Re: [PATCH v6 9/9] mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()

[Ye Liu]

在 2026/7/20 13:42, Andrew Morton 写道:
> On Mon, 20 Jul 2026 10:45:56 +0800 Ye Liu <ye.liu@xxxxxxxxx> wrote:
> 
>>> These points have too much detail that's already in the code. Would just
>>> mention that we opencode applicable parts of page_memcg_check() and
>>> PageMemcgKmem() using the snapshot?
>> Yes,It's a bit wordy.
>>>
>>>> This avoids both TOCTOU windows and the assertions entirely.
>>>>
>>>> Signed-off-by: Ye Liu <ye.liu@xxxxxxxxx>
>>>
>>> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@xxxxxxxxxx>
>>>
>>> Was all of this reported by sashiko? At least the new-in-v6 was?
>>> Then:
>>>
>>> Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
>>>
>>> But it's no longer a cleanup but a fix, so probably this?
>>>
>>> Fixes: fcf8935832b8 ("mm/page_owner: print memcg information")
>>> Cc: stable@xxxxxxxxxxxxxxx
>>>
>>> It's not fixing a new regression so I think it's fine to keep it part of
>>> this series for next release and not need to split out for mm-hotfixes.
>>>
>> Hi Andrew,
>>
>> Could you please help me revise the above?
> 
> Sure, how does this look?
> 
Looks great, thank you!
> 
> From: Ye Liu <ye.liu@xxxxxxxxx>
> Subject: mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()
> Date: Tue, 14 Jul 2026 09:51:08 +0800
> 
> print_page_owner_memcg() reads page->memcg_data via READ_ONCE() at the
> start to guard against tail pages and NULL data.  However, it later
> re-reads page->memcg_data locklessly in two places:
> 
> 1: page_memcg_check(page)
> 
> 2: PageMemcgKmem(page) (via folio_memcg_kmem(), which includes
>    VM_BUG_ON assertions for tail pages and MEMCG_DATA_OBJEXTS)
> 
> If the page is concurrently freed and reallocated as a THP tail page or
> slab page between these calls, the VM_BUG_ON assertions can trigger on
> CONFIG_DEBUG_VM=y builds, crashing the kernel.
> 
> Fix both TOCTOU issues by using the memcg_data snapshot throughout.
> 
> Link: https://lore.kernel.org/20260714015117.78351-10-ye.liu@xxxxxxxxx
> Fixes: fcf8935832b8 ("mm/page_owner: print memcg information")
> Signed-off-by: Ye Liu <ye.liu@xxxxxxxxx>
> Reviewed-by: Zi Yan <ziy@xxxxxxxxxx>
> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@xxxxxxxxxx>
> Cc: Brendan Jackman <jackmanb@xxxxxxxxxx>
> Cc: Johannes Weiner <hannes@xxxxxxxxxxx>
> Cc: Lorenzo Stoakes <ljs@xxxxxxxxxx>
> Cc: Michal Hocko <mhocko@xxxxxxxx>
> Cc: Suren Baghdasaryan <surenb@xxxxxxxxxx>
> Cc: David Hildenbrand (Arm) <david@xxxxxxxxxx>
> Cc: <stable@xxxxxxxxxxxxxxx>

-- 
Thanks,
Ye Liu