From: Jens Axboe <axboe@kernel.dk>
To: stable@vger.kernel.org
Subject: [PATCH 6.6.y 5/8] io_uring: charge tctx nodes and personalities
Date: Wed, 4 Nov 2026 11:43:38 -0700 [thread overview]
Message-ID: <20261104184341.516297-6-axboe@kernel.dk> (raw)
In-Reply-To: <20261104184341.516297-1-axboe@kernel.dk>
From: Chris Mason <mason@kernel.org>
Commit 0b34e7b20a48710b6f53716bf7030920b69fdbdd upstream.
The io_tctx_node allocated the first time a task touches a ring, and
the XArray nodes behind tctx->xa and ctx->personalities, are plain
GFP_KERNEL. tctx->xa is indexed by the ring pointer, so nearly every
entry needs nodes of its own, and a task gets one entry per ring it has
used. 642 threads on 4000 rings held 2.3GB with 59MB charged against a
64MB memory.max.
Allocate the node with GFP_KERNEL_ACCOUNT and set XA_FLAGS_ACCOUNT on
both XArrays.
Fixes: 0f2122045b94 ("io_uring: don't rely on weak ->files references")
Signed-off-by: Chris Mason <mason@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[axboe: 6.6 has kmalloc() for the node, inline in
__io_uring_add_tctx_node()]
---
io_uring/io_uring.c | 2 +-
io_uring/tctx.c | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index bc47a7d745b5..5836612781ff 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -319,7 +319,7 @@ static __cold struct io_ring_ctx *io_ring_ctx_alloc(struct io_uring_params *p)
io_alloc_cache_init(&ctx->netmsg_cache, IO_ALLOC_CACHE_MAX,
sizeof(struct io_async_msghdr));
init_completion(&ctx->ref_comp);
- xa_init_flags(&ctx->personalities, XA_FLAGS_ALLOC1);
+ xa_init_flags(&ctx->personalities, XA_FLAGS_ALLOC1 | XA_FLAGS_ACCOUNT);
mutex_init(&ctx->uring_lock);
init_waitqueue_head(&ctx->cq_wait);
init_waitqueue_head(&ctx->poll_wq);
diff --git a/io_uring/tctx.c b/io_uring/tctx.c
index 8597bcb903b2..d056cce2c1a8 100644
--- a/io_uring/tctx.c
+++ b/io_uring/tctx.c
@@ -93,7 +93,7 @@ __cold int io_uring_alloc_task_context(struct task_struct *task,
return ret;
}
- xa_init(&tctx->xa);
+ xa_init_flags(&tctx->xa, XA_FLAGS_ACCOUNT);
init_waitqueue_head(&tctx->wait);
atomic_set(&tctx->in_cancel, 0);
atomic_set(&tctx->inflight_tracked, 0);
@@ -125,7 +125,7 @@ int __io_uring_add_tctx_node(struct io_ring_ctx *ctx)
}
}
if (!xa_load(&tctx->xa, (unsigned long)ctx)) {
- node = kmalloc(sizeof(*node), GFP_KERNEL);
+ node = kmalloc(sizeof(*node), GFP_KERNEL_ACCOUNT);
if (!node)
return -ENOMEM;
node->ctx = ctx;
--
2.56.0
next prev parent reply other threads:[~2026-11-04 18:43 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-04 18:43 [PATCH 6.6.y 0/8] io_uring fixes for 6.6-stable Jens Axboe
2026-11-04 18:43 ` [PATCH 6.6.y 1/8] io_uring/net: keep recvmsg buffer select length within MAX_RW_COUNT Jens Axboe
2026-11-04 18:43 ` [PATCH 6.6.y 2/8] io_uring/net: don't retry a non-blocking connect() that fails with -EAGAIN Jens Axboe
2026-11-04 18:43 ` [PATCH 6.6.y 3/8] io_uring/io-wq: no new workers once the exit has begun Jens Axboe
2026-11-04 18:43 ` [PATCH 6.6.y 4/8] io_uring/rsrc: charge buffer arrays and nodes to memcg Jens Axboe
2026-11-04 18:43 ` Jens Axboe [this message]
2026-11-04 18:43 ` [PATCH 6.6.y 6/8] io_uring: free XArray nodes left by a failed store Jens Axboe
2026-11-04 18:43 ` [PATCH 6.6.y 7/8] io_uring/sqpoll: don't wait for the thread to exit Jens Axboe
2026-11-04 18:43 ` [PATCH 6.6.y 8/8] io_uring/timeout: count cancelled timeouts in cq_timeouts Jens Axboe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261104184341.516297-6-axboe@kernel.dk \
--to=axboe@kernel.dk \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox