Re: [PATCH] mm: mglru: fix stale batch updates after memcg reparenting

[Barry Song]

On Mon, Jun 22, 2026 at 3:38 PM Qi Zheng <qi.zheng@xxxxxxxxx> wrote:
>
> From: Qi Zheng <zhengqi.arch@xxxxxxxxxxxxx>
>
> The mglru page table walker batches per-generation size deltas in
> walk->nr_pages while walking page tables without holding the lruvec lock.
> The reset_batch_size() later folds those deltas into walk->lruvec under
> the lruvec lock.
>
> The page table walker can run concurrently with the memcg reparenting path
> as follows:
>
> CPU0                           CPU1
> ====                           ====
>
> walk_mm
> --> walk_page_range
>     --> update_batch_size
>         --> walk->nr_pages += delta
>
>                               mem_cgroup_css_offline
>                               --> memcg_reparent_objcgs
>                                   --> lock lruvec
>                                       lru_gen_reparent_memcg
>                                       --> reparent child folios to parent
>                                       unlock lruvec
>
>     lock lruvec
>     reset_batch_size
>     --> child lrugen->nr_pages += delta
>
> This can trigger the following warning:
>
> WARNING: mm/vmscan.c:5867 at lru_gen_exit_memcg+0x26f/0x300
> RIP: 0010:lru_gen_exit_memcg+0x26f/0x300 mm/vmscan.c:5867

I can't find 5867; instead, I can find 5828:

VM_WARN_ON_ONCE(memchr_inv(lruvec->lrugen.nr_pages, 0,
  sizeof(lruvec->lrugen.nr_pages)));

Is this the warning?

> Call Trace:
>   <TASK>
>   mem_cgroup_free mm/memcontrol.c:3972 [inline]
>   mem_cgroup_css_free+0x76/0xb0 mm/memcontrol.c:4241
>   css_free_rwork_fn+0x125/0x1260 kernel/cgroup/cgroup.c:5575
>   process_one_work+0xa0d/0x1c30 kernel/workqueue.c:3314
>   process_scheduled_works kernel/workqueue.c:3397 [inline]
>   worker_thread+0x645/0xe80 kernel/workqueue.c:3478
>   kthread+0x367/0x480 kernel/kthread.c:436
>   ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
>   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>   </TASK>
>
> To fix it, add lrugen->reparented to remember the new owner of a
> reparented lruvec, and make reset_batch_size() charge pending deltas to
> that owner.
>
> Reported-by: Peiyang He <peiyang_he@xxxxxxxxxxxxxxxx>
> Closes: https://lore.kernel.org/all/5A9E929D82717101+12fcf643-efb8-4b9a-a53a-1e28cc894f0b@xxxxxxxxxxxxxxxx
> Fixes: f304652609ea ("mm: vmscan: prepare for reparenting MGLRU folios")
> Cc: <stable@xxxxxxxxxxxxxxx>
> Signed-off-by: Qi Zheng <zhengqi.arch@xxxxxxxxxxxxx>

Looks reasonable to me.
Reviewed-by: Barry Song <baohua@xxxxxxxxxx>