Re: [syzbot] [mm?] WARNING: bad unlock balance in do_wp_page

[Andrew Morton <akpm@linux-foundation.org>]

On Mon, 27 Apr 2026 15:24:10 +0800 Qi Zheng <qi.zheng@linux.dev> wrote:

> 
> --- a/mm/memcontrol.c
> +++ b/mm/memcontrol.c
> @@ -805,10 +805,15 @@ static long memcg_state_val_in_pages(int idx, long 
> val)
>    * Used in mod_memcg_state() and mod_memcg_lruvec_state() to avoid 
> race with
>    * reparenting of non-hierarchical state_locals.
>    */
> -static inline struct mem_cgroup *get_non_dying_memcg_start(struct 
> mem_cgroup *memcg)
> +static inline struct mem_cgroup *get_non_dying_memcg_start(struct 
> mem_cgroup *memcg,
> +							   bool *locked)

Sometimes this is called "locked", sometimes "rcu_locked".  Let's be
consistent please.

>   {
> -	if (cgroup_subsys_on_dfl(memory_cgrp_subsys))
> +	if (cgroup_subsys_on_dfl(memory_cgrp_subsys)) {
> +		*locked = false;
>   		return memcg;
> +	}

I was thinking we could use a single bit in the task_struct for this:

--- a/mm/memcontrol.c~a
+++ a/mm/memcontrol.c
@@ -810,6 +810,8 @@ static inline struct mem_cgroup *get_non
 	if (cgroup_subsys_on_dfl(memory_cgrp_subsys))
 		return memcg;
 
+	current->foo = 1;
+
 	rcu_read_lock();
 
 	while (memcg_is_dying(memcg))
@@ -820,9 +822,11 @@ static inline struct mem_cgroup *get_non
 
 static inline void get_non_dying_memcg_end(void)
 {
-	if (cgroup_subsys_on_dfl(memory_cgrp_subsys))
+	if (current->foo == 0)
 		return;
 
+	current->foo = 0;
+
 	rcu_read_unlock();
 }
 #else
_

That doesn't work if get_non_dying_memcg_start/get_non_dying_memcg_end
calls can nest?  If they can nest then we'd need a counter in the
task_struct.