Re: [PATCH] mm: mglru: fix stale batch updates after memcg reparenting

[Qi Zheng]

Hi Barry,

On 6/23/26 6:52 AM, Barry Song wrote:
> On Mon, Jun 22, 2026 at 3:38 PM Qi Zheng <qi.zheng@xxxxxxxxx> wrote:
> > From: Qi Zheng <zhengqi.arch@xxxxxxxxxxxxx>
> >
> > The mglru page table walker batches per-generation size deltas in
> > walk->nr_pages while walking page tables without holding the lruvec lock.
> > The reset_batch_size() later folds those deltas into walk->lruvec under
> > the lruvec lock.
> >
> > The page table walker can run concurrently with the memcg reparenting path
> > as follows:
> >
> > CPU0                           CPU1
> > ====                           ====
> >
> > walk_mm
> > --> walk_page_range
> >      --> update_batch_size
> >          --> walk->nr_pages += delta
> >
> >                                mem_cgroup_css_offline
> >                                --> memcg_reparent_objcgs
> >                                    --> lock lruvec
> >                                        lru_gen_reparent_memcg
> >                                        --> reparent child folios to parent
> >                                        unlock lruvec
> >
> >      lock lruvec
> >      reset_batch_size
> >      --> child lrugen->nr_pages += delta
> >
> > This can trigger the following warning:
> >
> > WARNING: mm/vmscan.c:5867 at lru_gen_exit_memcg+0x26f/0x300
> > RIP: 0010:lru_gen_exit_memcg+0x26f/0x300 mm/vmscan.c:5867
>
> I can't find 5867; instead, I can find 5828:
>
> VM_WARN_ON_ONCE(memchr_inv(lruvec->lrugen.nr_pages, 0,
>    sizeof(lruvec->lrugen.nr_pages)));
>
> Is this the warning?

Yes, I just copy-pasted the warning log from Peiyang's report.

Maybe the description should be changed to:

This will trigger the following warning in lru_gen_exit_memcg():

	VM_WARN_ON_ONCE(memchr_inv(lruvec->lrugen.nr_pages, 0,
					   sizeof(lruvec->lrugen.nr_pages)));

> > Call Trace:
> >    <TASK>
> >    mem_cgroup_free mm/memcontrol.c:3972 [inline]
> >    mem_cgroup_css_free+0x76/0xb0 mm/memcontrol.c:4241
> >    css_free_rwork_fn+0x125/0x1260 kernel/cgroup/cgroup.c:5575
> >    process_one_work+0xa0d/0x1c30 kernel/workqueue.c:3314
> >    process_scheduled_works kernel/workqueue.c:3397 [inline]
> >    worker_thread+0x645/0xe80 kernel/workqueue.c:3478
> >    kthread+0x367/0x480 kernel/kthread.c:436
> >    ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
> >    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
> >    </TASK>
> >
> > To fix it, add lrugen->reparented to remember the new owner of a
> > reparented lruvec, and make reset_batch_size() charge pending deltas to
> > that owner.
> >
> > Reported-by: Peiyang He <peiyang_he@xxxxxxxxxxxxxxxx>
> > Closes: https://lore.kernel.org/all/5A9E929D82717101+12fcf643-efb8-4b9a-a53a-1e28cc894f0b@xxxxxxxxxxxxxxxx
> > Fixes: f304652609ea ("mm: vmscan: prepare for reparenting MGLRU folios")
> > Cc: <stable@xxxxxxxxxxxxxxx>
> > Signed-off-by: Qi Zheng <zhengqi.arch@xxxxxxxxxxxxx>
>
> Looks reasonable to me.
> Reviewed-by: Barry Song <baohua@xxxxxxxxxx>

Thanks!