Re: [PATCH v6 9/9] mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()

[Andrew Morton]

On Mon, 20 Jul 2026 10:45:56 +0800 Ye Liu <ye.liu@xxxxxxxxx> wrote:

> > These points have too much detail that's already in the code. Would just
> > mention that we opencode applicable parts of page_memcg_check() and
> > PageMemcgKmem() using the snapshot?
> Yes,It's a bit wordy.
> > 
> >> This avoids both TOCTOU windows and the assertions entirely.
> >>
> >> Signed-off-by: Ye Liu <ye.liu@xxxxxxxxx>
> > 
> > Reviewed-by: Vlastimil Babka (SUSE) <vbabka@xxxxxxxxxx>
> > 
> > Was all of this reported by sashiko? At least the new-in-v6 was?
> > Then:
> > 
> > Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
> > 
> > But it's no longer a cleanup but a fix, so probably this?
> > 
> > Fixes: fcf8935832b8 ("mm/page_owner: print memcg information")
> > Cc: stable@xxxxxxxxxxxxxxx
> > 
> > It's not fixing a new regression so I think it's fine to keep it part of
> > this series for next release and not need to split out for mm-hotfixes.
> > 
> Hi Andrew,
> 
> Could you please help me revise the above?

Sure, how does this look?


From: Ye Liu <ye.liu@xxxxxxxxx>
Subject: mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()
Date: Tue, 14 Jul 2026 09:51:08 +0800

print_page_owner_memcg() reads page->memcg_data via READ_ONCE() at the
start to guard against tail pages and NULL data.  However, it later
re-reads page->memcg_data locklessly in two places:

1: page_memcg_check(page)

2: PageMemcgKmem(page) (via folio_memcg_kmem(), which includes
   VM_BUG_ON assertions for tail pages and MEMCG_DATA_OBJEXTS)

If the page is concurrently freed and reallocated as a THP tail page or
slab page between these calls, the VM_BUG_ON assertions can trigger on
CONFIG_DEBUG_VM=y builds, crashing the kernel.

Fix both TOCTOU issues by using the memcg_data snapshot throughout.

Link: https://lore.kernel.org/20260714015117.78351-10-ye.liu@xxxxxxxxx
Fixes: fcf8935832b8 ("mm/page_owner: print memcg information")
Signed-off-by: Ye Liu <ye.liu@xxxxxxxxx>
Reviewed-by: Zi Yan <ziy@xxxxxxxxxx>
Reviewed-by: Vlastimil Babka (SUSE) <vbabka@xxxxxxxxxx>
Cc: Brendan Jackman <jackmanb@xxxxxxxxxx>
Cc: Johannes Weiner <hannes@xxxxxxxxxxx>
Cc: Lorenzo Stoakes <ljs@xxxxxxxxxx>
Cc: Michal Hocko <mhocko@xxxxxxxx>
Cc: Suren Baghdasaryan <surenb@xxxxxxxxxx>
Cc: David Hildenbrand (Arm) <david@xxxxxxxxxx>
Cc: <stable@xxxxxxxxxxxxxxx>