+ memcg-flush-nr_charged_bytes-when-the-obj-stock-trylock-fails.patch added to mm-hotfixes-unstable branch

+ memcg-flush-nr_charged_bytes-when-the-obj-stock-trylock-fails.patch added to mm-hotfixes-unstable branch

[Andrew Morton]

The patch titled
     Subject: memcg: flush nr_charged_bytes when the obj stock trylock fails
has been added to the -mm mm-hotfixes-unstable branch.  Its filename is
     memcg-flush-nr_charged_bytes-when-the-obj-stock-trylock-fails.patch

This patch will shortly appear at
     https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/memcg-flush-nr_charged_bytes-when-the-obj-stock-trylock-fails.patch

This patch will later appear in the mm-hotfixes-unstable branch at
    git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days

------------------------------------------------------
From: Shakeel Butt <shakeel.butt@linux.dev>
Subject: memcg: flush nr_charged_bytes when the obj stock trylock fails
Date: Wed, 11 Nov 2026 17:32:20 -0800

When interrupt code, such as an RCU callback in softirq, runs on top of a
task that holds the obj stock lock, its trylock fails and the bytes go to
objcg->nr_charged_bytes.  Nothing empties that counter while every CPU
using the objcg keeps it in its stock, so it can grow without limit.

Users see memory.current and the "kernel" field of memory.stat keep
growing while the cgroup's real usage does not.  With memory.high or
memory.max set, the cgroup is reclaimed, throttled or even OOM-killed for
memory it does not use.  The counter is 32-bit, so after 4 GiB it wraps,
and those 4 GiB stay charged to the cgroup and its ancestors until reboot,
even after the cgroup is removed.

Fix it by uncharging the whole pages in nr_charged_bytes whenever the
trylock fails.

Link: https://lore.kernel.org/20261112013220.4064478-1-shakeel.butt@linux.dev
Fixes: 200577f69f29 ("memcg: objcg stock trylock without irq disabling")
Signed-off-by: Shakeel Butt <shakeel.butt@linux.dev>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Chris Mason <mason@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: <stable@vger.kernel.org>
---

 mm/memcontrol.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/mm/memcontrol.c~memcg-flush-nr_charged_bytes-when-the-obj-stock-trylock-fails
+++ a/mm/memcontrol.c
@@ -3532,6 +3532,8 @@ static void __refill_obj_stock(struct ob
 	int i, slot = -1, empty_slot = -1;
 
 	if (!stock) {
+		nr_bytes += atomic_read(&objcg->nr_charged_bytes)
+			? atomic_xchg(&objcg->nr_charged_bytes, 0) : 0;
 		nr_pages = nr_bytes >> PAGE_SHIFT;
 		nr_bytes = nr_bytes & (PAGE_SIZE - 1);
 		atomic_add(nr_bytes, &objcg->nr_charged_bytes);
_

Patches currently in -mm which might be from shakeel.butt@linux.dev are

mm-mglru-splice-all-generations-when-reparenting-a-memcg.patch
memcg-flush-nr_charged_bytes-when-the-obj-stock-trylock-fails.patch
memcg-move-memoryhigh-enforcement-out-of-try_charge_memcg.patch
memcg-force-charges-from-reclaim-before-trying-the-limits.patch
memcg-use-high_work-for-kernel-threads.patch
memcg-use-high_work-for-remote-charges.patch
memcg-simplify-high-limit-handling-after-a-charge.patch