public inbox for linux-mm@kvack.org
 help / color / mirror / Atom feed
From: Qi Zheng <qi.zheng@linux.dev>
To: hannes@cmpxchg.org, hughd@google.com, mhocko@suse.com,
	roman.gushchin@linux.dev, shakeel.butt@linux.dev,
	muchun.song@linux.dev, david@kernel.org, ljs@kernel.org,
	ziy@nvidia.com, harry.yoo@oracle.com, yosry.ahmed@linux.dev,
	imran.f.khan@oracle.com, kamalesh.babulal@oracle.com,
	axelrasmussen@google.com, yuanchu@google.com, weixugc@google.com,
	chenridong@huaweicloud.com, mkoutny@suse.com,
	akpm@linux-foundation.org, hamzamahfooz@linux.microsoft.com,
	apais@linux.microsoft.com, lance.yang@linux.dev, bhe@redhat.com,
	usamaarif642@gmail.com, Qi Zheng <zhengqi.arch@bytedance.com>
Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2 0/4] fix unexpected type conversions and potential overflows
Date: Wed, 25 Mar 2026 22:24:37 +0800	[thread overview]
Message-ID: <19e8a328-d4c2-4809-a42d-e46d2a994d5d@linux.dev> (raw)
In-Reply-To: <cover.1774447069.git.zhengqi.arch@bytedance.com>

Forgot to include the changelog:

Changes in v2:

  - modified all commit messages. (suggested-by Lorenzo Stoakes)
  - added a fix patch to resolve the unexpected massive positive number
    (pointed-by Harry Yoo and sashiko)
  - fix the print type mismatch in [PATCH 3/3]
  - collect Reviewed-by

On 3/25/26 10:13 PM, Qi Zheng wrote:
> From: Qi Zheng <zhengqi.arch@bytedance.com>
> 
> Hi all,
> 
> As Harry Yoo pointed out [1], in scenarios where massive state updates occur
> (e.g., during the reparenting of LRU folios), the values passed to memcg stat
> update functions can accumulate and exceed the upper limit of a 32-bit integer.
> 
> If the parameter types are not large enough (like 'int') or are handled
> incorrectly, it can lead to severe truncation, potential overflow issues,
> and unexpected type conversion bugs.
> 
> This series aims to address these issues by correcting the parameter types
> in the relevant functions, and fixing an implicit conversion bug in
> memcg_state_val_in_pages().
> 
> This series is based on the next-20260323.
> 
> Comments and suggestions are welcome!
> 
> Thanks,
> Qi
> 
> [1]. https://lore.kernel.org/all/acDxaEgnqPI-Z4be@hyeyoo/
> 
> Qi Zheng (4):
>    mm: memcontrol: correct the type of stats_updates to unsigned long
>    mm: memcontrol: change val type to long in
>      __mod_memcg_{lruvec_}state()
>    mm: memcontrol: correct the nr_pages parameter type of
>      mem_cgroup_update_lru_size()
>    mm: memcontrol: fix unexpected massive positive number in
>      memcg_state_val_in_pages()
> 
>   include/linux/memcontrol.h   |  2 +-
>   include/trace/events/memcg.h | 10 +++++-----
>   mm/memcontrol.c              | 37 +++++++++++++++++++-----------------
>   3 files changed, 26 insertions(+), 23 deletions(-)
> 



  parent reply	other threads:[~2026-03-25 14:25 UTC|newest]

Thread overview: 30+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-03-25 14:13 [PATCH v2 0/4] fix unexpected type conversions and potential overflows Qi Zheng
2026-03-25 14:13 ` [PATCH v2 1/4] mm: memcontrol: correct the type of stats_updates to unsigned long Qi Zheng
2026-03-25 15:28   ` Lorenzo Stoakes (Oracle)
2026-03-26  2:32     ` Qi Zheng
2026-03-26  8:05       ` Lorenzo Stoakes (Oracle)
2026-03-26  8:19         ` Harry Yoo (Oracle)
2026-03-26  8:20         ` Qi Zheng
2026-03-25 14:13 ` [PATCH v2 2/4] mm: memcontrol: change val type to long in __mod_memcg_{lruvec_}state() Qi Zheng
2026-03-26  9:19   ` Lorenzo Stoakes (Oracle)
2026-03-26 14:37     ` David Laight
2026-03-27  2:37       ` Qi Zheng
2026-03-25 14:13 ` [PATCH v2 3/4] mm: memcontrol: correct the nr_pages parameter type of mem_cgroup_update_lru_size() Qi Zheng
2026-03-25 14:13 ` [PATCH v2 4/4] mm: memcontrol: fix unexpected massive positive number in memcg_state_val_in_pages() Qi Zheng
2026-03-26  9:16   ` Lorenzo Stoakes (Oracle)
2026-03-26  9:21     ` Lorenzo Stoakes (Oracle)
2026-03-26  9:32     ` Qi Zheng
2026-03-26  9:38       ` Lorenzo Stoakes (Oracle)
2026-03-27  0:06         ` Andrew Morton
2026-03-27  2:42           ` Qi Zheng
2026-03-27  3:13             ` Andrew Morton
2026-03-27  7:51               ` Lorenzo Stoakes (Oracle)
2026-03-25 14:24 ` Qi Zheng [this message]
2026-03-25 23:57 ` [PATCH v2 0/4] fix unexpected type conversions and potential overflows Andrew Morton
2026-03-26  0:28   ` Andrew Morton
2026-03-26  2:30   ` Qi Zheng
2026-03-26  3:27     ` Andrew Morton
2026-03-26  7:14 ` Michal Hocko
2026-03-26  7:51   ` Harry Yoo (Oracle)
2026-03-26  8:18     ` Michal Hocko
2026-03-26  9:22       ` Lorenzo Stoakes (Oracle)

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=19e8a328-d4c2-4809-a42d-e46d2a994d5d@linux.dev \
    --to=qi.zheng@linux.dev \
    --cc=akpm@linux-foundation.org \
    --cc=apais@linux.microsoft.com \
    --cc=axelrasmussen@google.com \
    --cc=bhe@redhat.com \
    --cc=chenridong@huaweicloud.com \
    --cc=david@kernel.org \
    --cc=hamzamahfooz@linux.microsoft.com \
    --cc=hannes@cmpxchg.org \
    --cc=harry.yoo@oracle.com \
    --cc=hughd@google.com \
    --cc=imran.f.khan@oracle.com \
    --cc=kamalesh.babulal@oracle.com \
    --cc=lance.yang@linux.dev \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=ljs@kernel.org \
    --cc=mhocko@suse.com \
    --cc=mkoutny@suse.com \
    --cc=muchun.song@linux.dev \
    --cc=roman.gushchin@linux.dev \
    --cc=shakeel.butt@linux.dev \
    --cc=usamaarif642@gmail.com \
    --cc=weixugc@google.com \
    --cc=yosry.ahmed@linux.dev \
    --cc=yuanchu@google.com \
    --cc=zhengqi.arch@bytedance.com \
    --cc=ziy@nvidia.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox