Re: [PATCH] mm: memcontrol: fix swap counter leak from offline cgroup

[Muchun Song]

> On Mar 6, 2025, at 22:37, Johannes Weiner <hannes@xxxxxxxxxxx> wrote:
> 
> On Thu, Mar 06, 2025 at 10:54:12AM +0800, Kairui Song wrote:
>> On Thu, Mar 6, 2025 at 10:32 AM Muchun Song <songmuchun@xxxxxxxxxxxxx> wrote:
>>> 
>>> The commit 6769183166b3 has removed the parameter of id from
>>> swap_cgroup_record() and get the memcg id from
>>> mem_cgroup_id(folio_memcg(folio)). However, the caller of it
>>> may update a different memcg's counter instead of
>>> folio_memcg(folio). E.g. in the caller of mem_cgroup_swapout(),
>>> @swap_memcg could be different with @memcg and update the counter
>>> of @swap_memcg, but swap_cgroup_record() records the wrong memcg's
>>> ID. When it is uncharged from __mem_cgroup_uncharge_swap(), the
>>> swap counter will leak since the wrong recorded ID. Fix it by
>>> bring the parameter of id back.
>>> 
>>> Fixes: 6769183166b3 ("mm/swap_cgroup: decouple swap cgroup recording and clearing")
>>> Cc: <stable@xxxxxxxxxxxxxxx>
>>> Signed-off-by: Muchun Song <songmuchun@xxxxxxxxxxxxx>
> 
> Acked-by: Johannes Weiner <hannes@xxxxxxxxxxx>
> 
> Looking at the original commit again, we also should do this:
> 
> ---
> 
> From 2685ca87d73d0c2b91cfd6959e381a40db235119 Mon Sep 17 00:00:00 2001
> From: Johannes Weiner <hannes@xxxxxxxxxxx>
> Date: Thu, 6 Mar 2025 09:31:42 -0500
> Subject: [PATCH] mm: swap_cgroup: remove double initialization of locals
> 
> Fixes: 6769183166b3 ("mm/swap_cgroup: decouple swap cgroup recording and clearing")
> Signed-off-by: Johannes Weiner <hannes@xxxxxxxxxxx>

Yes.

Reviewed-by: Muchun Song <muchun.song@xxxxxxxxx>

Thanks.

> ---
> mm/swap_cgroup.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/mm/swap_cgroup.c b/mm/swap_cgroup.c
> index 1007c30f12e2..de779fed8c21 100644
> --- a/mm/swap_cgroup.c
> +++ b/mm/swap_cgroup.c
> @@ -92,8 +92,7 @@ void swap_cgroup_record(struct folio *folio, unsigned short id,
>  */
> unsigned short swap_cgroup_clear(swp_entry_t ent, unsigned int nr_ents)
> {
> - 	pgoff_t offset = swp_offset(ent);
> - 	pgoff_t end = offset + nr_ents;
> + 	pgoff_t offset, end;
> 	struct swap_cgroup *map;
> 	unsigned short old, iter = 0;
> 
> -- 
> 2.48.1