[PATCH] memcg: Don't call schedule_work when no spinning is allowed

From: David Stevens

Date: Mon Aug 31 2026 - 19:44:40 EST


Memcg charging can be done from any context, but calling schedule_work()
isn't safe from an NMI. If memory.high is breached from a context where
spinning isn't allowed, use irq_work to schedule the reclaim work.

Fixes: 3ac4638a734a ("memcg: make memcg_rstat_updated nmi safe")
Signed-off-by: David Stevens <stevensd@xxxxxxxxxx>
---
include/linux/memcontrol.h | 1 +
mm/memcontrol.c | 12 +++++++++++-
2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 8170bb8066a2..036d973ceca6 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -219,6 +219,7 @@ struct mem_cgroup {
spinlock_t peaks_lock;

/* Range enforcement for interrupt charges */
+ struct irq_work high_irq_work;
struct work_struct high_work;

#ifdef CONFIG_ZSWAP
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 6dc4888a90f3..5e2f749067cb 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -2360,6 +2360,11 @@ static void high_work_func(struct work_struct *work)
reclaim_high(memcg, MEMCG_CHARGE_BATCH, GFP_KERNEL);
}

+static void high_irq_work_func(struct irq_work *work)
+{
+ schedule_work(&container_of(work, struct mem_cgroup, high_irq_work)->high_work);
+}
+
/*
* Clamp the maximum sleep time per allocation batch to 2 seconds. This is
* enough to still cause a significant slowdown in most cases, while still
@@ -2752,7 +2757,10 @@ static int try_charge_memcg(struct mem_cgroup *memcg, gfp_t gfp_mask,
/* Don't bother a random interrupted task */
if (!in_task()) {
if (mem_high) {
- schedule_work(&memcg->high_work);
+ if (allow_spinning)
+ schedule_work(&memcg->high_work);
+ else
+ irq_work_queue(&memcg->high_irq_work);
break;
}
continue;
@@ -4129,6 +4137,7 @@ static struct mem_cgroup *mem_cgroup_alloc(struct mem_cgroup *parent)
goto fail;

INIT_WORK(&memcg->high_work, high_work_func);
+ init_irq_work(&memcg->high_irq_work, high_irq_work_func);
vmpressure_init(&memcg->vmpressure);
INIT_LIST_HEAD(&memcg->memory_peaks);
INIT_LIST_HEAD(&memcg->swap_peaks);
@@ -4337,6 +4346,7 @@ static void mem_cgroup_css_free(struct cgroup_subsys_state *css)
static_branch_dec(&memcg_bpf_enabled_key);

vmpressure_cleanup(&memcg->vmpressure);
+ irq_work_sync(&memcg->high_irq_work);
cancel_work_sync(&memcg->high_work);
memcg1_remove_from_trees(memcg);
free_shrinker_info(memcg);

base-commit: 8d3ae59288f1e7d58d76558a6ee96d533bc5019f
--
2.55.0.897.gb25b4bd76c-goog