Re: [syzbot] [mm?] WARNING: bad unlock balance in do_wp_page

[Qi Zheng <qi.zheng@linux.dev>]

On 4/27/26 6:43 PM, Andrew Morton wrote:
> On Mon, 27 Apr 2026 15:24:10 +0800 Qi Zheng <qi.zheng@linux.dev> wrote:
> 
>>
>> --- a/mm/memcontrol.c
>> +++ b/mm/memcontrol.c
>> @@ -805,10 +805,15 @@ static long memcg_state_val_in_pages(int idx, long
>> val)
>>     * Used in mod_memcg_state() and mod_memcg_lruvec_state() to avoid
>> race with
>>     * reparenting of non-hierarchical state_locals.
>>     */
>> -static inline struct mem_cgroup *get_non_dying_memcg_start(struct
>> mem_cgroup *memcg)
>> +static inline struct mem_cgroup *get_non_dying_memcg_start(struct
>> mem_cgroup *memcg,
>> +							   bool *locked)
> 
> Sometimes this is called "locked", sometimes "rcu_locked".  Let's be
> consistent please.

OK.

> 
>>    {
>> -	if (cgroup_subsys_on_dfl(memory_cgrp_subsys))
>> +	if (cgroup_subsys_on_dfl(memory_cgrp_subsys)) {
>> +		*locked = false;
>>    		return memcg;
>> +	}
> 
> I was thinking we could use a single bit in the task_struct for this:

Maybe this isn't the good idea.

It feels a bit weird to add a new member to task_struct just to fix a
minor bug in mm. :(

> 
> --- a/mm/memcontrol.c~a
> +++ a/mm/memcontrol.c
> @@ -810,6 +810,8 @@ static inline struct mem_cgroup *get_non
>   	if (cgroup_subsys_on_dfl(memory_cgrp_subsys))
>   		return memcg;
>   
> +	current->foo = 1;
> +
>   	rcu_read_lock();
>   
>   	while (memcg_is_dying(memcg))
> @@ -820,9 +822,11 @@ static inline struct mem_cgroup *get_non
>   
>   static inline void get_non_dying_memcg_end(void)
>   {
> -	if (cgroup_subsys_on_dfl(memory_cgrp_subsys))
> +	if (current->foo == 0)
>   		return;
>   
> +	current->foo = 0;
> +
>   	rcu_read_unlock();
>   }
>   #else
> _
> 
> That doesn't work if get_non_dying_memcg_start/get_non_dying_memcg_end
> calls can nest?  If they can nest then we'd need a counter in the
> task_struct.



>