Re: [PATCH v5 4/6] mm/zswap: Implement proactive writeback

[Yosry Ahmed]

> > If you're looking for another cleanup to do, shrink_worker() should
> > probably also use mem_cgroup_online() and avoid taking/dropping an
> > extra ref :)
>
> IIRC, this might not work because zswap_next_shrink is a global variable
> and is accessed outside the lock during reclamation.
>
> Consider the following race condition between shrink_worker on CPU0 and
> zswap_memcg_offline_cleanup on CPU1:
>
>
>            CPU0                            CPU1
> spin_lock(zswap_shrink_lock)
> memcg1 = mem_cgroup_iter()
>    memcg1.ref = 1
>    zswap_next_shrink = memcg1
> spin_unlock(zswap_shrink_lock)
>                                zswap_memcg_offline_cleanup()
>                                spin_lock(zswap_shrink_lock)
>                                css_put(zswap_next_shrink)
>                                memcg1.ref = 0  <--
>
> shrink_memcg(memcg1) *maybe UAF*

You're right, thanks for double-checking. I lost track of why the
extra ref was needed.