7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Chris Mason Commit 0b34e7b20a48710b6f53716bf7030920b69fdbdd upstream. The io_tctx_node allocated the first time a task touches a ring, and the XArray nodes behind tctx->xa and ctx->personalities, are plain GFP_KERNEL. tctx->xa is indexed by the ring pointer, so nearly every entry needs nodes of its own, and a task gets one entry per ring it has used. 642 threads on 4000 rings held 2.3GB with 59MB charged against a 64MB memory.max. Allocate the node with GFP_KERNEL_ACCOUNT and set XA_FLAGS_ACCOUNT on both XArrays. Fixes: 0f2122045b94 ("io_uring: don't rely on weak ->files references") Signed-off-by: Chris Mason Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman --- io_uring/io_uring.c | 2 +- io_uring/tctx.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -271,7 +271,7 @@ static __cold struct io_ring_ctx *io_rin if (ret) goto free_ref; init_completion(&ctx->ref_comp); - xa_init_flags(&ctx->personalities, XA_FLAGS_ALLOC1); + xa_init_flags(&ctx->personalities, XA_FLAGS_ALLOC1 | XA_FLAGS_ACCOUNT); mutex_init(&ctx->uring_lock); init_waitqueue_head(&ctx->cq_wait); init_waitqueue_head(&ctx->poll_wq); --- a/io_uring/tctx.c +++ b/io_uring/tctx.c @@ -104,7 +104,7 @@ __cold struct io_uring_task *io_uring_al } tctx->task = task; - xa_init(&tctx->xa); + xa_init_flags(&tctx->xa, XA_FLAGS_ACCOUNT); init_waitqueue_head(&tctx->wait); atomic_set(&tctx->in_cancel, 0); atomic_set(&tctx->inflight_tracked, 0); @@ -123,7 +123,7 @@ static int io_tctx_install_node(struct i if (xa_load(&tctx->xa, (unsigned long)ctx)) return 0; - node = kmalloc_obj(*node); + node = kmalloc_obj(*node, GFP_KERNEL_ACCOUNT); if (!node) return -ENOMEM; node->ctx = ctx;