* [PATCH] mm/list_lru: disable memcg awareness under cgroup_disable=memory
@ 2026-09-02 3:28 Qinyun Tan
2026-09-02 9:16 ` Baolin Wang
0 siblings, 1 reply; 3+ messages in thread
From: Qinyun Tan @ 2026-09-02 3:28 UTC (permalink / raw)
To: Andrew Morton
Cc: Dave Chinner, Qi Zheng, Roman Gushchin, Muchun Song, Baolin Wang,
Xunlei Pang, linux-mm, linux-kernel, Qinyun Tan
__list_lru_init() only collapses a memcg-aware list_lru into plain
per-node lists when kmem accounting is disabled
(cgroup.memory=nokmem). When the memory controller is disabled
entirely (cgroup_disable=memory), mem_cgroup_kmem_disabled() is
false, so the lru stays memcg aware even though no object will ever
be charged to a memcg.
This is more than a semantic inconsistency.
folio_memcg_list_lru_alloc() trusts list_lru_memcg_aware() and
dereferences the folio's memcg, which is always NULL with the
controller disabled. The only mainline caller,
folio_memcg_alloc_deferred(), papers over this with an explicit
mem_cgroup_disabled() check. The shmem unused-huge shrinker
conversion ("mm: shmem: make unused huge shrinker memcg aware") adds
a second caller without such a guard, so booting with
cgroup_disable=memory and writing to a huge=always tmpfs oopses:
BUG: unable to handle page fault for address: 0000000000000488
RIP: 0010:folio_memcg_list_lru_alloc+0x41/0xf0
Call Trace:
<TASK>
shmem_get_folio_gfp+0x1cd/0x7c0
shmem_write_begin+0x5d/0x100
generic_perform_write+0x89/0x2a0
shmem_file_write_iter+0x82/0x90
vfs_write+0x256/0x410
ksys_write+0x61/0xe0
do_syscall_64+0x8d/0x460
entry_SYSCALL_64_after_hwframe+0x76/0x7e
The faulting address is the offset of mem_cgroup->kmemcg_id,
dereferenced on a NULL memcg in memcg_list_lru_allocated():
folio_memcg_list_lru_alloc()
list_lru_memcg_aware() <- true, only nokmem checked
memcg = folio_memcg(folio) <- NULL
memcg_list_lru_allocated(memcg, lru)
memcg->kmemcg_id <- NULL pointer dereference
Check mem_cgroup_disabled() in __list_lru_init() so that all
list_lrus fall back to plain per-node lists when the controller is
disabled, matching what the shrinker side already does
(shrinker_memcg_alloc() bails out on mem_cgroup_disabled()). This
makes the mem_cgroup_disabled() check in callers unnecessary rather
than mandatory.
Signed-off-by: Qinyun Tan <qinyuntan@linux.alibaba.com>
---
Applies on top of mm-new. No Fixes: tag since the commit that makes
the crash reachable ("mm: shmem: make unused huge shrinker memcg
aware") is only in mm-new; no stable backport is needed either.
Reproducer, on mm-new booted with cgroup_disable=memory
(CONFIG_MEMCG=y, CONFIG_TRANSPARENT_HUGEPAGE=y):
# mount -t tmpfs -o huge=always tmpfs /mnt
# echo x > /mnt/f
Without this patch the write oopses immediately as shown above: the
freshly allocated huge folio extends beyond i_size, so
shmem_get_folio_gfp() queues the inode via shmem_unused_huge_add()
-> folio_memcg_list_lru_alloc(), which dereferences the NULL
folio_memcg().
With this patch the same steps run cleanly: the lru falls back to
plain per-node lists and folio_memcg_list_lru_alloc() returns early.
From code inspection the rest of the shmem path handles the NULL
objcg fine (obj_cgroup_memcg() and obj_cgroup_put() are NULL-safe,
and list_lru_add() with a NULL memcg lands on the per-node list),
but I have not exercised the shrinker reclaim itself under
cgroup_disable=memory.
Discussion: https://lore.kernel.org/linux-mm/20260901115104.2944996-1-qinyuntan@linux.alibaba.com/
mm/list_lru.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/mm/list_lru.c b/mm/list_lru.c
index 36662d02ff963..f8be119351cca 100644
--- a/mm/list_lru.c
+++ b/mm/list_lru.c
@@ -671,7 +671,12 @@ int __list_lru_init(struct list_lru *lru, bool memcg_aware, struct shrinker *shr
else
lru->shrinker_id = -1;
- if (mem_cgroup_kmem_disabled())
+ /*
+ * With the memory controller disabled entirely, no object is ever
+ * charged to a memcg, so collapse to plain per-node lists just
+ * like under nokmem.
+ */
+ if (mem_cgroup_disabled() || mem_cgroup_kmem_disabled())
memcg_aware = false;
#endif
--
2.43.7
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] mm/list_lru: disable memcg awareness under cgroup_disable=memory
2026-09-02 3:28 [PATCH] mm/list_lru: disable memcg awareness under cgroup_disable=memory Qinyun Tan
@ 2026-09-02 9:16 ` Baolin Wang
2026-09-02 9:30 ` Qinyun Tan
0 siblings, 1 reply; 3+ messages in thread
From: Baolin Wang @ 2026-09-02 9:16 UTC (permalink / raw)
To: Qinyun Tan, Andrew Morton
Cc: Dave Chinner, Qi Zheng, Roman Gushchin, Muchun Song, Xunlei Pang,
linux-mm, linux-kernel
On 9/2/26 11:28 AM, Qinyun Tan wrote:
> __list_lru_init() only collapses a memcg-aware list_lru into plain
> per-node lists when kmem accounting is disabled
> (cgroup.memory=nokmem). When the memory controller is disabled
> entirely (cgroup_disable=memory), mem_cgroup_kmem_disabled() is
> false, so the lru stays memcg aware even though no object will ever
> be charged to a memcg.
>
> This is more than a semantic inconsistency.
> folio_memcg_list_lru_alloc() trusts list_lru_memcg_aware() and
> dereferences the folio's memcg, which is always NULL with the
> controller disabled. The only mainline caller,
> folio_memcg_alloc_deferred(), papers over this with an explicit
> mem_cgroup_disabled() check. The shmem unused-huge shrinker
> conversion ("mm: shmem: make unused huge shrinker memcg aware") adds
> a second caller without such a guard, so booting with
> cgroup_disable=memory and writing to a huge=always tmpfs oopses:
>
> BUG: unable to handle page fault for address: 0000000000000488
> RIP: 0010:folio_memcg_list_lru_alloc+0x41/0xf0
> Call Trace:
> <TASK>
> shmem_get_folio_gfp+0x1cd/0x7c0
> shmem_write_begin+0x5d/0x100
> generic_perform_write+0x89/0x2a0
> shmem_file_write_iter+0x82/0x90
> vfs_write+0x256/0x410
> ksys_write+0x61/0xe0
> do_syscall_64+0x8d/0x460
> entry_SYSCALL_64_after_hwframe+0x76/0x7e
>
> The faulting address is the offset of mem_cgroup->kmemcg_id,
> dereferenced on a NULL memcg in memcg_list_lru_allocated():
>
> folio_memcg_list_lru_alloc()
> list_lru_memcg_aware() <- true, only nokmem checked
> memcg = folio_memcg(folio) <- NULL
> memcg_list_lru_allocated(memcg, lru)
> memcg->kmemcg_id <- NULL pointer dereference
>
> Check mem_cgroup_disabled() in __list_lru_init() so that all
> list_lrus fall back to plain per-node lists when the controller is
> disabled, matching what the shrinker side already does
> (shrinker_memcg_alloc() bails out on mem_cgroup_disabled()). This
> makes the mem_cgroup_disabled() check in callers unnecessary rather
> than mandatory.
>
> Signed-off-by: Qinyun Tan <qinyuntan@linux.alibaba.com>
> ---
> Applies on top of mm-new. No Fixes: tag since the commit that makes
> the crash reachable ("mm: shmem: make unused huge shrinker memcg
> aware") is only in mm-new; no stable backport is needed either.
>
> Reproducer, on mm-new booted with cgroup_disable=memory
> (CONFIG_MEMCG=y, CONFIG_TRANSPARENT_HUGEPAGE=y):
>
> # mount -t tmpfs -o huge=always tmpfs /mnt
> # echo x > /mnt/f
>
> Without this patch the write oopses immediately as shown above: the
> freshly allocated huge folio extends beyond i_size, so
> shmem_get_folio_gfp() queues the inode via shmem_unused_huge_add()
> -> folio_memcg_list_lru_alloc(), which dereferences the NULL
> folio_memcg().
>
> With this patch the same steps run cleanly: the lru falls back to
> plain per-node lists and folio_memcg_list_lru_alloc() returns early.
> From code inspection the rest of the shmem path handles the NULL
> objcg fine (obj_cgroup_memcg() and obj_cgroup_put() are NULL-safe,
> and list_lru_add() with a NULL memcg lands on the per-node list),
> but I have not exercised the shrinker reclaim itself under
> cgroup_disable=memory.
>
> Discussion: https://lore.kernel.org/linux-mm/20260901115104.2944996-1-qinyuntan@linux.alibaba.com/
>
> mm/list_lru.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/mm/list_lru.c b/mm/list_lru.c
> index 36662d02ff963..f8be119351cca 100644
> --- a/mm/list_lru.c
> +++ b/mm/list_lru.c
> @@ -671,7 +671,12 @@ int __list_lru_init(struct list_lru *lru, bool memcg_aware, struct shrinker *shr
> else
> lru->shrinker_id = -1;
>
> - if (mem_cgroup_kmem_disabled())
> + /*
> + * With the memory controller disabled entirely, no object is ever
> + * charged to a memcg, so collapse to plain per-node lists just
> + * like under nokmem.
> + */
These comments seem useless, as the code already explains itself.
> + if (mem_cgroup_disabled() || mem_cgroup_kmem_disabled())
> memcg_aware = false;
> #endif
>
Since __list_lru_init() is also exported, I think this looks reasonable
to me. With comments removed,
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] mm/list_lru: disable memcg awareness under cgroup_disable=memory
2026-09-02 9:16 ` Baolin Wang
@ 2026-09-02 9:30 ` Qinyun Tan
0 siblings, 0 replies; 3+ messages in thread
From: Qinyun Tan @ 2026-09-02 9:30 UTC (permalink / raw)
To: Baolin Wang, Andrew Morton
Cc: Dave Chinner, Qi Zheng, Roman Gushchin, Muchun Song, Xunlei Pang,
linux-mm, linux-kernel
Hi,
On 9/2/26 5:16 PM, Baolin Wang wrote:
>
>
> On 9/2/26 11:28 AM, Qinyun Tan wrote:
>> __list_lru_init() only collapses a memcg-aware list_lru into plain
>> per-node lists when kmem accounting is disabled
>> (cgroup.memory=nokmem). When the memory controller is disabled
>> entirely (cgroup_disable=memory), mem_cgroup_kmem_disabled() is
>> false, so the lru stays memcg aware even though no object will ever
>> be charged to a memcg.
>>
>> This is more than a semantic inconsistency.
>> folio_memcg_list_lru_alloc() trusts list_lru_memcg_aware() and
>> dereferences the folio's memcg, which is always NULL with the
>> controller disabled. The only mainline caller,
>> folio_memcg_alloc_deferred(), papers over this with an explicit
>> mem_cgroup_disabled() check. The shmem unused-huge shrinker
>> conversion ("mm: shmem: make unused huge shrinker memcg aware") adds
>> a second caller without such a guard, so booting with
>> cgroup_disable=memory and writing to a huge=always tmpfs oopses:
>>
>> BUG: unable to handle page fault for address: 0000000000000488
>> RIP: 0010:folio_memcg_list_lru_alloc+0x41/0xf0
>> Call Trace:
>> <TASK>
>> shmem_get_folio_gfp+0x1cd/0x7c0
>> shmem_write_begin+0x5d/0x100
>> generic_perform_write+0x89/0x2a0
>> shmem_file_write_iter+0x82/0x90
>> vfs_write+0x256/0x410
>> ksys_write+0x61/0xe0
>> do_syscall_64+0x8d/0x460
>> entry_SYSCALL_64_after_hwframe+0x76/0x7e
>>
>> The faulting address is the offset of mem_cgroup->kmemcg_id,
>> dereferenced on a NULL memcg in memcg_list_lru_allocated():
>>
>> folio_memcg_list_lru_alloc()
>> list_lru_memcg_aware() <- true, only nokmem checked
>> memcg = folio_memcg(folio) <- NULL
>> memcg_list_lru_allocated(memcg, lru)
>> memcg->kmemcg_id <- NULL pointer dereference
>>
>> Check mem_cgroup_disabled() in __list_lru_init() so that all
>> list_lrus fall back to plain per-node lists when the controller is
>> disabled, matching what the shrinker side already does
>> (shrinker_memcg_alloc() bails out on mem_cgroup_disabled()). This
>> makes the mem_cgroup_disabled() check in callers unnecessary rather
>> than mandatory.
>>
>> Signed-off-by: Qinyun Tan <qinyuntan@linux.alibaba.com>
>> ---
>> Applies on top of mm-new. No Fixes: tag since the commit that makes
>> the crash reachable ("mm: shmem: make unused huge shrinker memcg
>> aware") is only in mm-new; no stable backport is needed either.
>>
>> Reproducer, on mm-new booted with cgroup_disable=memory
>> (CONFIG_MEMCG=y, CONFIG_TRANSPARENT_HUGEPAGE=y):
>>
>> # mount -t tmpfs -o huge=always tmpfs /mnt
>> # echo x > /mnt/f
>>
>> Without this patch the write oopses immediately as shown above: the
>> freshly allocated huge folio extends beyond i_size, so
>> shmem_get_folio_gfp() queues the inode via shmem_unused_huge_add()
>> -> folio_memcg_list_lru_alloc(), which dereferences the NULL
>> folio_memcg().
>>
>> With this patch the same steps run cleanly: the lru falls back to
>> plain per-node lists and folio_memcg_list_lru_alloc() returns early.
>> From code inspection the rest of the shmem path handles the NULL
>> objcg fine (obj_cgroup_memcg() and obj_cgroup_put() are NULL-safe,
>> and list_lru_add() with a NULL memcg lands on the per-node list),
>> but I have not exercised the shrinker reclaim itself under
>> cgroup_disable=memory.
>>
>> Discussion: https://lore.kernel.org/linux-mm/20260901115104.2944996-1-qinyuntan@linux.alibaba.com/
>>
>> mm/list_lru.c | 7 ++++++-
>> 1 file changed, 6 insertions(+), 1 deletion(-)
>>
>> diff --git a/mm/list_lru.c b/mm/list_lru.c
>> index 36662d02ff963..f8be119351cca 100644
>> --- a/mm/list_lru.c
>> +++ b/mm/list_lru.c
>> @@ -671,7 +671,12 @@ int __list_lru_init(struct list_lru *lru, bool memcg_aware, struct shrinker *shr
>> else
>> lru->shrinker_id = -1;
>> - if (mem_cgroup_kmem_disabled())
>> + /*
>> + * With the memory controller disabled entirely, no object is ever
>> + * charged to a memcg, so collapse to plain per-node lists just
>> + * like under nokmem.
>> + */
>
> These comments seem useless, as the code already explains itself.
>
Agreed, the condition is self-explanatory. Will drop the comment.
>> + if (mem_cgroup_disabled() || mem_cgroup_kmem_disabled())
>> memcg_aware = false;
>> #endif
>>
>
> Since __list_lru_init() is also exported, I think this looks reasonable to me. With comments removed,
>
> Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Thanks for the review. I will send v2 shortly with the comment
removed and your Reviewed-by collected.
Thanks,
Qinyun Tan
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-02 9:30 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-02 3:28 [PATCH] mm/list_lru: disable memcg awareness under cgroup_disable=memory Qinyun Tan
2026-09-02 9:16 ` Baolin Wang
2026-09-02 9:30 ` Qinyun Tan
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox