[PATCH v2] ipc/shm: fix RSS accounting for hugetlb shared memory

[PATCH v2] ipc/shm: fix RSS accounting for hugetlb shared memory

[Weilin Tong]

Commit a08c7193e4f1 ("mm/filemap: remove hugetlb special casing in
filemap.c") changed mapping->nrpages to count base pages for hugetlb
folios. However, shm_add_rss_swap() still multiplies it by
pages_per_huge_page(), overcounting RSS in both SHM_INFO and
/proc/sysvipc/shm.

Use mapping->nrpages for RSS accounting across all backing types, and
account swap only for non-hugetlb shmem. Use READ_ONCE() for both counters
instead of info->lock, which does not protect nrpages and cannot provide
a consistent snapshot.

Fixes: a08c7193e4f1 ("mm/filemap: remove hugetlb special casing in filemap.c")
Suggested-by: Muchun Song <muchun.song@linux.dev>
Signed-off-by: Weilin Tong <tongweilin@linux.alibaba.com>
---
Changes in v2 (suggested by Muchun Song):
- Share RSS accounting across all backing types, leaving only swap
  accounting conditional on CONFIG_SHMEM and non-hugetlb files.
- Replace info->lock with READ_ONCE() for both counters.

v1: https://lore.kernel.org/linux-mm/82f099d8-e46d-481e-bba5-95bff118ffbb@linux.alibaba.com/T/#mf511e253ce84ad64a9b7fcfe7bff51bc7ed23f12

 ipc/shm.c | 23 ++++-------------------
 1 file changed, 4 insertions(+), 19 deletions(-)

diff --git a/ipc/shm.c b/ipc/shm.c
index bb1a721..6862f68 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -936,26 +936,11 @@ static inline unsigned long copy_shminfo_to_user(void __user *buf, struct shminf
 static void shm_add_rss_swap(struct shmid_kernel *shp,
 	unsigned long *rss_add, unsigned long *swp_add)
 {
-	struct inode *inode;
+	struct inode *inode = file_inode(shp->shm_file);
 
-	inode = file_inode(shp->shm_file);
-
-	if (is_file_hugepages(shp->shm_file)) {
-		struct address_space *mapping = inode->i_mapping;
-		struct hstate *h = hstate_file(shp->shm_file);
-		*rss_add += pages_per_huge_page(h) * mapping->nrpages;
-	} else {
-#ifdef CONFIG_SHMEM
-		struct shmem_inode_info *info = SHMEM_I(inode);
-
-		spin_lock_irq(&info->lock);
-		*rss_add += inode->i_mapping->nrpages;
-		*swp_add += info->swapped;
-		spin_unlock_irq(&info->lock);
-#else
-		*rss_add += inode->i_mapping->nrpages;
-#endif
-	}
+	*rss_add += READ_ONCE(inode->i_mapping->nrpages);
+	if (IS_ENABLED(CONFIG_SHMEM) && !is_file_hugepages(shp->shm_file))
+		*swp_add += READ_ONCE(SHMEM_I(inode)->swapped);
 }
 
 /*
-- 
2.39.3 (Apple Git-146)

Re: [PATCH v2] ipc/shm: fix RSS accounting for hugetlb shared memory

[Muchun Song]

> On Oct 14, 2026, at 16:22, Weilin Tong <tongweilin@linux.alibaba.com> wrote:
> 
> Commit a08c7193e4f1 ("mm/filemap: remove hugetlb special casing in
> filemap.c") changed mapping->nrpages to count base pages for hugetlb
> folios. However, shm_add_rss_swap() still multiplies it by
> pages_per_huge_page(), overcounting RSS in both SHM_INFO and
> /proc/sysvipc/shm.
> 
> Use mapping->nrpages for RSS accounting across all backing types, and
> account swap only for non-hugetlb shmem. Use READ_ONCE() for both counters
> instead of info->lock, which does not protect nrpages and cannot provide
> a consistent snapshot.
> 
> Fixes: a08c7193e4f1 ("mm/filemap: remove hugetlb special casing in filemap.c")
> Suggested-by: Muchun Song <muchun.song@linux.dev>
> Signed-off-by: Weilin Tong <tongweilin@linux.alibaba.com>

Acked-by: Muchun Song <muchun.song@linux.dev>

Thanks.