Re: [syzbot] [mm?] WARNING: bad unlock balance in do_wp_page

[Qi Zheng]

On 4/27/26 6:43 PM, Andrew Morton wrote:
> On Mon, 27 Apr 2026 15:24:10 +0800 Qi Zheng <qi.zheng@xxxxxxxxx> wrote:
>
> > --- a/mm/memcontrol.c
> > +++ b/mm/memcontrol.c
> > @@ -805,10 +805,15 @@ static long memcg_state_val_in_pages(int idx, long
> > val)
> >     * Used in mod_memcg_state() and mod_memcg_lruvec_state() to avoid
> > race with
> >     * reparenting of non-hierarchical state_locals.
> >     */
> > -static inline struct mem_cgroup *get_non_dying_memcg_start(struct
> > mem_cgroup *memcg)
> > +static inline struct mem_cgroup *get_non_dying_memcg_start(struct
> > mem_cgroup *memcg,
> > +							   bool *locked)
>
> Sometimes this is called "locked", sometimes "rcu_locked".  Let's be
> consistent please.

OK.

> >    {
> > -	if (cgroup_subsys_on_dfl(memory_cgrp_subsys))
> > +	if (cgroup_subsys_on_dfl(memory_cgrp_subsys)) {
> > +		*locked = false;
> >    		return memcg;
> > +	}
>
> I was thinking we could use a single bit in the task_struct for this:

Maybe this isn't the good idea.

It feels a bit weird to add a new member to task_struct just to fix a
minor bug in mm. :(

> --- a/mm/memcontrol.c~a
> +++ a/mm/memcontrol.c
> @@ -810,6 +810,8 @@ static inline struct mem_cgroup *get_non
>   	if (cgroup_subsys_on_dfl(memory_cgrp_subsys))
>   		return memcg;
>   
> +	current->foo = 1;
> +
>   	rcu_read_lock();
>   
>   	while (memcg_is_dying(memcg))
> @@ -820,9 +822,11 @@ static inline struct mem_cgroup *get_non
>   
>   static inline void get_non_dying_memcg_end(void)
>   {
> -	if (cgroup_subsys_on_dfl(memory_cgrp_subsys))
> +	if (current->foo == 0)
>   		return;
>   
> +	current->foo = 0;
> +
>   	rcu_read_unlock();
>   }
>   #else
> _
>
> That doesn't work if get_non_dying_memcg_start/get_non_dying_memcg_end
> calls can nest?  If they can nest then we'd need a counter in the
> task_struct.



>