[BUG] refill_stock -- VM_WARN_ON_ONCE(mem_cgroup_is_root()) from a write to the cgroup-v2 root's memory.reclaim

[BUG] refill_stock -- VM_WARN_ON_ONCE(mem_cgroup_is_root()) from a write to the cgroup-v2 root's memory.reclaim

[Farhad Alemi]

Hello,

As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/145-memcg-vm_warn-refill_stock-root-cgroup/

  mem_cgroup_is_root(memcg)
  WARNING: mm/memcontrol.c:2198 at refill_stock+0x644/0x940, CPU#1: repro/9490
  Call Trace:
   refill_stock+0x644/0x940
   try_charge_memcg+0x12d6/0x1570
   __obj_cgroup_charge+0x35/0xf0
   obj_cgroup_charge+0x1de/0x210
   obj_cgroup_charge_zswap+0x83/0x270
   zswap_store+0x1620/0x2000
   swap_writeout+0x94c/0x14c0
   shrink_folio_list+0x3388/0x52b0
   evict_folios+0x374d/0x48c0
   try_to_shrink_lruvec+0xe72/0x1350
   shrink_node+0x3320/0x3b90
   do_try_to_free_pages+0x6a2/0x1990
   try_to_free_mem_cgroup_pages+0x30d/0x830
   user_proactive_reclaim+0x504/0x840
   memory_reclaim+0x1f/0x30
   cgroup_file_write+0x331/0x8f0
   kernfs_fop_write_iter+0x3af/0x540

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,

Re: [BUG] refill_stock -- VM_WARN_ON_ONCE(mem_cgroup_is_root()) from a write to the cgroup-v2 root's memory.reclaim

[Shakeel Butt]

On Thu, Aug 27, 2026 at 10:28:57PM -0700, Farhad Alemi wrote:
> Hello,
> 
> As part of the kernel research at ASU's SEFCOM
> lab, we hit the crash below. Crash reports can be found here:
> 
>   https://github.com/farhad-alemi/public_bug_reports/tree/main/145-memcg-vm_warn-refill_stock-root-cgroup/
> 
>   mem_cgroup_is_root(memcg)
>   WARNING: mm/memcontrol.c:2198 at refill_stock+0x644/0x940, CPU#1: repro/9490
>   Call Trace:
>    refill_stock+0x644/0x940
>    try_charge_memcg+0x12d6/0x1570
>    __obj_cgroup_charge+0x35/0xf0
>    obj_cgroup_charge+0x1de/0x210
>    obj_cgroup_charge_zswap+0x83/0x270
>    zswap_store+0x1620/0x2000
>    swap_writeout+0x94c/0x14c0
>    shrink_folio_list+0x3388/0x52b0
>    evict_folios+0x374d/0x48c0
>    try_to_shrink_lruvec+0xe72/0x1350
>    shrink_node+0x3320/0x3b90
>    do_try_to_free_pages+0x6a2/0x1990
>    try_to_free_mem_cgroup_pages+0x30d/0x830
>    user_proactive_reclaim+0x504/0x840
>    memory_reclaim+0x1f/0x30
>    cgroup_file_write+0x331/0x8f0
>    kernfs_fop_write_iter+0x3af/0x540
> 
> Our reproducer.c is available upon request.
> 
> Happy to test a patch if that would help.

Thanks for the report. Please test the following patch. I will send formal patch
after your testing.


diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 4a18ee4509ab..1709ac96bbde 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3157,7 +3157,7 @@ static int obj_cgroup_charge_pages(struct obj_cgroup *objcg, gfp_t gfp,
 
 	memcg = get_mem_cgroup_from_objcg(objcg);
 
-	ret = try_charge_memcg(memcg, gfp, nr_pages);
+	ret = try_charge(memcg, gfp, nr_pages);
 	if (ret)
 		goto out;