Re: [PATCH] mm/hugetlb: charge folios to the target mm's memcg

[Muchun Song]

> On Sep 3, 2026, at 15:50, Jinmeng Zhou <jinmengzhou22@xxxxxxxxx> wrote:
> 
> HugeTLB folios are currently charged to the memcg of the allocating
> task.  This gives the wrong result when a userfaultfd handler populates a
> HugeTLB VMA that belongs to another process.  The UFFDIO_COPY ioctl
> operates on the userfaultfd context's mm, but get_mem_cgroup_from_current()
> charges the folio to the handler's memcg instead.
> 
> This can be reproduced by placing the faulting process and its userfaultfd
> handler in different memory cgroups.  Have the target process register a
> HugeTLB mapping with userfaultfd, trigger a missing fault, and let the
> handler resolve it with UFFDIO_COPY.  The hugepage usage is then reported
> in the handler's memory.current instead of the target's.
> 
> The generic userfaultfd population path avoids this problem by charging
> folios to dst_vma->vm_mm.
> 
> Pass the target mm through hugetlb_alloc_folio() and charge the folio by
> using get_mem_cgroup_from_mm().  This preserves the existing charge timing
> and error handling while making HugeTLB userfaultfd population consistent
> with the generic path.
> 
> Fixes: 8cba9576df60 ("hugetlb: memcg: account hugetlb-backed memory in memory controller")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Jinmeng Zhou <zhoujinmeng@xxxxxxxxxxxxx>

Reviewed-by: Muchun Song <muchun.song@xxxxxxxxx>

Thanks.