[PATCH v2] mm/memcontrol: fix stuck FLUSHING_CACHED_CHARGE bit on isolated cpus

[PATCH v2] mm/memcontrol: fix stuck FLUSHING_CACHED_CHARGE bit on isolated cpus

[Rik van Riel]

When drain_all_stock() sets FLUSHING_CACHED_CHARGE before checking
isolation, schedule_drain_work() can drop the work in a separate RCU
critical section, and housekeeping_update()'s synchronize_rcu() can race
that second check, leaving the flag set.

drain_local_stock() only clears the bit for work that ran, so the flag
remains set and the stock is never drained again.

Have schedule_drain_work() return whether the work was queued, and clear
FLUSHING_CACHED_CHARGE in drain_all_stock() when the remote CPU is
isolated, so future drains can retry.

Fixes: 6a792697a53a ("memcg: do not drain charge pcp caches on remote isolated cpus")
Cc: stable@vger.kernel.org
Suggested-by: Michal Hocko <mhocko@suse.com>
Suggested-by: Shakeel Butt <shakeel.butt@linux.dev>
Signed-off-by: Rik van Riel <riel@surriel.com>
---
v2: use the approach suggested by Michal and Shakeel

Link: https://lore.kernel.org/all/cover.1787890328.git.riel@surriel.com/

 mm/memcontrol.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 1271d390b617..309398e943ca 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -2306,7 +2306,7 @@ static bool is_memcg_drain_needed(struct memcg_stock_pcp *stock,
 	return flush;
 }
 
-static void schedule_drain_work(int cpu, struct work_struct *work)
+static bool schedule_drain_work(int cpu, struct work_struct *work)
 {
 	/*
 	 * Protect housekeeping cpumask read and work enqueue together
@@ -2315,8 +2315,11 @@ static void schedule_drain_work(int cpu, struct work_struct *work)
 	 * pending work on newly isolated CPUs.
 	 */
 	guard(rcu)();
-	if (!cpu_is_isolated(cpu))
-		queue_work_on(cpu, memcg_wq, work);
+	if (cpu_is_isolated(cpu))
+		return false;
+
+	queue_work_on(cpu, memcg_wq, work);
+	return true;
 }
 
 /*
@@ -2348,8 +2351,9 @@ void drain_all_stock(struct mem_cgroup *root_memcg)
 				      &memcg_st->flags)) {
 			if (cpu == curcpu)
 				drain_local_memcg_stock(&memcg_st->work);
-			else
-				schedule_drain_work(cpu, &memcg_st->work);
+			else if (!schedule_drain_work(cpu, &memcg_st->work))
+				clear_bit(FLUSHING_CACHED_CHARGE,
+					  &memcg_st->flags);
 		}
 
 		if (!test_bit(FLUSHING_CACHED_CHARGE, &obj_st->flags) &&
@@ -2358,8 +2362,9 @@ void drain_all_stock(struct mem_cgroup *root_memcg)
 				      &obj_st->flags)) {
 			if (cpu == curcpu)
 				drain_local_obj_stock(&obj_st->work);
-			else
-				schedule_drain_work(cpu, &obj_st->work);
+			else if (!schedule_drain_work(cpu, &obj_st->work))
+				clear_bit(FLUSHING_CACHED_CHARGE,
+					  &obj_st->flags);
 		}
 	}
 	migrate_enable();
-- 
2.55.0

Re: [PATCH v2] mm/memcontrol: fix stuck FLUSHING_CACHED_CHARGE bit on isolated cpus

[Shakeel Butt]

On Fri, Aug 28, 2026 at 01:50:36PM -0400, Rik van Riel wrote:
> When drain_all_stock() sets FLUSHING_CACHED_CHARGE before checking
> isolation, schedule_drain_work() can drop the work in a separate RCU
> critical section, and housekeeping_update()'s synchronize_rcu() can race
> that second check, leaving the flag set.
> 
> drain_local_stock() only clears the bit for work that ran, so the flag
> remains set and the stock is never drained again.
> 
> Have schedule_drain_work() return whether the work was queued, and clear
> FLUSHING_CACHED_CHARGE in drain_all_stock() when the remote CPU is
> isolated, so future drains can retry.
> 
> Fixes: 6a792697a53a ("memcg: do not drain charge pcp caches on remote isolated cpus")
> Cc: stable@vger.kernel.org
> Suggested-by: Michal Hocko <mhocko@suse.com>
> Suggested-by: Shakeel Butt <shakeel.butt@linux.dev>
> Signed-off-by: Rik van Riel <riel@surriel.com>

Acked-by: Shakeel Butt <shakeel.butt@linux.dev>

Re: [PATCH v2] mm/memcontrol: fix stuck FLUSHING_CACHED_CHARGE bit on isolated cpus

[Andrew Morton]

On Fri, 28 Aug 2026 13:50:36 -0400 Rik van Riel <riel@surriel.com> wrote:

> When drain_all_stock() sets FLUSHING_CACHED_CHARGE before checking
> isolation, schedule_drain_work() can drop the work in a separate RCU
> critical section, and housekeeping_update()'s synchronize_rcu() can race
> that second check, leaving the flag set.
> 
> drain_local_stock() only clears the bit for work that ran, so the flag
> remains set and the stock is never drained again.
> 
> Have schedule_drain_work() return whether the work was queued, and clear
> FLUSHING_CACHED_CHARGE in drain_all_stock() when the remote CPU is
> isolated, so future drains can retry.

Is there some Reported-by: or reproducer for this?

Given the complexity of the reproducers which Gemini developed for me, I'm
suspecting "nope".

> Fixes: 6a792697a53a ("memcg: do not drain charge pcp caches on remote isolated cpus")
> Cc: stable@vger.kernel.org

Why is a backport being proposed?  How does that benefit those we
serve?

Sashiko suggests that we ain't done yet:
	https://sashiko.dev/#/patchset/20260828135036.7d44361f@fangorn

Re: [PATCH v2] mm/memcontrol: fix stuck FLUSHING_CACHED_CHARGE bit on isolated cpus

[Shakeel Butt]

On Fri, Aug 28, 2026 at 12:20:18PM -0700, Andrew Morton wrote:
> On Fri, 28 Aug 2026 13:50:36 -0400 Rik van Riel <riel@surriel.com> wrote:
> 
> > When drain_all_stock() sets FLUSHING_CACHED_CHARGE before checking
> > isolation, schedule_drain_work() can drop the work in a separate RCU
> > critical section, and housekeeping_update()'s synchronize_rcu() can race
> > that second check, leaving the flag set.
> > 
> > drain_local_stock() only clears the bit for work that ran, so the flag
> > remains set and the stock is never drained again.
> > 
> > Have schedule_drain_work() return whether the work was queued, and clear
> > FLUSHING_CACHED_CHARGE in drain_all_stock() when the remote CPU is
> > isolated, so future drains can retry.
> 
> Is there some Reported-by: or reproducer for this?
> 
> Given the complexity of the reproducers which Gemini developed for me, I'm
> suspecting "nope".
> 
> > Fixes: 6a792697a53a ("memcg: do not drain charge pcp caches on remote isolated cpus")
> > Cc: stable@vger.kernel.org
> 
> Why is a backport being proposed?  How does that benefit those we
> serve?
> 
> Sashiko suggests that we ain't done yet:
> 	https://sashiko.dev/#/patchset/20260828135036.7d44361f@fangorn

Haha we are never done. Just sent the fix for this new report:

http://lore.kernel.org/20260828192419.3057939-1-shakeel.butt@linux.dev

Re: [PATCH v2] mm/memcontrol: fix stuck FLUSHING_CACHED_CHARGE bit on isolated cpus

[Andrew Morton]

On Fri, 28 Aug 2026 12:26:15 -0700 Shakeel Butt <shakeel.butt@linux.dev> wrote:

> On Fri, Aug 28, 2026 at 12:20:18PM -0700, Andrew Morton wrote:
> > On Fri, 28 Aug 2026 13:50:36 -0400 Rik van Riel <riel@surriel.com> wrote:
> > 
> > > When drain_all_stock() sets FLUSHING_CACHED_CHARGE before checking
> > > isolation, schedule_drain_work() can drop the work in a separate RCU
> > > critical section, and housekeeping_update()'s synchronize_rcu() can race
> > > that second check, leaving the flag set.
> > > 
> > > drain_local_stock() only clears the bit for work that ran, so the flag
> > > remains set and the stock is never drained again.
> > > 
> > > Have schedule_drain_work() return whether the work was queued, and clear
> > > FLUSHING_CACHED_CHARGE in drain_all_stock() when the remote CPU is
> > > isolated, so future drains can retry.
> > 
> > Is there some Reported-by: or reproducer for this?
> > 
> > Given the complexity of the reproducers which Gemini developed for me, I'm
> > suspecting "nope".
> > 
> > > Fixes: 6a792697a53a ("memcg: do not drain charge pcp caches on remote isolated cpus")
> > > Cc: stable@vger.kernel.org
> > 
> > Why is a backport being proposed?  How does that benefit those we
> > serve?
> > 
> > Sashiko suggests that we ain't done yet:
> > 	https://sashiko.dev/#/patchset/20260828135036.7d44361f@fangorn
> 
> Haha we are never done. Just sent the fix for this new report:
> 
> http://lore.kernel.org/20260828192419.3057939-1-shakeel.butt@linux.dev

Cool.

And... guess what?
	https://sashiko.dev/#/patchset/20260828192419.3057939-1-shakeel.butt@linux.dev

Re: [PATCH v2] mm/memcontrol: fix stuck FLUSHING_CACHED_CHARGE bit on isolated cpus

[Rik van Riel]

On Fri, 2026-08-28 at 12:55 -0700, Andrew Morton wrote:
> 
> Cool.
> 
> And... guess what?
> 	
> https://sashiko.dev/#/patchset/20260828192419.3057939-1-shakeel.butt@
> linux.dev

That one should be fixed by this patch you merged earlier:

mm-memcontrol-fix-stuck-flushing_cached_charge-bit-on-isolated-
cpus.patch

-- 
All Rights Reversed.