Re: [syzbot] [mm?] WARNING: bad unlock balance in do_wp_page

Qi Zheng
2026-04-27T10:55:15Z

On 4/27/26 6:43 PM, Andrew Morton wrote:
> On Mon, 27 Apr 2026 15:24:10 +0800 Qi Zheng <qi.zheng@linux.dev> wrote:
>
>>
>> --- a/mm/memcontrol.c
>> +++ b/mm/memcontrol.c
>> @@ -805,10 +805,15 @@ static long memcg_state_val_in_pages(int idx, long
>> val)
>> * Used in mod_memcg_state() and mod_memcg_lruvec_state() to avoid
>> race with
>> * reparenting of non-hierarchical state_locals.
>> */
>> -static inline struct mem_cgroup *get_non_dying_memcg_start(struct
>> mem_cgroup *memcg)
>> +static inline struct mem_cgroup *get_non_dying_memcg_start(struct
>> mem_cgroup *memcg,
>> + bool *locked)
>
> Sometimes this is called "locked", sometimes "rcu_locked". Let's be
> consistent please.

OK.

>
>> {
>> - if (cgroup_subsys_on_dfl(memory_cgrp_subsys))
>> + if (cgroup_subsys_on_dfl(memory_cgrp_subsys)) {
>> + *locked = false;
>> return memcg;
>> + }
>
> I was thinking we could use a single bit in the task_struct for this:

Maybe this isn't the good idea.

It feels a bit weird to add a new member to task_struct just to fix a
minor bug in mm. :(

>
> --- a/mm/memcontrol.c~a
> +++ a/mm/memcontrol.c
> @@ -810,6 +810,8 @@ static inline struct mem_cgroup *get_non
> if (cgroup_subsys_on_dfl(memory_cgrp_subsys))
> return memcg;
>
> + current->foo = 1;
> +
> rcu_read_lock();
>
> while (memcg_is_dying(memcg))
> @@ -820,9 +822,11 @@ static inline struct mem_cgroup *get_non
>
> static inline void get_non_dying_memcg_end(void)
> {
> - if (cgroup_subsys_on_dfl(memory_cgrp_subsys))
> + if (current->foo == 0)
> return;
>
> + current->foo = 0;
> +
> rcu_read_unlock();
> }
> #else
> _
>
> That doesn't work if get_non_dying_memcg_start/get_non_dying_memcg_end
> calls can nest? If they can nest then we'd need a counter in the
> task_struct.

>