		memcg_offline_kmem(memcg);
> -}
>  #else
>  static int memcg_online_kmem(struct mem_cgroup *memcg)
>  {
> @@ -3688,9 +3681,6 @@ static int memcg_online_kmem(struct mem_cgroup *memcg)
>  static void memcg_offline_kmem(struct mem_cgroup *memcg)
>  {
>  }
> -static void memcg_free_kmem(struct mem_cgroup *memcg)
> -{
> -}
>  #endif /* CONFIG_MEMCG_KMEM */
>  
>  static int memcg_update_kmem_max(struct mem_cgroup *memcg,
> @@ -5325,7 +5315,6 @@ static void mem_cgroup_css_free(struct cgroup_subsys_state *css)
>  	cancel_work_sync(&memcg->high_work);
>  	mem_cgroup_remove_from_trees(memcg);
>  	free_shrinker_info(memcg);
> -	memcg_free_kmem(memcg);
>  	mem_cgroup_free(memcg);
>  }
>  
> -- 
> 2.18.1
> 

Re: [PATCH 2/3] mm, memcg: Remove obsolete memcg_free_kmem()

[Waiman Long]

On 10/1/21 8:01 PM, Roman Gushchin wrote:
> On Fri, Oct 01, 2021 at 03:09:37PM -0400, Waiman Long wrote:
>> Since commit d648bcc7fe65 ("mm: kmem: make memcg_kmem_enabled()
>> irreversible"), the only thing memcg_free_kmem() does is to call
>> memcg_offline_kmem() when the memcg is still online. However,
>> memcg_offline_kmem() is only called from mem_cgroup_css_free() which
>> cannot be reached if the memcg hasn't been offlined first.
> Hm, is it true? What if online_css() fails?
I just realize that memcg_online_kmem() is called at css_create(). So 
yes, if css_online() fails (i.e. ENOMEM), we will need to do 
memcg_offline_kmem().
>> As this
>> function now serves no purpose, we should just remove it.
> It looks like we can just use memcg_offline_kmem() instead of
> memcg_free_kmem().

Right, memcg_free_kmem() isn't the right name for that. I agree that we 
should just change mem_cgroup_css_free() to call memcg_offline_kmem() 
directly. Will update the patch accordingly.

Thanks,
Longman

[PATCH 3/3] mm, memcg: Ensure valid memcg from objcg within a RCU critical section

[Waiman Long]

To ensure that a to-be-offlined memcg fetched from objcg remains
valid (has non-zero reference count) within a RCU critical section,
a synchronize_rcu() call is inserted at the end of memcg_offline_kmem().

With that change, we no longer need to use css_tryget()
in get_mem_cgroup_from_objcg() as the final css_put() in
css_killed_work_fn() would not have been called yet.

The obj_cgroup_uncharge_pages() function is simplifed to perform
the whole uncharge operation within a RCU critical section saving a
css_get()/css_put() pair.

Signed-off-by: Waiman Long <longman-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
---
 mm/memcontrol.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 8177f253a127..1dbb37d96e49 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -2769,10 +2769,8 @@ static struct mem_cgroup *get_mem_cgroup_from_objcg(struct obj_cgroup *objcg)
 	struct mem_cgroup *memcg;
 
 	rcu_read_lock();
-retry:
 	memcg = obj_cgroup_memcg(objcg);
-	if (unlikely(!css_tryget(&memcg->css)))
-		goto retry;
+	css_get(&memcg->css);
 	rcu_read_unlock();
 
 	return memcg;
@@ -2947,13 +2945,14 @@ static void obj_cgroup_uncharge_pages(struct obj_cgroup *objcg,
 {
 	struct mem_cgroup *memcg;
 
-	memcg = get_mem_cgroup_from_objcg(objcg);
+	rcu_read_lock();
+	memcg = obj_cgroup_memcg(objcg);
 
 	if (!cgroup_subsys_on_dfl(memory_cgrp_subsys))
 		page_counter_uncharge(&memcg->kmem, nr_pages);
 	refill_stock(memcg, nr_pages);
 
-	css_put(&memcg->css);
+	rcu_read_unlock();
 }
 
 /*
@@ -3672,6 +3671,13 @@ static void memcg_offline_kmem(struct mem_cgroup *memcg)
 	memcg_drain_all_list_lrus(kmemcg_id, parent);
 
 	memcg_free_cache_id(kmemcg_id);
+
+	/*
+	 * To ensure that a to-be-offlined memcg fetched from objcg remains
+	 * valid within a RCU critical section, we need to wait here until
+	 * the a grace period has elapsed.
+	 */
+	synchronize_rcu();
 }
 #else
 static int memcg_online_kmem(struct mem_cgroup *memcg)
-- 
2.18.1

Re: [PATCH 3/3] mm, memcg: Ensure valid memcg from objcg within a RCU critical section

[Shakeel Butt]

On Fri, Oct 1, 2021 at 12:10 PM Waiman Long <longman-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> wrote:
>
> To ensure that a to-be-offlined memcg fetched from objcg remains
> valid (has non-zero reference count) within a RCU critical section,
> a synchronize_rcu() call is inserted at the end of memcg_offline_kmem().
>
> With that change, we no longer need to use css_tryget()
> in get_mem_cgroup_from_objcg() as the final css_put() in
> css_killed_work_fn() would not have been called yet.
>
> The obj_cgroup_uncharge_pages() function is simplifed to perform
> the whole uncharge operation within a RCU critical section saving a
> css_get()/css_put() pair.
>
> Signed-off-by: Waiman Long <longman-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
> ---
>  mm/memcontrol.c | 16 +++++++++++-----
>  1 file changed, 11 insertions(+), 5 deletions(-)
>
> diff --git a/mm/memcontrol.c b/mm/memcontrol.c
> index 8177f253a127..1dbb37d96e49 100644
> --- a/mm/memcontrol.c
> +++ b/mm/memcontrol.c
> @@ -2769,10 +2769,8 @@ static struct mem_cgroup *get_mem_cgroup_from_objcg(struct obj_cgroup *objcg)
>         struct mem_cgroup *memcg;
>
>         rcu_read_lock();
> -retry:
>         memcg = obj_cgroup_memcg(objcg);
> -       if (unlikely(!css_tryget(&memcg->css)))
> -               goto retry;
> +       css_get(&memcg->css);
>         rcu_read_unlock();
>
>         return memcg;
> @@ -2947,13 +2945,14 @@ static void obj_cgroup_uncharge_pages(struct obj_cgroup *objcg,
>  {
>         struct mem_cgroup *memcg;
>
> -       memcg = get_mem_cgroup_from_objcg(objcg);
> +       rcu_read_lock();
> +       memcg = obj_cgroup_memcg(objcg);
>
>         if (!cgroup_subsys_on_dfl(memory_cgrp_subsys))
>                 page_counter_uncharge(&memcg->kmem, nr_pages);
>         refill_stock(memcg, nr_pages);
>
> -       css_put(&memcg->css);
> +       rcu_read_unlock();
>  }
>
>  /*
> @@ -3672,6 +3671,13 @@ static void memcg_offline_kmem(struct mem_cgroup *memcg)
>         memcg_drain_all_list_lrus(kmemcg_id, parent);
>
>         memcg_free_cache_id(kmemcg_id);
> +
> +       /*
> +        * To ensure that a to-be-offlined memcg fetched from objcg remains
> +        * valid within a RCU critical section, we need to wait here until
> +        * the a grace period has elapsed.
> +        */
> +       synchronize_rcu();

This is called with cgroup_mutex held from css_offline path and
synchronize_rcu() can be very expensive on a busy system, so, this
will indirectly impact all the code paths which take cgroup_mutex.

>  }
>  #else
>  static int memcg_online_kmem(struct mem_cgroup *memcg)
> --
> 2.18.1
>

Re: [PATCH 3/3] mm, memcg: Ensure valid memcg from objcg within a RCU critical section

[Waiman Long]

On 10/1/21 4:24 PM, Shakeel Butt wrote:
> On Fri, Oct 1, 2021 at 12:10 PM Waiman Long <longman@redhat.com> wrote:
>> To ensure that a to-be-offlined memcg fetched from objcg remains
>> valid (has non-zero reference count) within a RCU critical section,
>> a synchronize_rcu() call is inserted at the end of memcg_offline_kmem().
>>
>> With that change, we no longer need to use css_tryget()
>> in get_mem_cgroup_from_objcg() as the final css_put() in
>> css_killed_work_fn() would not have been called yet.
>>
>> The obj_cgroup_uncharge_pages() function is simplifed to perform
>> the whole uncharge operation within a RCU critical section saving a
>> css_get()/css_put() pair.
>>
>> Signed-off-by: Waiman Long <longman@redhat.com>
>> ---
>>   mm/memcontrol.c | 16 +++++++++++-----
>>   1 file changed, 11 insertions(+), 5 deletions(-)
>>
>> diff --git a/mm/memcontrol.c b/mm/memcontrol.c
>> index 8177f253a127..1dbb37d96e49 100644
>> --- a/mm/memcontrol.c
>> +++ b/mm/memcontrol.c
>> @@ -2769,10 +2769,8 @@ static struct mem_cgroup *get_mem_cgroup_from_objcg(struct obj_cgroup *objcg)
>>          struct mem_cgroup *memcg;
>>
>>          rcu_read_lock();
>> -retry:
>>          memcg = obj_cgroup_memcg(objcg);
>> -       if (unlikely(!css_tryget(&memcg->css)))
>> -               goto retry;
>> +       css_get(&memcg->css);
>>          rcu_read_unlock();
>>
>>          return memcg;
>> @@ -2947,13 +2945,14 @@ static void obj_cgroup_uncharge_pages(struct obj_cgroup *objcg,
>>   {
>>          struct mem_cgroup *memcg;
>>
>> -       memcg = get_mem_cgroup_from_objcg(objcg);
>> +       rcu_read_lock();
>> +       memcg = obj_cgroup_memcg(objcg);
>>
>>          if (!cgroup_subsys_on_dfl(memory_cgrp_subsys))
>>                  page_counter_uncharge(&memcg->kmem, nr_pages);
>>          refill_stock(memcg, nr_pages);
>>
>> -       css_put(&memcg->css);
>> +       rcu_read_unlock();
>>   }
>>
>>   /*
>> @@ -3672,6 +3671,13 @@ static void memcg_offline_kmem(struct mem_cgroup *memcg)
>>          memcg_drain_all_list_lrus(kmemcg_id, parent);
>>
>>          memcg_free_cache_id(kmemcg_id);
>> +
>> +       /*
>> +        * To ensure that a to-be-offlined memcg fetched from objcg remains
>> +        * valid within a RCU critical section, we need to wait here until
>> +        * the a grace period has elapsed.
>> +        */
>> +       synchronize_rcu();
> This is called with cgroup_mutex held from css_offline path and
> synchronize_rcu() can be very expensive on a busy system, so, this
> will indirectly impact all the code paths which take cgroup_mutex.
>
Yes, you are right. Just don't consider this patch for the time being. I 
will need to find a way to work around that.

Thanks,
Longman