From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-180.mta0.migadu.com (out-180.mta0.migadu.com [91.218.175.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 59EF53A9DBA for ; Wed, 5 Aug 2026 19:07:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.180 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785956846; cv=none; b=b4OVaKvOaKGf5g6lvsIkPLP88f0dZs3Jucq1jrW7HGY2qj9x8+JKYxaCXbMwXfOvFJkuthruMgAXou4zszvHw11rSJBc8MbCSe+tyCCYR/qjOUiXCgndGp+yRsiVs0jjzfKNoy7+NZhlxBA7MT+KRMwXh6pv2l/Vknh+A7anOaA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785956846; c=relaxed/simple; bh=7nyIhxGxbFU4lBeSeeeyv5x2vqV/gGGCBAV7FN/q55o=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=ezwIBqSIBZVqtNNCTzYppWkuXxTc7Taa5ATfyqWK/RfOMlmjj9DqxwnCqXCp+UQY8w5cW6bQ5efUcK3mcgIf9M0GgtzvCAZ3tYswpCB9wYM7g4a1aHB1LCx3b3T3ucwmQHJk8WOpHbFAnuXoha93Fr/DrrksNmL7V+Qb2ID5AV4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=M60DEs3g; arc=none smtp.client-ip=91.218.175.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="M60DEs3g" Date: Wed, 5 Aug 2026 12:07:01 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1785956831; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=Bf4C1433YPmcAdrQ6UIsaaRwbBD1WIAriLgZrgKPaRQ=; b=M60DEs3goINApcTnMMkH7P4umo5bL3SnRkEtbYYGALGh+oH0lBupYZjDycgk/IagkfGepL ftVvRczp/9J8MF3oM8m9/oa3oKoX0fEXA0ad0EZq1tin8wO43dhv8WWnvZxLvPDKrxDYmL TgKPs2JsYyQEOnIavmRToQ9s14v9tjg= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Shakeel Butt To: Karl Erik Hofseth Cc: linux-mm@kvack.org, akpm@linux-foundation.org, qi.zheng@linux.dev, kasong@tencent.com, baohua@kernel.org, axelrasmussen@google.com, yuanchu@google.com, weixugc@google.com, hannes@cmpxchg.org, mhocko@kernel.org, roman.gushchin@linux.dev, muchun.song@linux.dev, david@kernel.org, ljs@kernel.org, cgroups@vger.kernel.org, regressions@lists.linux.dev, linux-kernel@vger.kernel.org Subject: Re: [REGRESSION] mm/memcg: folio/lruvec mismatch after cgroup offline: lru_size underflow and list_del corruption (7.1) Message-ID: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Migadu-Flow: FLOW_OUT On Wed, Aug 05, 2026 at 02:03:03PM +0200, Karl Erik Hofseth wrote: > Hi, > > The following KASAN slab-use-after-free comes from a Fedora debug kernel > build of 7.1.6 with de4660898b7a applied on top, provoked with the > attached script. Further down are OOPSes generated by workloads in > production on stock Fedora kernels. MGLRU on/off makes no difference. Hi Karl, Thanks a lot for the report and I think I understand the issue. We are not handling the case of folio migration causing folio having objcg different different from its node which breaks the assumption memcg_reparent_objcgs() have for its locking lru of child and parent per-node LRUs. Thanks for the reproducer and I was able to reproduce with inceased workers. I will send out the fixes soon. thanks, Shakeel