Re: [PATCH] mm/list_lru: disable memcg awareness under cgroup_disable=memory

[Qinyun Tan]

Hi,

On 9/2/26 5:16 PM, Baolin Wang wrote:
> 
> 
> On 9/2/26 11:28 AM, Qinyun Tan wrote:
>> __list_lru_init() only collapses a memcg-aware list_lru into plain
>> per-node lists when kmem accounting is disabled
>> (cgroup.memory=nokmem).  When the memory controller is disabled
>> entirely (cgroup_disable=memory), mem_cgroup_kmem_disabled() is
>> false, so the lru stays memcg aware even though no object will ever
>> be charged to a memcg.
>>
>> This is more than a semantic inconsistency.
>> folio_memcg_list_lru_alloc() trusts list_lru_memcg_aware() and
>> dereferences the folio's memcg, which is always NULL with the
>> controller disabled.  The only mainline caller,
>> folio_memcg_alloc_deferred(), papers over this with an explicit
>> mem_cgroup_disabled() check.  The shmem unused-huge shrinker
>> conversion ("mm: shmem: make unused huge shrinker memcg aware") adds
>> a second caller without such a guard, so booting with
>> cgroup_disable=memory and writing to a huge=always tmpfs oopses:
>>
>>    BUG: unable to handle page fault for address: 0000000000000488
>>    RIP: 0010:folio_memcg_list_lru_alloc+0x41/0xf0
>>    Call Trace:
>>     <TASK>
>>     shmem_get_folio_gfp+0x1cd/0x7c0
>>     shmem_write_begin+0x5d/0x100
>>     generic_perform_write+0x89/0x2a0
>>     shmem_file_write_iter+0x82/0x90
>>     vfs_write+0x256/0x410
>>     ksys_write+0x61/0xe0
>>     do_syscall_64+0x8d/0x460
>>     entry_SYSCALL_64_after_hwframe+0x76/0x7e
>>
>> The faulting address is the offset of mem_cgroup->kmemcg_id,
>> dereferenced on a NULL memcg in memcg_list_lru_allocated():
>>
>>    folio_memcg_list_lru_alloc()
>>      list_lru_memcg_aware()               <- true, only nokmem checked
>>      memcg = folio_memcg(folio)           <- NULL
>>      memcg_list_lru_allocated(memcg, lru)
>>        memcg->kmemcg_id                   <- NULL pointer dereference
>>
>> Check mem_cgroup_disabled() in __list_lru_init() so that all
>> list_lrus fall back to plain per-node lists when the controller is
>> disabled, matching what the shrinker side already does
>> (shrinker_memcg_alloc() bails out on mem_cgroup_disabled()).  This
>> makes the mem_cgroup_disabled() check in callers unnecessary rather
>> than mandatory.
>>
>> Signed-off-by: Qinyun Tan <qinyuntan@xxxxxxxxxxxxxxxxx>
>> ---
>> Applies on top of mm-new.  No Fixes: tag since the commit that makes
>> the crash reachable ("mm: shmem: make unused huge shrinker memcg
>> aware") is only in mm-new; no stable backport is needed either.
>>
>> Reproducer, on mm-new booted with cgroup_disable=memory
>> (CONFIG_MEMCG=y, CONFIG_TRANSPARENT_HUGEPAGE=y):
>>
>>    # mount -t tmpfs -o huge=always tmpfs /mnt
>>    # echo x > /mnt/f
>>
>> Without this patch the write oopses immediately as shown above: the
>> freshly allocated huge folio extends beyond i_size, so
>> shmem_get_folio_gfp() queues the inode via shmem_unused_huge_add()
>> -> folio_memcg_list_lru_alloc(), which dereferences the NULL
>> folio_memcg().
>>
>> With this patch the same steps run cleanly: the lru falls back to
>> plain per-node lists and folio_memcg_list_lru_alloc() returns early.
>>  From code inspection the rest of the shmem path handles the NULL
>> objcg fine (obj_cgroup_memcg() and obj_cgroup_put() are NULL-safe,
>> and list_lru_add() with a NULL memcg lands on the per-node list),
>> but I have not exercised the shrinker reclaim itself under
>> cgroup_disable=memory.
>>
>> Discussion: https://lore.kernel.org/linux-mm/20260901115104.2944996-1-qinyuntan@xxxxxxxxxxxxxxxxx/
>>
>>   mm/list_lru.c | 7 ++++++-
>>   1 file changed, 6 insertions(+), 1 deletion(-)
>>
>> diff --git a/mm/list_lru.c b/mm/list_lru.c
>> index 36662d02ff963..f8be119351cca 100644
>> --- a/mm/list_lru.c
>> +++ b/mm/list_lru.c
>> @@ -671,7 +671,12 @@ int __list_lru_init(struct list_lru *lru, bool memcg_aware, struct shrinker *shr
>>       else
>>           lru->shrinker_id = -1;
>>   -    if (mem_cgroup_kmem_disabled())
>> +    /*
>> +     * With the memory controller disabled entirely, no object is ever
>> +     * charged to a memcg, so collapse to plain per-node lists just
>> +     * like under nokmem.
>> +     */
> 
> These comments seem useless, as the code already explains itself.
> 

Agreed, the condition is self-explanatory. Will drop the comment.

>> +    if (mem_cgroup_disabled() || mem_cgroup_kmem_disabled())
>>           memcg_aware = false;
>>   #endif
>>   
> 
> Since __list_lru_init() is also exported, I think this looks reasonable to me. With comments removed,
> 
> Reviewed-by: Baolin Wang <baolin.wang@xxxxxxxxxxxxxxxxx>

Thanks for the review. I will send v2 shortly with the comment
removed and your Reviewed-by collected.

Thanks,
Qinyun Tan