Re: [syzbot] [mm?] WARNING: bad unlock balance in do_wp_page

Andrew Morton
2026-04-27T10:43:58Z

On Mon, 27 Apr 2026 15:24:10 +0800 Qi Zheng <qi.zheng@linux.dev> wrote:

>
> --- a/mm/memcontrol.c
> +++ b/mm/memcontrol.c
> @@ -805,10 +805,15 @@ static long memcg_state_val_in_pages(int idx, long
> val)
> * Used in mod_memcg_state() and mod_memcg_lruvec_state() to avoid
> race with
> * reparenting of non-hierarchical state_locals.
> */
> -static inline struct mem_cgroup *get_non_dying_memcg_start(struct
> mem_cgroup *memcg)
> +static inline struct mem_cgroup *get_non_dying_memcg_start(struct
> mem_cgroup *memcg,
> + bool *locked)

Sometimes this is called "locked", sometimes "rcu_locked". Let's be
consistent please.

> {
> - if (cgroup_subsys_on_dfl(memory_cgrp_subsys))
> + if (cgroup_subsys_on_dfl(memory_cgrp_subsys)) {
> + *locked = false;
> return memcg;
> + }

I was thinking we could use a single bit in the task_struct for this:

--- a/mm/memcontrol.c~a
+++ a/mm/memcontrol.c
@@ -810,6 +810,8 @@ static inline struct mem_cgroup *get_non
if (cgroup_subsys_on_dfl(memory_cgrp_subsys))
return memcg;

+ current->foo = 1;
+
rcu_read_lock();

while (memcg_is_dying(memcg))
@@ -820,9 +822,11 @@ static inline struct mem_cgroup *get_non

static inline void get_non_dying_memcg_end(void)
{
- if (cgroup_subsys_on_dfl(memory_cgrp_subsys))
+ if (current->foo == 0)
return;

+ current->foo = 0;
+
rcu_read_unlock();
}
#else
_

That doesn't work if get_non_dying_memcg_start/get_non_dying_memcg_end
calls can nest? If they can nest then we'd need a counter in the
task_struct.