Re: [PATCH v5 9/9] mm/page_owner: use memcg_data snapshot instead of PageMemcgKmem() to avoid TOCTOU VM_BUG_ON

[Vlastimil Babka (SUSE)]

On 7/1/26 08:10, Ye Liu wrote:
> print_page_owner_memcg() takes a snapshot of page->memcg_data via
> READ_ONCE at the top of the function and guards against tail pages
> and NULL memcg_data.  However, at the end it calls PageMemcgKmem(page)
> which internally calls folio_memcg_kmem() — and that function re-reads
> folio->memcg_data and page->compound_head locklessly, wrapping both
> in VM_BUG_ON assertions:
> 
>     VM_BUG_ON_PGFLAGS(PageTail(&folio->page), &folio->page);
>     VM_BUG_ON_FOLIO(folio->memcg_data & MEMCG_DATA_OBJEXTS, folio);
> 
> If the page is concurrently freed and reallocated as a THP tail page
> or a slab page between the initial guards and this final call, the
> VM_BUG_ON assertions can fire on debug builds (CONFIG_DEBUG_VM=y),
> causing a kernel panic.
> 
> Fix by reusing the memcg_data snapshot already taken at function entry
> instead of calling PageMemcgKmem(), which is semantically equivalent:
> PageMemcgKmem()->folio_memcg_kmem()->folio->memcg_data & MEMCG_DATA_KMEM.
> This avoids both the TOCTOU window and the assertions entirely.
> 
> Signed-off-by: Ye Liu <ye.liu@xxxxxxxxx>

Reviewed-by: Vlastimil Babka (SUSE) <vbabka@xxxxxxxxxx>

> ---
>  mm/page_owner.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/mm/page_owner.c b/mm/page_owner.c
> index 2e3880053a34..efbf67d54ee2 100644
> --- a/mm/page_owner.c
> +++ b/mm/page_owner.c
> @@ -561,7 +561,7 @@ static inline int print_page_owner_memcg(char *kbuf, size_t count, int ret,
>  	cgroup_name(memcg->css.cgroup, name, sizeof(name));
>  	ret += scnprintf(kbuf + ret, count - ret,
>  			"Charged %sto %smemcg %s\n",
> -			PageMemcgKmem(page) ? "(via objcg) " : "",
> +			(memcg_data & MEMCG_DATA_KMEM) ? "(via objcg) " : "",
>  			online ? "" : "offline ",
>  			name);
>  out_unlock: