| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/09/01 19:47 | flow | patch-triage |
2mArgs:null Results: {
"EnableConfigs": [
"MEMCG",
"SWAP"
],
"FocusSymbols": [
"mem_cgroup_from_private_id",
"mem_cgroup_private_id_get_online",
"__mem_cgroup_try_charge_swap",
"__mem_cgroup_uncharge_swap",
"list_lru_walk_node",
"workingset_test_recent"
],
"KMSANReasoning": "The patch refactors the memory cgroup private ID tracking mechanism so that the private ID pins the corresponding obj_cgroup rather than the mem_cgroup CSS directly.\n\n1. Uninitialized memory analysis:\n- All modified structures (`struct obj_cgroup` and `struct mem_cgroup`) are zero-allocated using `kzalloc_obj()` and `kmem_cache_zalloc()`, and newly introduced fields (`memcgid_ref`, `id_objcg`, `id`) are explicitly initialized during allocation / online state.\n- Local variables across modified functions (`memcgid`, `objcg`, `memcg`) are initialized before being used in branching or assignments.\n- No uninitialized buffers or fields are read, branched upon, or passed to user space.\n\n2. KASAN vs KMSAN applicability:\n- The changes involve internal memory management, object lifecycle, and reference counting (refcount_t, percpu_ref, RCU, XArray).\n- Potential issues such as use-after-free, double-free, reference count imbalances, or NULL pointer dereferences are directly detectable by KASAN, refcount debugging, and standard kernel assertions.\n- KMSAN is not required as there are no uninitialized memory usage or info-leak risks.",
"NeedsKMSAN": false,
"Reasoning": "The patch refactors mem_cgroup private ID management, changing ownership and reference counting from mem_cgroup directly to obj_cgroup (memcgid_ref) so that private IDs reference obj_cgroup and allow proper lifetime management and reparenting during cgroup destruction and swap accounting. These are core memory management and cgroup changes that affect swap charging/uncharging, list_lru traversal, and workingset refault logic.",
"WorthFuzzing": true
} |
| 1/1 | 2026/09/01 19:47 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 5f8653600a227db799d6f3819216dbb595ecac63\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Tue Sep 1 19:46:59 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h\nindex f227348a3f24a..eafc817ff244c 100644\n--- a/include/linux/memcontrol.h\n+++ b/include/linux/memcontrol.h\n@@ -66,11 +66,6 @@ struct mem_cgroup_reclaim_cookie {\n \n #define MEM_CGROUP_ID_SHIFT\t16\n \n-struct mem_cgroup_private_id {\n-\tint id;\n-\trefcount_t ref;\n-};\n-\n struct memcg_vmstats_percpu;\n struct memcg1_events_percpu;\n struct memcg_vmstats;\n@@ -173,6 +168,7 @@ struct obj_cgroup {\n \tstruct percpu_ref refcnt;\n \tstruct mem_cgroup *memcg;\n \tatomic_t nr_charged_bytes;\n+\trefcount_t memcgid_ref;\n \tunion {\n \t\tstruct list_head list; /* protected by objcg_lock */\n \t\tstruct rcu_head rcu;\n@@ -189,8 +185,8 @@ struct obj_cgroup {\n struct mem_cgroup {\n \tstruct cgroup_subsys_state css;\n \n-\t/* Private memcg ID. Used to ID objects that outlive the cgroup */\n-\tstruct mem_cgroup_private_id id;\n+\t/* The objcg holding private memcg ID. */\n+\tstruct obj_cgroup *id_objcg;\n \n \t/* Accounted resources */\n \tstruct page_counter memory;\t\t/* Both v1 \u0026 v2 */\n@@ -255,6 +251,9 @@ struct mem_cgroup {\n #endif\n \tint kmemcg_id;\n \n+\t/* Private memcg ID. Used to ID objects that outlive the cgroup */\n+\tint id;\n+\n #ifdef CONFIG_CGROUP_WRITEBACK\n \tstruct list_head cgwb_list;\n #endif\n@@ -810,7 +809,7 @@ static inline unsigned short mem_cgroup_private_id(struct mem_cgroup *memcg)\n \tif (mem_cgroup_disabled())\n \t\treturn 0;\n \n-\treturn memcg-\u003eid.id;\n+\treturn memcg-\u003eid;\n }\n struct mem_cgroup *mem_cgroup_from_private_id(unsigned short id);\n \ndiff --git a/mm/list_lru.c b/mm/list_lru.c\nindex 36662d02ff963..bc956267f6835 100644\n--- a/mm/list_lru.c\n+++ b/mm/list_lru.c\n@@ -428,7 +428,7 @@ unsigned long list_lru_walk_node(struct list_lru *lru, int nid,\n \t\txa_for_each(\u0026lru-\u003exa, index, mlru) {\n \t\t\trcu_read_lock();\n \t\t\tmemcg = mem_cgroup_from_private_id(index);\n-\t\t\tif (!mem_cgroup_tryget(memcg)) {\n+\t\t\tif (!memcg || !mem_cgroup_tryget(memcg)) {\n \t\t\t\trcu_read_unlock();\n \t\t\t\tcontinue;\n \t\t\t}\ndiff --git a/mm/memcontrol.c b/mm/memcontrol.c\nindex 256b68ffca70e..84dcab3acb8a2 100644\n--- a/mm/memcontrol.c\n+++ b/mm/memcontrol.c\n@@ -3773,7 +3773,7 @@ static void memcg_online_kmem(struct mem_cgroup *memcg)\n \n \tstatic_branch_enable(\u0026memcg_kmem_online_key);\n \n-\tmemcg-\u003ekmemcg_id = memcg-\u003eid.id;\n+\tmemcg-\u003ekmemcg_id = memcg-\u003eid;\n }\n \n static void memcg_offline_kmem(struct mem_cgroup *memcg)\n@@ -4032,25 +4032,65 @@ static DEFINE_XARRAY_ALLOC1(mem_cgroup_private_ids);\n \n static void mem_cgroup_private_id_remove(struct mem_cgroup *memcg)\n {\n-\tif (memcg-\u003eid.id \u003e 0) {\n-\t\txa_erase(\u0026mem_cgroup_private_ids, memcg-\u003eid.id);\n-\t\tmemcg-\u003eid.id = 0;\n+\tif (memcg-\u003eid \u003e 0) {\n+\t\txa_erase(\u0026mem_cgroup_private_ids, memcg-\u003eid);\n+\t\tmemcg-\u003eid = 0;\n \t}\n }\n \n-static inline void mem_cgroup_private_id_put(struct mem_cgroup *memcg, unsigned int n)\n+static void __mem_cgroup_private_id_put(struct obj_cgroup *objcg,\n+\t\tunsigned short id, unsigned int n)\n {\n-\tif (refcount_sub_and_test(n, \u0026memcg-\u003eid.ref)) {\n-\t\tmem_cgroup_private_id_remove(memcg);\n+\tstruct obj_cgroup *objcg_free;\n \n-\t\t/* Memcg ID pins CSS */\n-\t\tcss_put(\u0026memcg-\u003ecss);\n+\tif (refcount_sub_and_test(n, \u0026objcg-\u003ememcgid_ref)) {\n+\t\tobjcg_free = xa_erase(\u0026mem_cgroup_private_ids, id);\n+\t\tVM_WARN_ON(objcg_free != objcg);\n+\n+\t\t/* Memcg ID pins the objcg */\n+\t\tobj_cgroup_put(objcg);\n \t}\n }\n \n+/**\n+ * mem_cgroup_private_id_put - put memcgid and get the nearest online memcg\n+ * @id: the memcg private id got from mem_cgroup_id_get_online\n+ * @n: count of references to put\n+ */\n+static struct mem_cgroup *mem_cgroup_private_id_put(unsigned short id, unsigned int n)\n+{\n+\tstruct mem_cgroup *memcg = NULL;\n+\tstruct obj_cgroup *objcg;\n+\n+\trcu_read_lock();\n+\tobjcg = xa_load(\u0026mem_cgroup_private_ids, id);\n+\tif (unlikely(!objcg))\n+\t\tgoto out;\n+\n+\tmemcg = obj_cgroup_memcg(objcg);\n+\twhile (memcg_is_dying(memcg) || !mem_cgroup_tryget(memcg))\n+\t\tmemcg = parent_mem_cgroup(memcg);\n+\n+\t__mem_cgroup_private_id_put(objcg, id, n);\n+\n+out:\n+\trcu_read_unlock();\n+\treturn memcg;\n+}\n+\n+static void mem_cgroup_private_id_kill(struct mem_cgroup *memcg)\n+{\n+\t__mem_cgroup_private_id_put(memcg-\u003eid_objcg, memcg-\u003eid, 1);\n+}\n+\n struct mem_cgroup *mem_cgroup_private_id_get_online(struct mem_cgroup *memcg, unsigned int n)\n {\n-\twhile (!refcount_add_not_zero(n, \u0026memcg-\u003eid.ref)) {\n+\tstruct obj_cgroup *objcg;\n+\n+\trcu_read_lock();\n+\tobjcg = memcg-\u003eid_objcg;\n+\n+\twhile (!refcount_add_not_zero(n, \u0026objcg-\u003ememcgid_ref)) {\n \t\t/*\n \t\t * The root cgroup cannot be destroyed, so it's refcount must\n \t\t * always be \u003e= 1.\n@@ -4060,7 +4100,10 @@ struct mem_cgroup *mem_cgroup_private_id_get_online(struct mem_cgroup *memcg, un\n \t\t\tbreak;\n \t\t}\n \t\tmemcg = parent_mem_cgroup(memcg);\n+\t\tobjcg = memcg-\u003eid_objcg;\n \t}\n+\n+\trcu_read_unlock();\n \treturn memcg;\n }\n \n@@ -4069,11 +4112,24 @@ struct mem_cgroup *mem_cgroup_private_id_get_online(struct mem_cgroup *memcg, un\n * @id: the memcg id to look up\n *\n * Caller must hold rcu_read_lock().\n+ *\n+ * @return: the memcg, or NULL if the memcg is already reparented.\n */\n struct mem_cgroup *mem_cgroup_from_private_id(unsigned short id)\n {\n+\tstruct obj_cgroup *objcg;\n+\tstruct mem_cgroup *memcg;\n \tWARN_ON_ONCE(!rcu_read_lock_held());\n-\treturn xa_load(\u0026mem_cgroup_private_ids, id);\n+\n+\tobjcg = xa_load(\u0026mem_cgroup_private_ids, id);\n+\tif (!objcg)\n+\t\treturn NULL;\n+\n+\tmemcg = obj_cgroup_memcg(objcg);\n+\tif (mem_cgroup_private_id(memcg) != id)\n+\t\treturn NULL;\n+\n+\treturn memcg;\n }\n \n struct mem_cgroup *mem_cgroup_get_from_id(u64 id)\n@@ -4174,7 +4230,7 @@ static struct mem_cgroup *mem_cgroup_alloc(struct mem_cgroup *parent)\n \tif (!memcg)\n \t\treturn ERR_PTR(-ENOMEM);\n \n-\terror = xa_alloc(\u0026mem_cgroup_private_ids, \u0026memcg-\u003eid.id, NULL,\n+\terror = xa_alloc(\u0026mem_cgroup_private_ids, \u0026memcg-\u003eid, NULL,\n \t\t\t XA_LIMIT(1, MEM_CGROUP_ID_MAX), GFP_KERNEL);\n \tif (error)\n \t\tgoto fail;\n@@ -4319,9 +4375,10 @@ static int mem_cgroup_css_online(struct cgroup_subsys_state *css)\n \t\t\t\t FLUSH_TIME);\n \tlru_gen_online_memcg(memcg);\n \n-\t/* Online state pins memcg ID, memcg ID pins CSS */\n-\trefcount_set(\u0026memcg-\u003eid.ref, 1);\n-\tcss_get(css);\n+\t/* CSS pins memcg ID, memcg ID pins obj cgroup */\n+\tmemcg-\u003eid_objcg = objcg;\n+\trefcount_set(\u0026memcg-\u003eid_objcg-\u003ememcgid_ref, 1);\n+\tobj_cgroup_get(memcg-\u003eid_objcg);\n \n \t/*\n \t * Ensure mem_cgroup_from_private_id() works once we're fully online.\n@@ -4333,7 +4390,7 @@ static int mem_cgroup_css_online(struct cgroup_subsys_state *css)\n \t * publish it here at the end of onlining. This matches the\n \t * regular ID destruction during offlining.\n \t */\n-\txa_store(\u0026mem_cgroup_private_ids, memcg-\u003eid.id, memcg, GFP_KERNEL);\n+\txa_store(\u0026mem_cgroup_private_ids, memcg-\u003eid, memcg-\u003eid_objcg, GFP_KERNEL);\n \n \treturn 0;\n free_objcg:\n@@ -4385,7 +4442,7 @@ static void mem_cgroup_css_offline(struct cgroup_subsys_state *css)\n \n \tdrain_all_stock(memcg);\n \n-\tmem_cgroup_private_id_put(memcg, 1);\n+\tmem_cgroup_private_id_kill(memcg);\n }\n \n static void mem_cgroup_css_released(struct cgroup_subsys_state *css)\n@@ -5750,6 +5807,7 @@ int __mem_cgroup_try_charge_swap(struct folio *folio)\n \tstruct page_counter *counter;\n \tstruct mem_cgroup *memcg;\n \tstruct obj_cgroup *objcg;\n+\tunsigned short memcgid;\n \n \tif (do_memsw_account())\n \t\treturn 0;\n@@ -5767,22 +5825,24 @@ int __mem_cgroup_try_charge_swap(struct folio *folio)\n \t\treturn 0;\n \t}\n \n-\tmemcg = mem_cgroup_private_id_get_online(memcg, nr_pages);\n-\t/* memcg is pined by memcg ID. */\n-\trcu_read_unlock();\n+\twhile (memcg_is_dying(memcg))\n+\t\tmemcg = parent_mem_cgroup(memcg);\n \n \tif (!mem_cgroup_is_root(memcg) \u0026\u0026\n \t !page_counter_try_charge(\u0026memcg-\u003eswap, nr_pages, \u0026counter)) {\n \t\tmemcg_memory_event(memcg, MEMCG_SWAP_MAX);\n \t\tmemcg_memory_event(memcg, MEMCG_SWAP_FAIL);\n-\t\tmem_cgroup_private_id_put(memcg, nr_pages);\n+\t\trcu_read_unlock();\n \t\treturn -ENOMEM;\n \t}\n \tmod_memcg_state(memcg, MEMCG_SWAP, nr_pages);\n \n+\tmemcg = mem_cgroup_private_id_get_online(memcg, nr_pages);\n+\tmemcgid = mem_cgroup_private_id(memcg);\n+\trcu_read_unlock();\n+\n \tci = swap_cluster_get_and_lock(folio);\n-\t__swap_cgroup_set(ci, swp_cluster_offset(folio-\u003eswap), nr_pages,\n-\t\t\t mem_cgroup_private_id(memcg));\n+\t__swap_cgroup_set(ci, swp_cluster_offset(folio-\u003eswap), nr_pages, memcgid);\n \tswap_cluster_unlock(ci);\n \n \treturn 0;\n@@ -5798,18 +5858,23 @@ void __mem_cgroup_uncharge_swap(unsigned short id, unsigned int nr_pages)\n \tstruct mem_cgroup *memcg;\n \n \trcu_read_lock();\n-\tmemcg = mem_cgroup_from_private_id(id);\n+\tmemcg = mem_cgroup_private_id_put(id, nr_pages);\n \tif (memcg) {\n-\t\tif (!mem_cgroup_is_root(memcg)) {\n+\t\t/*\n+\t\t * If the memcg was offline and reparented to root, swap needs\n+\t\t * uncharging as well. We check this by comparing the memcgid.\n+\t\t */\n+\t\tif (!mem_cgroup_is_root(memcg) || id != mem_cgroup_private_id(memcg)) {\n \t\t\tif (do_memsw_account())\n \t\t\t\tpage_counter_uncharge(\u0026memcg-\u003ememsw, nr_pages);\n \t\t\telse\n \t\t\t\tpage_counter_uncharge(\u0026memcg-\u003eswap, nr_pages);\n \t\t}\n \t\tmod_memcg_state(memcg, MEMCG_SWAP, -nr_pages);\n-\t\tmem_cgroup_private_id_put(memcg, nr_pages);\n \t}\n \trcu_read_unlock();\n+\n+\tmem_cgroup_put(memcg);\n }\n \n long mem_cgroup_get_nr_swap_pages(struct mem_cgroup *memcg)\ndiff --git a/mm/workingset.c b/mm/workingset.c\nindex 7ac2b88c80ae5..4e9b7b163c01e 100644\n--- a/mm/workingset.c\n+++ b/mm/workingset.c\n@@ -470,7 +470,7 @@ bool workingset_test_recent(void *shadow, bool file, bool *workingset,\n \t * configurations instead.\n \t */\n \teviction_memcg = mem_cgroup_from_private_id(memcgid);\n-\tif (!mem_cgroup_tryget(eviction_memcg))\n+\tif (eviction_memcg \u0026\u0026 !mem_cgroup_tryget(eviction_memcg))\n \t\teviction_memcg = NULL;\n \trcu_read_unlock();\n \n"
} |
| 2/1 | 2026/09/01 19:47 | agent | patch-evaluator |
1mModel:core Args: null Results: {
"EnableConfigs": [
"MEMCG",
"SWAP"
],
"FocusSymbols": [
"mem_cgroup_from_private_id",
"mem_cgroup_private_id_get_online",
"__mem_cgroup_try_charge_swap",
"__mem_cgroup_uncharge_swap",
"list_lru_walk_node",
"workingset_test_recent"
],
"Reasoning": "The patch refactors mem_cgroup private ID management, changing ownership and reference counting from mem_cgroup directly to obj_cgroup (memcgid_ref) so that private IDs reference obj_cgroup and allow proper lifetime management and reparenting during cgroup destruction and swap accounting. These are core memory management and cgroup changes that affect swap charging/uncharging, list_lru traversal, and workingset refault logic.",
"WorthFuzzing": true
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit 5f8653600a227db799d6f3819216dbb595ecac63
Author: syz-cluster <triage@syzkaller.com>
Date: Tue Sep 1 19:46:59 2026 +0000
syz-cluster: applied patch under review
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index f227348a3f24a..eafc817ff244c 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -66,11 +66,6 @@ struct mem_cgroup_reclaim_cookie {
#define MEM_CGROUP_ID_SHIFT 16
-struct mem_cgroup_private_id {
- int id;
- refcount_t ref;
-};
-
struct memcg_vmstats_percpu;
struct memcg1_events_percpu;
struct memcg_vmstats;
@@ -173,6 +168,7 @@ struct obj_cgroup {
struct percpu_ref refcnt;
struct mem_cgroup *memcg;
atomic_t nr_charged_bytes;
+ refcount_t memcgid_ref;
union {
struct list_head list; /* protected by objcg_lock */
struct rcu_head rcu;
@@ -189,8 +185,8 @@ struct obj_cgroup {
struct mem_cgroup {
struct cgroup_subsys_state css;
- /* Private memcg ID. Used to ID objects that outlive the cgroup */
- struct mem_cgroup_private_id id;
+ /* The objcg holding private memcg ID. */
+ struct obj_cgroup *id_objcg;
/* Accounted resources */
struct page_counter memory; /* Both v1 & v2 */
@@ -255,6 +251,9 @@ struct mem_cgroup {
#endif
int kmemcg_id;
+ /* Private memcg ID. Used to ID objects that outlive the cgroup */
+ int id;
+
#ifdef CONFIG_CGROUP_WRITEBACK
struct list_head cgwb_list;
#endif
@@ -810,7 +809,7 @@ static inline unsigned short mem_cgroup_private_id(struct mem_cgroup *memcg)
if (mem_cgroup_disabled())
return 0;
- return memcg->id.id;
+ return memcg->id;
}
struct mem_cgroup *mem_cgroup_from_private_id(unsigned short id);
diff --git a/mm/list_lru.c b/mm/list_lru.c
index 36662d02ff963..bc956267f6835 100644
--- a/mm/list_lru.c
+++ b/mm/list_lru.c
@@ -428,7 +428,7 @@ unsigned long list_lru_walk_node(struct list_lru *lru, int nid,
xa_for_each(&lru->xa, index, mlru) {
rcu_read_lock();
memcg = mem_cgroup_from_private_id(index);
- if (!mem_cgroup_tryget(memcg)) {
+ if (!memcg || !mem_cgroup_tryget(memcg)) {
rcu_read_unlock();
continue;
}
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 256b68ffca70e..84dcab3acb8a2 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3773,7 +3773,7 @@ static void memcg_online_kmem(struct mem_cgroup *memcg)
static_branch_enable(&memcg_kmem_online_key);
- memcg->kmemcg_id = memcg->id.id;
+ memcg->kmemcg_id = memcg->id;
}
static void memcg_offline_kmem(struct mem_cgroup *memcg)
@@ -4032,25 +4032,65 @@ static DEFINE_XARRAY_ALLOC1(mem_cgroup_private_ids);
static void mem_cgroup_private_id_remove(struct mem_cgroup *memcg)
{
- if (memcg->id.id > 0) {
- xa_erase(&mem_cgroup_private_ids, memcg->id.id);
- memcg->id.id = 0;
+ if (memcg->id > 0) {
+ xa_erase(&mem_cgroup_private_ids, memcg->id);
+ memcg->id = 0;
}
}
-static inline void mem_cgroup_private_id_put(struct mem_cgroup *memcg, unsigned int n)
+static void __mem_cgroup_private_id_put(struct obj_cgroup *objcg,
+ unsigned short id, unsigned int n)
{
- if (refcount_sub_and_test(n, &memcg->id.ref)) {
- mem_cgroup_private_id_remove(memcg);
+ struct obj_cgroup *objcg_free;
- /* Memcg ID pins CSS */
- css_put(&memcg->css);
+ if (refcount_sub_and_test(n, &objcg->memcgid_ref)) {
+ objcg_free = xa_erase(&mem_cgroup_private_ids, id);
+ VM_WARN_ON(objcg_free != objcg);
+
+ /* Memcg ID pins the objcg */
+ obj_cgroup_put(objcg);
}
}
+/**
+ * mem_cgroup_private_id_put - put memcgid and get the nearest online memcg
+ * @id: the memcg private id got from mem_cgroup_id_get_online
+ * @n: count of references to put
+ */
+static struct mem_cgroup *mem_cgroup_private_id_put(unsigned short id, unsigned int n)
+{
+ struct mem_cgroup *memcg = NULL;
+ struct obj_cgroup *objcg;
+
+ rcu_read_lock();
+ objcg = xa_load(&mem_cgroup_private_ids, id);
+ if (unlikely(!objcg))
+ goto out;
+
+ memcg = obj_cgroup_memcg(objcg);
+ while (memcg_is_dying(memcg) || !mem_cgroup_tryget(memcg))
+ memcg = parent_mem_cgroup(memcg);
+
+ __mem_cgroup_private_id_put(objcg, id, n);
+
+out:
+ rcu_read_unlock();
+ return memcg;
+}
+
+static void mem_cgroup_private_id_kill(struct mem_cgroup *memcg)
+{
+ __mem_cgroup_private_id_put(memcg->id_objcg, memcg->id, 1);
+}
+
struct mem_cgroup *mem_cgroup_private_id_get_online(struct mem_cgroup *memcg, unsigned int n)
{
- while (!refcount_add_not_zero(n, &memcg->id.ref)) {
+ struct obj_cgroup *objcg;
+
+ rcu_read_lock();
+ objcg = memcg->id_objcg;
+
+ while (!refcount_add_not_zero(n, &objcg->memcgid_ref)) {
/*
* The root cgroup cannot be destroyed, so it's refcount must
* always be >= 1.
@@ -4060,7 +4100,10 @@ struct mem_cgroup *mem_cgroup_private_id_get_online(struct mem_cgroup *memcg, un
break;
}
memcg = parent_mem_cgroup(memcg);
+ objcg = memcg->id_objcg;
}
+
+ rcu_read_unlock();
return memcg;
}
@@ -4069,11 +4112,24 @@ struct mem_cgroup *mem_cgroup_private_id_get_online(struct mem_cgroup *memcg, un
* @id: the memcg id to look up
*
* Caller must hold rcu_read_lock().
+ *
+ * @return: the memcg, or NULL if the memcg is already reparented.
*/
struct mem_cgroup *mem_cgroup_from_private_id(unsigned short id)
{
+ struct obj_cgroup *objcg;
+ struct mem_cgroup *memcg;
WARN_ON_ONCE(!rcu_read_lock_held());
- return xa_load(&mem_cgroup_private_ids, id);
+
+ objcg = xa_load(&mem_cgroup_private_ids, id);
+ if (!objcg)
+ return NULL;
+
+ memcg = obj_cgroup_memcg(objcg);
+ if (mem_cgroup_private_id(memcg) != id)
+ return NULL;
+
+ return memcg;
}
struct mem_cgroup *mem_cgroup_get_from_id(u64 id)
@@ -4174,7 +4230,7 @@ static struct mem_cgroup *mem_cgroup_alloc(struct mem_cgroup *parent)
if (!memcg)
return ERR_PTR(-ENOMEM);
- error = xa_alloc(&mem_cgroup_private_ids, &memcg->id.id, NULL,
+ error = xa_alloc(&mem_cgroup_private_ids, &memcg->id, NULL,
XA_LIMIT(1, MEM_CGROUP_ID_MAX), GFP_KERNEL);
if (error)
goto fail;
@@ -4319,9 +4375,10 @@ static int mem_cgroup_css_online(struct cgroup_subsys_state *css)
FLUSH_TIME);
lru_gen_online_memcg(memcg);
- /* Online state pins memcg ID, memcg ID pins CSS */
- refcount_set(&memcg->id.ref, 1);
- css_get(css);
+ /* CSS pins memcg ID, memcg ID pins obj cgroup */
+ memcg->id_objcg = objcg;
+ refcount_set(&memcg->id_objcg->memcgid_ref, 1);
+ obj_cgroup_get(memcg->id_objcg);
/*
* Ensure mem_cgroup_from_private_id() works once we're fully online.
@@ -4333,7 +4390,7 @@ static int mem_cgroup_css_online(struct cgroup_subsys_state *css)
* publish it here at the end of onlining. This matches the
* regular ID destruction during offlining.
*/
- xa_store(&mem_cgroup_private_ids, memcg->id.id, memcg, GFP_KERNEL);
+ xa_store(&mem_cgroup_private_ids, memcg->id, memcg->id_objcg, GFP_KERNEL);
return 0;
free_objcg:
@@ -4385,7 +4442,7 @@ static void mem_cgroup_css_offline(struct cgroup_subsys_state *css)
drain_all_stock(memcg);
- mem_cgroup_private_id_put(memcg, 1);
+ mem_cgroup_private_id_kill(memcg);
}
static void mem_cgroup_css_released(struct cgroup_subsys_state *css)
@@ -5750,6 +5807,7 @@ int __mem_cgroup_try_charge_swap(struct folio *folio)
struct page_counter *counter;
struct mem_cgroup *memcg;
struct obj_cgroup *objcg;
+ unsigned short memcgid;
if (do_memsw_account())
return 0;
@@ -5767,22 +5825,24 @@ int __mem_cgroup_try_charge_swap(struct folio *folio)
return 0;
}
- memcg = mem_cgroup_private_id_get_online(memcg, nr_pages);
- /* memcg is pined by memcg ID. */
- rcu_read_unlock();
+ while (memcg_is_dying(memcg))
+ memcg = parent_mem_cgroup(memcg);
if (!mem_cgroup_is_root(memcg) &&
!page_counter_try_charge(&memcg->swap, nr_pages, &counter)) {
memcg_memory_event(memcg, MEMCG_SWAP_MAX);
memcg_memory_event(memcg, MEMCG_SWAP_FAIL);
- mem_cgroup_private_id_put(memcg, nr_pages);
+ rcu_read_unlock();
return -ENOMEM;
}
mod_memcg_state(memcg, MEMCG_SWAP, nr_pages);
+ memcg = mem_cgroup_private_id_get_online(memcg, nr_pages);
+ memcgid = mem_cgroup_private_id(memcg);
+ rcu_read_unlock();
+
ci = swap_cluster_get_and_lock(folio);
- __swap_cgroup_set(ci, swp_cluster_offset(folio->swap), nr_pages,
- mem_cgroup_private_id(memcg));
+ __swap_cgroup_set(ci, swp_cluster_offset(folio->swap), nr_pages, memcgid);
swap_cluster_unlock(ci);
return 0;
@@ -5798,18 +5858,23 @@ void __mem_cgroup_uncharge_swap(unsigned short id, unsigned int nr_pages)
struct mem_cgroup *memcg;
rcu_read_lock();
- memcg = mem_cgroup_from_private_id(id);
+ memcg = mem_cgroup_private_id_put(id, nr_pages);
if (memcg) {
- if (!mem_cgroup_is_root(memcg)) {
+ /*
+ * If the memcg was offline and reparented to root, swap needs
+ * uncharging as well. We check this by comparing the memcgid.
+ */
+ if (!mem_cgroup_is_root(memcg) || id != mem_cgroup_private_id(memcg)) {
if (do_memsw_account())
page_counter_uncharge(&memcg->memsw, nr_pages);
else
page_counter_uncharge(&memcg->swap, nr_pages);
}
mod_memcg_state(memcg, MEMCG_SWAP, -nr_pages);
- mem_cgroup_private_id_put(memcg, nr_pages);
}
rcu_read_unlock();
+
+ mem_cgroup_put(memcg);
}
long mem_cgroup_get_nr_swap_pages(struct mem_cgroup *memcg)
diff --git a/mm/workingset.c b/mm/workingset.c
index 7ac2b88c80ae5..4e9b7b163c01e 100644
--- a/mm/workingset.c
+++ b/mm/workingset.c
@@ -470,7 +470,7 @@ bool workingset_test_recent(void *shadow, bool file, bool *workingset,
* configurations instead.
*/
eviction_memcg = mem_cgroup_from_private_id(memcgid);
- if (!mem_cgroup_tryget(eviction_memcg))
+ if (eviction_memcg && !mem_cgroup_tryget(eviction_memcg))
eviction_memcg = NULL;
rcu_read_unlock();
|
| 3/2 | 2026/09/01 19:47 | llm | patch-evaluator |
1mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 6040 output: 24 thoughts: 520 Thoughts: **Analyzing the Potential for Fuzzing this Kernel Patch** Okay, let's break this down. My goal is to determine if this patch is a good target for fuzzing, and, if so, what configurations and symbols I should focus on. First, let's make sure there's nothing malicious here. This is a standard QA/defensive analysis of a kernel patch – it's all about improving the kernel's robustness. This patch is definitely not asking me to do anything exploitative. Good. Now, the patch itself touches some interesting files: `include/linux/memcontrol.h`, `mm/list_lru.c`, `mm/memcontrol.c`, and `mm/workingset.c`. That right there gets my attention. These files are all in the heart of memory management and control, specifically around cgroups. The commit refactors how mem_cgroup private IDs are handled. The old way involved a `struct mem_cgroup_private_id` with a reference count directly within `mem_cgroup`. The new way moves the reference count to `obj_cgroup` and uses an `xarray` to manage `obj_cgroup` pointers for private IDs. The changes include modifications to critical functions: `mem_cgroup_private_id_put`, `mem_cgroup_private_id_get_online`, `mem_cgroup_from_private_id`, and also some swap and lru functions like `__mem_cgroup_try_charge_swap`, `__mem_cgroup_uncharge_swap`, `list_lru_walk_node`, and `workingset_test_recent`. This is a **major** area, which means this *is* absolutely worth fuzzing. It's a core memory management and cgroup subsystem change. It touches memory control, swap accounting, and workingset refaulting logic. This kind of refactoring is ripe for introducing potential race conditions, use-after-frees, or memory leaks, especially with these reference counting and lifetime changes. I'm especially interested in the changes to swap charging and uncharging because those areas can be tricky. Reparenting and list_lru operations are other good targets. Now, let's fire up grep and our code search tools. Time to dig into the Kconfig dependencies and relevant kernel symbols to narrow down our fuzzing targets and configurations. |
| 4/2 | 2026/09/01 19:48 | tool | grepper |
0mArgs:{
"Expression": "MEMCG",
"PathPrefix": "mm/"
}Results: {
"Output": "\nFull output is too long, showing 500 out of 1490 lines.\nUse more precise expression if possible.\n\nmm/Makefile=103=obj-$(CONFIG_LIVEUPDATE_MEMFD) += memfd_luo.o\nmm/Makefile:104:obj-$(CONFIG_MEMCG_V1) += memcontrol-v1.o\nmm/Makefile:105:obj-$(CONFIG_MEMCG) += memcontrol.o vmpressure.o\nmm/Makefile-106-ifdef CONFIG_BPF_SYSCALL\nmm/Makefile:107:obj-$(CONFIG_MEMCG) += bpf_memcontrol.o\nmm/Makefile-108-endif\n--\nmm/bpf_memcontrol.c=125=__bpf_kfunc unsigned long bpf_mem_cgroup_memory_events(struct mem_cgroup *memcg,\n--\nmm/bpf_memcontrol.c-127-{\nmm/bpf_memcontrol.c:128:\tif (unlikely(event \u003e= MEMCG_NR_MEMORY_EVENTS))\nmm/bpf_memcontrol.c-129-\t\treturn (unsigned long)-1;\n--\nmm/damon/core.c=1128=static void damos_commit_quota_goal_union(\n--\nmm/damon/core.c-1135-\t\tbreak;\nmm/damon/core.c:1136:\tcase DAMOS_QUOTA_NODE_MEMCG_USED_BP:\nmm/damon/core.c:1137:\tcase DAMOS_QUOTA_NODE_MEMCG_FREE_BP:\nmm/damon/core.c-1138-\t\tdst-\u003enid = src-\u003enid;\n--\nmm/damon/core.c=1237=static void damos_commit_filter_arg(\n--\nmm/damon/core.c-1240-\tswitch (dst-\u003etype) {\nmm/damon/core.c:1241:\tcase DAMOS_FILTER_TYPE_MEMCG:\nmm/damon/core.c-1242-\t\tdst-\u003ememcg_id = src-\u003ememcg_id;\n--\nmm/damon/core.c=1676=static void damon_commit_filter(struct damon_filter *dst,\n--\nmm/damon/core.c-1682-\tswitch (dst-\u003etype) {\nmm/damon/core.c:1683:\tcase DAMON_FILTER_TYPE_MEMCG:\nmm/damon/core.c-1684-\t\tdst-\u003ememcg_id = src-\u003ememcg_id;\n--\nmm/damon/core.c=1691=static int damon_commit_filters(struct damon_probe *dst,\n--\nmm/damon/core.c-1713-\t\tswitch (src_filter-\u003etype) {\nmm/damon/core.c:1714:\t\tcase DAMON_FILTER_TYPE_MEMCG:\nmm/damon/core.c-1715-\t\t\tnew_filter-\u003ememcg_id = src_filter-\u003ememcg_id;\n--\nmm/damon/core.c=2816=static unsigned long damos_get_node_memcg_used_bp(\n--\nmm/damon/core.c-2824-\tif (invalid_mem_node(goal-\u003enid)) {\nmm/damon/core.c:2825:\t\tif (goal-\u003emetric == DAMOS_QUOTA_NODE_MEMCG_USED_BP)\nmm/damon/core.c-2826-\t\t\treturn 0;\nmm/damon/core.c:2827:\t\telse\t/* DAMOS_QUOTA_NODE_MEMCG_FREE_BP */\nmm/damon/core.c-2828-\t\t\treturn 10000;\n--\nmm/damon/core.c-2832-\tif (!memcg) {\nmm/damon/core.c:2833:\t\tif (goal-\u003emetric == DAMOS_QUOTA_NODE_MEMCG_USED_BP)\nmm/damon/core.c-2834-\t\t\treturn 0;\nmm/damon/core.c:2835:\t\telse\t/* DAMOS_QUOTA_NODE_MEMCG_FREE_BP */\nmm/damon/core.c-2836-\t\t\treturn 10000;\n--\nmm/damon/core.c-2848-\tsi_meminfo_node(\u0026i, goal-\u003enid);\nmm/damon/core.c:2849:\tif (goal-\u003emetric == DAMOS_QUOTA_NODE_MEMCG_USED_BP)\nmm/damon/core.c-2850-\t\tnumerator = used_pages;\nmm/damon/core.c:2851:\telse\t/* DAMOS_QUOTA_NODE_MEMCG_FREE_BP */\nmm/damon/core.c-2852-\t\tnumerator = i.totalram - used_pages;\n--\nmm/damon/core.c=3017=static void damos_set_quota_goal_current_value(struct damon_ctx *c,\n--\nmm/damon/core.c-3034-\t\tbreak;\nmm/damon/core.c:3035:\tcase DAMOS_QUOTA_NODE_MEMCG_USED_BP:\nmm/damon/core.c:3036:\tcase DAMOS_QUOTA_NODE_MEMCG_FREE_BP:\nmm/damon/core.c-3037-\t\tgoal-\u003ecurrent_value = damos_get_node_memcg_used_bp(goal);\n--\nmm/damon/ops-common.c=261=bool damos_folio_filter_match(struct damos_filter *filter, struct folio *folio)\n--\nmm/damon/ops-common.c-273-\t\tbreak;\nmm/damon/ops-common.c:274:\tcase DAMOS_FILTER_TYPE_MEMCG:\nmm/damon/ops-common.c-275-\t\trcu_read_lock();\n--\nmm/damon/paddr.c=108=static bool damon_pa_filter_match(struct damon_filter *filter,\n--\nmm/damon/paddr.c-121-\t\tbreak;\nmm/damon/paddr.c:122:\tcase DAMON_FILTER_TYPE_MEMCG:\nmm/damon/paddr.c-123-\t\tif (!folio) {\n--\nmm/damon/sysfs-common.c=106=static bool damon_sysfs_memcg_path_eq(struct mem_cgroup *memcg,\n--\nmm/damon/sysfs-common.c-108-{\nmm/damon/sysfs-common.c:109:#ifdef CONFIG_MEMCG\nmm/damon/sysfs-common.c-110-\tcgroup_path(memcg-\u003ecss.cgroup, memcg_path_buf, PATH_MAX);\n--\nmm/damon/sysfs-common.c-112-\t\treturn true;\nmm/damon/sysfs-common.c:113:#endif /* CONFIG_MEMCG */\nmm/damon/sysfs-common.c-114-\treturn false;\n--\nmm/damon/sysfs-schemes.c=558=damos_sysfs_filter_type_names[] = {\n--\nmm/damon/sysfs-schemes.c-567-\t{\nmm/damon/sysfs-schemes.c:568:\t\t.type = DAMOS_FILTER_TYPE_MEMCG,\nmm/damon/sysfs-schemes.c-569-\t\t.name = \"memcg\",\n--\nmm/damon/sysfs-schemes.c=1235=struct damos_sysfs_qgoal_metric_name damos_sysfs_qgoal_metric_names[] = {\n--\nmm/damon/sysfs-schemes.c-1252-\t{\nmm/damon/sysfs-schemes.c:1253:\t\t.metric = DAMOS_QUOTA_NODE_MEMCG_USED_BP,\nmm/damon/sysfs-schemes.c-1254-\t\t.name = \"node_memcg_used_bp\",\n--\nmm/damon/sysfs-schemes.c-1256-\t{\nmm/damon/sysfs-schemes.c:1257:\t\t.metric = DAMOS_QUOTA_NODE_MEMCG_FREE_BP,\nmm/damon/sysfs-schemes.c-1258-\t\t.name = \"node_memcg_free_bp\",\n--\nmm/damon/sysfs-schemes.c=2804=static int damon_sysfs_add_scheme_filters(struct damos *scheme,\n--\nmm/damon/sysfs-schemes.c-2819-\t\t\treturn -ENOMEM;\nmm/damon/sysfs-schemes.c:2820:\t\tif (filter-\u003etype == DAMOS_FILTER_TYPE_MEMCG) {\nmm/damon/sysfs-schemes.c-2821-\t\t\terr = damon_sysfs_memcg_path_to_id(\n--\nmm/damon/sysfs-schemes.c=2851=static int damos_sysfs_add_quota_score(\n--\nmm/damon/sysfs-schemes.c-2876-\t\t\tbreak;\nmm/damon/sysfs-schemes.c:2877:\t\tcase DAMOS_QUOTA_NODE_MEMCG_USED_BP:\nmm/damon/sysfs-schemes.c:2878:\t\tcase DAMOS_QUOTA_NODE_MEMCG_FREE_BP:\nmm/damon/sysfs-schemes.c-2879-\t\t\terr = damon_sysfs_memcg_path_to_id(\n--\nmm/damon/sysfs.c=775=damon_sysfs_filter_type_names[] = {\n--\nmm/damon/sysfs.c-780-\t{\nmm/damon/sysfs.c:781:\t\t.type = DAMON_FILTER_TYPE_MEMCG,\nmm/damon/sysfs.c-782-\t\t.name = \"memcg\",\n--\nmm/damon/sysfs.c=1935=static int damon_sysfs_set_filters(struct damon_probe *probe,\n--\nmm/damon/sysfs.c-1949-\t\t\treturn -ENOMEM;\nmm/damon/sysfs.c:1950:\t\tif (filter-\u003etype == DAMON_FILTER_TYPE_MEMCG) {\nmm/damon/sysfs.c-1951-\t\t\tint err;\n--\nmm/damon/tests/core-kunit.h=756=static void damos_test_commit_quota_goal_for(struct kunit *test,\n--\nmm/damon/tests/core-kunit.h-776-\t\tbreak;\nmm/damon/tests/core-kunit.h:777:\tcase DAMOS_QUOTA_NODE_MEMCG_USED_BP:\nmm/damon/tests/core-kunit.h:778:\tcase DAMOS_QUOTA_NODE_MEMCG_FREE_BP:\nmm/damon/tests/core-kunit.h-779-\t\tKUNIT_EXPECT_EQ(test, dst-\u003enid, src-\u003enid);\n--\nmm/damon/tests/core-kunit.h=787=static void damos_test_commit_quota_goal(struct kunit *test)\n--\nmm/damon/tests/core-kunit.h-816-\t\t\t\u0026(struct damos_quota_goal){\nmm/damon/tests/core-kunit.h:817:\t\t\t.metric = DAMOS_QUOTA_NODE_MEMCG_USED_BP,\nmm/damon/tests/core-kunit.h-818-\t\t\t.target_value = 456,\n--\nmm/damon/tests/core-kunit.h-824-\t\t\t\u0026(struct damos_quota_goal){\nmm/damon/tests/core-kunit.h:825:\t\t\t.metric = DAMOS_QUOTA_NODE_MEMCG_FREE_BP,\nmm/damon/tests/core-kunit.h-826-\t\t\t.target_value = 890,\n--\nmm/damon/tests/core-kunit.h=1066=static void damos_test_commit_filter_for(struct kunit *test,\n--\nmm/damon/tests/core-kunit.h-1073-\tswitch (src-\u003etype) {\nmm/damon/tests/core-kunit.h:1074:\tcase DAMOS_FILTER_TYPE_MEMCG:\nmm/damon/tests/core-kunit.h-1075-\t\tKUNIT_EXPECT_EQ(test, dst-\u003ememcg_id, src-\u003ememcg_id);\n--\nmm/damon/tests/core-kunit.h=1095=static void damos_test_commit_filter(struct kunit *test)\n--\nmm/damon/tests/core-kunit.h-1110-\t\t\t\u0026(struct damos_filter){\nmm/damon/tests/core-kunit.h:1111:\t\t\t.type = DAMOS_FILTER_TYPE_MEMCG,\nmm/damon/tests/core-kunit.h-1112-\t\t\t.matching = false,\n--\nmm/debug.c=70=static void __dump_folio(const struct folio *folio, const struct page *page,\n--\nmm/debug.c-96-\nmm/debug.c:97:#ifdef CONFIG_MEMCG\nmm/debug.c-98-\tif (folio-\u003ememcg_data)\n--\nmm/debug.c=171=void dump_mm(const struct mm_struct *mm)\n--\nmm/debug.c-184-#endif\nmm/debug.c:185:#ifdef CONFIG_MEMCG\nmm/debug.c-186-\t\t\"owner %px \"\n--\nmm/debug.c-213-#endif\nmm/debug.c:214:#ifdef CONFIG_MEMCG\nmm/debug.c-215-\t\tmm-\u003eowner,\n--\nmm/folio.c=1110=void folio_batch_remove_exceptionals(struct folio_batch *fbatch)\n--\nmm/folio.c-1121-\nmm/folio.c:1122:#ifdef CONFIG_MEMCG\nmm/folio.c-1123-static void lruvec_reparent_lru(struct lruvec *child_lruvec,\n--\nmm/huge_memory.c=1064=static int __init thp_shrinker_init(void)\n--\nmm/huge_memory.c-1066-\tdeferred_split_shrinker = shrinker_alloc(SHRINKER_NUMA_AWARE |\nmm/huge_memory.c:1067:\t\t\t\t\t\t SHRINKER_MEMCG_AWARE,\nmm/huge_memory.c-1068-\t\t\t\t\t\t \"thp-deferred_split\");\n--\nmm/huge_memory.c=3689=static void __split_folio_to_order(struct folio *folio, int old_order,\n--\nmm/huge_memory.c-3791-\t\t\tfolio_set_idle(new_folio);\nmm/huge_memory.c:3792:#ifdef CONFIG_MEMCG\nmm/huge_memory.c-3793-\t\tnew_folio-\u003ememcg_data = folio-\u003ememcg_data;\n--\nmm/hwpoison-inject.c=45=static int hwpoison_filter_flags(struct page *p)\n--\nmm/hwpoison-inject.c-66- */\nmm/hwpoison-inject.c:67:#ifdef CONFIG_MEMCG\nmm/hwpoison-inject.c-68-static u64 hwpoison_filter_memcg;\n--\nmm/hwpoison-inject.c=162=static int __init pfn_inject_init(void)\n--\nmm/hwpoison-inject.c-191-\nmm/hwpoison-inject.c:192:#ifdef CONFIG_MEMCG\nmm/hwpoison-inject.c-193-\tdebugfs_create_u64(\"corrupt-filter-memcg\", 0600, hwpoison_dir,\n--\nmm/internal.h=65=unsigned long lruvec_lru_size(struct lruvec *lruvec, enum lru_list lru,\n--\nmm/internal.h-67-\nmm/internal.h:68:#define MEMCG_RECLAIM_MAY_SWAP (1 \u003c\u003c 1)\nmm/internal.h:69:#define MEMCG_RECLAIM_PROACTIVE (1 \u003c\u003c 2)\nmm/internal.h-70-#define MIN_SWAPPINESS 0\n--\nmm/list_lru.c=29=static inline void unlock_list_lru(struct list_lru_one *l, bool irq_off,\n--\nmm/list_lru.c-39-\nmm/list_lru.c:40:#ifdef CONFIG_MEMCG\nmm/list_lru.c-41-static LIST_HEAD(memcg_list_lrus);\n--\nmm/list_lru.c=141=lock_list_lru_of_memcg(struct list_lru *lru, int nid,\n--\nmm/list_lru.c-150-}\nmm/list_lru.c:151:#endif /* CONFIG_MEMCG */\nmm/list_lru.c-152-\n--\nmm/list_lru.c=413=unsigned long list_lru_walk_node(struct list_lru *lru, int nid,\n--\nmm/list_lru.c-421-\nmm/list_lru.c:422:#ifdef CONFIG_MEMCG\nmm/list_lru.c-423-\tif (*nr_to_walk \u003e 0 \u0026\u0026 list_lru_memcg_aware(lru)) {\n--\nmm/list_lru.c=451=static void init_one_lru(struct list_lru *lru, struct list_lru_one *l)\n--\nmm/list_lru.c-461-\nmm/list_lru.c:462:#ifdef CONFIG_MEMCG\nmm/list_lru.c-463-static struct list_lru_memcg *memcg_init_list_lru_one(struct list_lru *lru, gfp_t gfp)\n--\nmm/list_lru.c=659=static void memcg_destroy_list_lru(struct list_lru *lru)\n--\nmm/list_lru.c-661-}\nmm/list_lru.c:662:#endif /* CONFIG_MEMCG */\nmm/list_lru.c-663-\nmm/list_lru.c=664=int __list_lru_init(struct list_lru *lru, bool memcg_aware, struct shrinker *shrinker)\n--\nmm/list_lru.c-667-\nmm/list_lru.c:668:#ifdef CONFIG_MEMCG\nmm/list_lru.c-669-\tif (shrinker)\n--\nmm/list_lru.c=692=void list_lru_destroy(struct list_lru *lru)\n--\nmm/list_lru.c-703-\nmm/list_lru.c:704:#ifdef CONFIG_MEMCG\nmm/list_lru.c-705-\tlru-\u003eshrinker_id = -1;\n--\nmm/memcontrol-v1.c=269=void __memcg1_swapout(struct folio *folio, struct swap_cluster_info *ci)\n--\nmm/memcontrol-v1.c-299-\tswap_memcg = mem_cgroup_private_id_get_online(memcg, nr_entries);\nmm/memcontrol-v1.c:300:\tmod_memcg_state(swap_memcg, MEMCG_SWAP, nr_entries);\nmm/memcontrol-v1.c-301-\n--\nmm/memcontrol-v1.c=1123=void memcg1_oom_finish(struct mem_cgroup *memcg, bool locked)\n--\nmm/memcontrol-v1.c-1130- * cgroup v1 userspace vmpressure interface (memory.pressure_level /\nmm/memcontrol-v1.c:1131: * cgroup.event_control). Kept here so v2-only kernels (CONFIG_MEMCG_V1=n)\nmm/memcontrol-v1.c-1132- * drop the whole eventfd accumulator, its work item, and the per-memcg\n--\nmm/memcontrol-v1.c=1422=static int mem_cgroup_resize_max(struct mem_cgroup *memcg,\n--\nmm/memcontrol-v1.c-1467-\t\tif (!try_to_free_mem_cgroup_pages(memcg, 1, GFP_KERNEL,\nmm/memcontrol-v1.c:1468:\t\t\t\tmemsw ? 0 : MEMCG_RECLAIM_MAY_SWAP, NULL)) {\nmm/memcontrol-v1.c-1469-\t\t\tret = -EBUSY;\n--\nmm/memcontrol-v1.c=1485=static int mem_cgroup_force_empty(struct mem_cgroup *memcg)\n--\nmm/memcontrol-v1.c-1503-\t\tif (!try_to_free_mem_cgroup_pages(memcg, 1, GFP_KERNEL,\nmm/memcontrol-v1.c:1504:\t\t\t\t\t\t MEMCG_RECLAIM_MAY_SWAP, NULL))\nmm/memcontrol-v1.c-1505-\t\t\tnr_retries--;\n--\nmm/memcontrol-v1.c=1826=static const unsigned int memcg1_stats[] = {\n--\nmm/memcontrol-v1.c-1838-#ifdef CONFIG_SWAP\nmm/memcontrol-v1.c:1839:\tMEMCG_SWAP,\nmm/memcontrol-v1.c-1840-\tNR_SWAPCACHE,\n--\nmm/memcontrol-v1.c=1986=static int mem_cgroup_oom_control_read(struct seq_file *sf, void *v)\n--\nmm/memcontrol-v1.c-1992-\tseq_printf(sf, \"oom_kill %lu\\n\",\nmm/memcontrol-v1.c:1993:\t\t atomic_long_read(\u0026memcg-\u003ememory_events[MEMCG_OOM_KILL]));\nmm/memcontrol-v1.c-1994-\treturn 0;\n--\nmm/memcontrol-v1.h=25=struct mem_cgroup *mem_cgroup_private_id_get_online(struct mem_cgroup *memcg,\n--\nmm/memcontrol-v1.h-28-/* Cgroup v1-specific declarations */\nmm/memcontrol-v1.h:29:#ifdef CONFIG_MEMCG_V1\nmm/memcontrol-v1.h-30-\n--\nmm/memcontrol-v1.h=86=extern struct cftype mem_cgroup_legacy_files[];\nmm/memcontrol-v1.h-87-\nmm/memcontrol-v1.h:88:#else\t/* CONFIG_MEMCG_V1 */\nmm/memcontrol-v1.h-89-\n--\nmm/memcontrol-v1.h=118=static inline void memcg1_uncharge_skmem(struct mem_cgroup *memcg, unsigned int nr_pages) {}\nmm/memcontrol-v1.h-119-\nmm/memcontrol-v1.h:120:#endif\t/* CONFIG_MEMCG_V1 */\nmm/memcontrol-v1.h-121-\n--\nmm/memcontrol.c=141=static void memcg_uncharge_kmem(struct mem_cgroup *memcg, unsigned int nr_pages)\nmm/memcontrol.c-142-{\nmm/memcontrol.c:143:\tmod_memcg_state(memcg, MEMCG_KMEM, -nr_pages);\nmm/memcontrol.c-144-\tmemcg1_account_kmem(memcg, -nr_pages);\n--\nmm/memcontrol.c=215=static inline struct obj_cgroup *__memcg_reparent_objcgs(struct mem_cgroup *memcg,\n--\nmm/memcontrol.c-234-\nmm/memcontrol.c:235:#ifdef CONFIG_MEMCG_V1\nmm/memcontrol.c-236-static void __mem_cgroup_flush_stats(struct mem_cgroup *memcg, bool force);\n--\nmm/memcontrol.c=437=static const unsigned int memcg_stat_items[] = {\nmm/memcontrol.c:438:\tMEMCG_SWAP,\nmm/memcontrol.c:439:\tMEMCG_SOCK,\nmm/memcontrol.c:440:\tMEMCG_PERCPU_B,\nmm/memcontrol.c:441:\tMEMCG_KMEM,\nmm/memcontrol.c:442:\tMEMCG_ZSWAP_B,\nmm/memcontrol.c:443:\tMEMCG_ZSWAPPED,\nmm/memcontrol.c:444:\tMEMCG_ZSWAP_INCOMP,\nmm/memcontrol.c-445-};\nmm/memcontrol.c-446-\nmm/memcontrol.c:447:#define NR_MEMCG_NODE_STAT_ITEMS ARRAY_SIZE(memcg_node_stat_items)\nmm/memcontrol.c:448:#define MEMCG_VMSTAT_SIZE (NR_MEMCG_NODE_STAT_ITEMS + \\\nmm/memcontrol.c-449-\t\t\t ARRAY_SIZE(memcg_stat_items))\nmm/memcontrol.c-450-#define BAD_STAT_IDX(index) ((u32)(index) \u003e= U8_MAX)\nmm/memcontrol.c:451:static u8 mem_cgroup_stats_index[MEMCG_NR_STAT] __read_mostly;\nmm/memcontrol.c-452-\nmm/memcontrol.c=453=static void init_memcg_stats(void)\n--\nmm/memcontrol.c-456-\nmm/memcontrol.c:457:\tBUILD_BUG_ON(MEMCG_NR_STAT \u003e= U8_MAX);\nmm/memcontrol.c-458-\n--\nmm/memcontrol.c-460-\nmm/memcontrol.c:461:\tfor (i = 0; i \u003c NR_MEMCG_NODE_STAT_ITEMS; ++i, ++j)\nmm/memcontrol.c-462-\t\tmem_cgroup_stats_index[memcg_node_stat_items[i]] = j;\n--\nmm/memcontrol.c=473=struct lruvec_stats_percpu {\nmm/memcontrol.c-474-\t/* Local (CPU and cgroup) state */\nmm/memcontrol.c:475:\tlong state[NR_MEMCG_NODE_STAT_ITEMS];\nmm/memcontrol.c-476-\nmm/memcontrol.c-477-\t/* Delta calculation for lockless upward propagation */\nmm/memcontrol.c:478:\tlong state_prev[NR_MEMCG_NODE_STAT_ITEMS];\nmm/memcontrol.c-479-};\n--\nmm/memcontrol.c=481=struct lruvec_stats {\nmm/memcontrol.c-482-\t/* Aggregated (CPU and subtree) state */\nmm/memcontrol.c:483:\tlong state[NR_MEMCG_NODE_STAT_ITEMS];\nmm/memcontrol.c-484-\nmm/memcontrol.c-485-\t/* Non-hierarchical (CPU aggregated) state */\nmm/memcontrol.c:486:\tlong state_local[NR_MEMCG_NODE_STAT_ITEMS];\nmm/memcontrol.c-487-\nmm/memcontrol.c-488-\t/* Pending child counts during tree propagation */\nmm/memcontrol.c:489:\tlong state_pending[NR_MEMCG_NODE_STAT_ITEMS];\nmm/memcontrol.c-490-};\n--\nmm/memcontrol.c=550=unsigned long lruvec_page_state_local(struct lruvec *lruvec,\n--\nmm/memcontrol.c-572-\nmm/memcontrol.c:573:#ifdef CONFIG_MEMCG_V1\nmm/memcontrol.c-574-static void __mod_memcg_lruvec_state(struct mem_cgroup_per_node *pn,\n--\nmm/memcontrol.c=598=static const unsigned int memcg_vm_event_stat[] = {\nmm/memcontrol.c:599:#ifdef CONFIG_MEMCG_V1\nmm/memcontrol.c-600-\tPGPGIN,\n--\nmm/memcontrol.c-632-\nmm/memcontrol.c:633:#define NR_MEMCG_EVENTS ARRAY_SIZE(memcg_vm_event_stat)\nmm/memcontrol.c-634-static u8 mem_cgroup_events_index[NR_VM_EVENT_ITEMS] __read_mostly;\n--\nmm/memcontrol.c=636=static void init_memcg_events(void)\n--\nmm/memcontrol.c-644-\nmm/memcontrol.c:645:\tfor (i = 0; i \u003c NR_MEMCG_EVENTS; ++i)\nmm/memcontrol.c-646-\t\tmem_cgroup_events_index[memcg_vm_event_stat[i]] = i;\n--\nmm/memcontrol.c=654=struct memcg_vmstats_percpu {\n--\nmm/memcontrol.c-664-\t/* Local (CPU and cgroup) page state \u0026 events */\nmm/memcontrol.c:665:\tlong\t\t\tstate[MEMCG_VMSTAT_SIZE];\nmm/memcontrol.c:666:\tunsigned long\t\tevents[NR_MEMCG_EVENTS];\nmm/memcontrol.c-667-\nmm/memcontrol.c-668-\t/* Delta calculation for lockless upward propagation */\nmm/memcontrol.c:669:\tlong\t\t\tstate_prev[MEMCG_VMSTAT_SIZE];\nmm/memcontrol.c:670:\tunsigned long\t\tevents_prev[NR_MEMCG_EVENTS];\nmm/memcontrol.c-671-} ____cacheline_aligned;\n--\nmm/memcontrol.c=673=struct memcg_vmstats {\nmm/memcontrol.c-674-\t/* Aggregated (CPU and subtree) page state \u0026 events */\nmm/memcontrol.c:675:\tlong\t\t\tstate[MEMCG_VMSTAT_SIZE];\nmm/memcontrol.c:676:\tunsigned long\t\tevents[NR_MEMCG_EVENTS];\nmm/memcontrol.c-677-\nmm/memcontrol.c-678-\t/* Non-hierarchical (CPU aggregated) page state \u0026 events */\nmm/memcontrol.c:679:\tlong\t\t\tstate_local[MEMCG_VMSTAT_SIZE];\nmm/memcontrol.c:680:\tunsigned long\t\tevents_local[NR_MEMCG_EVENTS];\nmm/memcontrol.c-681-\nmm/memcontrol.c-682-\t/* Pending child counts during tree propagation */\nmm/memcontrol.c:683:\tlong\t\t\tstate_pending[MEMCG_VMSTAT_SIZE];\nmm/memcontrol.c:684:\tunsigned long\t\tevents_pending[NR_MEMCG_EVENTS];\nmm/memcontrol.c-685-\n--\nmm/memcontrol.c-700- * 2) Flush the stats synchronously on reader side only when there are more than\nmm/memcontrol.c:701: * (MEMCG_CHARGE_BATCH * nr_cpus) update events. Though this optimization\nmm/memcontrol.c:702: * will let stats be out of sync by atmost (MEMCG_CHARGE_BATCH * nr_cpus) but\nmm/memcontrol.c-703- * only for 2 seconds due to (1).\n--\nmm/memcontrol.c=711=static bool memcg_vmstats_needs_flush(struct memcg_vmstats *vmstats)\n--\nmm/memcontrol.c-713-\treturn atomic_long_read(\u0026vmstats-\u003estats_updates) \u003e\nmm/memcontrol.c:714:\t\tMEMCG_CHARGE_BATCH * num_online_cpus();\nmm/memcontrol.c-715-}\n--\nmm/memcontrol.c=717=static inline void memcg_rstat_updated(struct mem_cgroup *memcg, long val,\n--\nmm/memcontrol.c-740-\t\t\t\t\t\t abs(val));\nmm/memcontrol.c:741:\t\tif (stats_updates \u003c MEMCG_CHARGE_BATCH)\nmm/memcontrol.c-742-\t\t\tcontinue;\n--\nmm/memcontrol.c=818=bool memcg_stat_item_valid(int idx)\nmm/memcontrol.c-819-{\nmm/memcontrol.c:820:\tif ((u32)idx \u003e= MEMCG_NR_STAT)\nmm/memcontrol.c-821-\t\treturn false;\n--\nmm/memcontrol.c=832=static long memcg_state_val_in_pages(int idx, long val)\n--\nmm/memcontrol.c-847-\nmm/memcontrol.c:848:#ifdef CONFIG_MEMCG_V1\nmm/memcontrol.c-849-/*\n--\nmm/memcontrol.c=916=void mod_memcg_state(struct mem_cgroup *memcg, enum memcg_stat_item idx,\n--\nmm/memcontrol.c-928-\nmm/memcontrol.c:929:#ifdef CONFIG_MEMCG_V1\nmm/memcontrol.c-930-/* idx can be of type enum memcg_stat_item or node_stat_item. */\n--\nmm/memcontrol.c=1104=bool memcg_vm_event_item_valid(enum vm_event_item idx)\n--\nmm/memcontrol.c-1111-\nmm/memcontrol.c:1112:#ifdef CONFIG_MEMCG_V1\nmm/memcontrol.c-1113-unsigned long memcg_events_local(struct mem_cgroup *memcg, int event)\n--\nmm/memcontrol.c=1575=static const struct memory_stat memory_stats[] = {\n--\nmm/memcontrol.c-1577-\t{ \"file\",\t\t\tNR_FILE_PAGES\t\t\t},\nmm/memcontrol.c:1578:\t{ \"kernel\",\t\t\tMEMCG_KMEM\t\t\t},\nmm/memcontrol.c-1579-\t{ \"kernel_stack\",\t\tNR_KERNEL_STACK_KB\t\t},\n--\nmm/memcontrol.c-1581-\t{ \"sec_pagetables\",\t\tNR_SECONDARY_PAGETABLE\t\t},\nmm/memcontrol.c:1582:\t{ \"percpu\",\t\t\tMEMCG_PERCPU_B\t\t\t},\nmm/memcontrol.c:1583:\t{ \"sock\",\t\t\tMEMCG_SOCK\t\t\t},\nmm/memcontrol.c-1584-\t{ \"vmalloc\",\t\t\tNR_VMALLOC\t\t\t},\n--\nmm/memcontrol.c-1586-#ifdef CONFIG_ZSWAP\nmm/memcontrol.c:1587:\t{ \"zswap\",\t\t\tMEMCG_ZSWAP_B\t\t\t},\nmm/memcontrol.c:1588:\t{ \"zswapped\",\t\t\tMEMCG_ZSWAPPED\t\t\t},\nmm/memcontrol.c:1589:\t{ \"zswap_incomp\",\t\tMEMCG_ZSWAP_INCOMP\t\t},\nmm/memcontrol.c-1590-#endif\n--\nmm/memcontrol.c=1641=static int memcg_page_state_unit(int item)\n--\nmm/memcontrol.c-1643-\tswitch (item) {\nmm/memcontrol.c:1644:\tcase MEMCG_PERCPU_B:\nmm/memcontrol.c:1645:\tcase MEMCG_ZSWAP_B:\nmm/memcontrol.c-1646-\tcase NR_SLAB_RECLAIMABLE_B:\n--\nmm/memcontrol.c=1696=unsigned long memcg_page_state_output(struct mem_cgroup *memcg, int item)\n--\nmm/memcontrol.c-1701-\nmm/memcontrol.c:1702:#ifdef CONFIG_MEMCG_V1\nmm/memcontrol.c-1703-unsigned long memcg_page_state_local_output(struct mem_cgroup *memcg, int item)\n--\nmm/memcontrol.c=1722=static void memcg_stat_format(struct mem_cgroup *memcg, struct seq_buf *s)\n--\nmm/memcontrol.c-1768-\tfor (i = 0; i \u003c ARRAY_SIZE(memcg_vm_event_stat); i++) {\nmm/memcontrol.c:1769:#ifdef CONFIG_MEMCG_V1\nmm/memcontrol.c-1770-\t\tif (memcg_vm_event_stat[i] == PGPGIN ||\n--\nmm/memcontrol.c=1820=void mem_cgroup_print_oom_meminfo(struct mem_cgroup *memcg)\n--\nmm/memcontrol.c-1829-\tif (cgroup_subsys_on_dfl(memory_cgrp_subsys))\nmm/memcontrol.c:1830:\t\tmemory_failcnt = atomic_long_read(\u0026memcg-\u003ememory_events[MEMCG_MAX]);\nmm/memcontrol.c-1831-\telse\n--\nmm/memcontrol.c-1840-\t\t\tK((u64)READ_ONCE(memcg-\u003eswap.max)),\nmm/memcontrol.c:1841:\t\t\tatomic_long_read(\u0026memcg-\u003ememory_events[MEMCG_SWAP_MAX]));\nmm/memcontrol.c:1842:#ifdef CONFIG_MEMCG_V1\nmm/memcontrol.c-1843-\telse {\n--\nmm/memcontrol.c=1883=void __memcg_memory_event(struct mem_cgroup *memcg,\n--\nmm/memcontrol.c-1885-{\nmm/memcontrol.c:1886:\tbool swap_event = event == MEMCG_SWAP_HIGH || event == MEMCG_SWAP_MAX ||\nmm/memcontrol.c:1887:\t\t\t event == MEMCG_SWAP_FAIL;\nmm/memcontrol.c-1888-\nmm/memcontrol.c:1889:\t/* For now only MEMCG_MAX can happen with !allow_spinning context. */\nmm/memcontrol.c:1890:\tVM_WARN_ON_ONCE(!allow_spinning \u0026\u0026 event != MEMCG_MAX);\nmm/memcontrol.c-1891-\n\n"
} |
| 5/2 | 2026/09/01 19:48 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 16981 output: 25 thoughts: 28 Thoughts: Here's my thinking process: **Diving into Configuration Dependencies** Okay, so I need to figure out the configuration dependencies for `CONFIG_MEMCG`. Given my experience, the first place I'd look for those definitions is probably within the kernel's Kconfig files. Specifically, since we're dealing with memory control groups, it's highly likely that the relevant definitions and dependencies are either in the `init/Kconfig` file, which often contains core system initialization options, or perhaps `mm/Kconfig`, since memory management is a core aspect. So, I'll start by checking those two files – `init/Kconfig` and `mm/Kconfig` – to uncover the conditional logic that governs whether `CONFIG_MEMCG` can even be enabled in the kernel's configuration. This will give me a clear picture of what other features need to be enabled or disabled for it to work correctly, or what other dependencies are needed, and also where it is defined. |
| 6/2 | 2026/09/01 19:48 | tool | grepper |
0mArgs:{
"Expression": "config MEMCG",
"PathPrefix": "init/"
}Results: {
"Output": "init/Kconfig=1075=config CGROUP_FAVOR_DYNMODS\n--\ninit/Kconfig-1084-\ninit/Kconfig:1085:config MEMCG\ninit/Kconfig-1086-\tbool \"Memory controller\"\n--\ninit/Kconfig-1093-\ninit/Kconfig:1094:config MEMCG_NMI_UNSAFE\ninit/Kconfig-1095-\tbool\n--\ninit/Kconfig-1100-\ninit/Kconfig:1101:config MEMCG_NMI_SAFETY_REQUIRES_ATOMIC\ninit/Kconfig-1102-\tbool\n--\ninit/Kconfig-1107-\ninit/Kconfig:1108:config MEMCG_V1\ninit/Kconfig-1109-\tbool \"Legacy cgroup v1 memory controller\"\n"
} |
| 7/2 | 2026/09/01 19:48 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 17469 output: 33 thoughts: 18 Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience: **Diving into the Kernel Configuration Landscape** Okay, so I need to understand something related to kernel configuration. Let's see...I think I remember something important around the Kconfig system. Specifically, I'm going to jump into the `init/Kconfig` file. I'm going to focus my attention on around line 1085, as that location is frequently relevant to the core system initialization parameters. I'll need to figure out which feature is defined around there and what its interactions are with other parts of the system. Let's see what we can dig up. |
| 8/2 | 2026/09/01 19:48 | tool | read-file |
0mArgs:{
"File": "init/Kconfig",
"FirstLine": 1080,
"LineCount": 40
}Results: {
"Contents": "1080:\t\t as task migrations and controller on/offs at the cost of making\n1081:\t\t hot path operations such as forks and exits more expensive.\n1082:\t\n1083:\t\t Say N if unsure.\n1084:\t\n1085:\tconfig MEMCG\n1086:\t\tbool \"Memory controller\"\n1087:\t\tselect PAGE_COUNTER\n1088:\t\tselect EVENTFD\n1089:\t\tselect SLAB_OBJ_EXT\n1090:\t\tselect VM_EVENT_COUNTERS\n1091:\t\thelp\n1092:\t\t Provides control over the memory footprint of tasks in a cgroup.\n1093:\t\n1094:\tconfig MEMCG_NMI_UNSAFE\n1095:\t\tbool\n1096:\t\tdepends on MEMCG\n1097:\t\tdepends on HAVE_NMI\n1098:\t\tdepends on !ARCH_HAS_NMI_SAFE_THIS_CPU_OPS \u0026\u0026 !ARCH_HAVE_NMI_SAFE_CMPXCHG\n1099:\t\tdefault y\n1100:\t\n1101:\tconfig MEMCG_NMI_SAFETY_REQUIRES_ATOMIC\n1102:\t\tbool\n1103:\t\tdepends on MEMCG\n1104:\t\tdepends on HAVE_NMI\n1105:\t\tdepends on !ARCH_HAS_NMI_SAFE_THIS_CPU_OPS \u0026\u0026 ARCH_HAVE_NMI_SAFE_CMPXCHG\n1106:\t\tdefault y\n1107:\t\n1108:\tconfig MEMCG_V1\n1109:\t\tbool \"Legacy cgroup v1 memory controller\"\n1110:\t\tdepends on MEMCG\n1111:\t\tdefault n\n1112:\t\thelp\n1113:\t\t Legacy cgroup v1 memory controller which has been deprecated by\n1114:\t\t cgroup v2 implementation. The v1 is there for legacy applications\n1115:\t\t which haven't migrated to the new cgroup v2 interface yet. If you\n1116:\t\t do not have any such application then you are completely fine leaving\n1117:\t\t this option disabled.\n1118:\t\n1119:\t\t Please note that feature set of the legacy memory controller is likely\n"
} |
| 9/2 | 2026/09/01 19:48 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 18245 output: 33 thoughts: 58 Thoughts: **Investigating Swap Configuration and Memory CGroups** Okay, so I need to dig into how swap interacts with the memory cgroup implementation. First, I'll take a look at `CONFIG_SWAP` and see if any related configurations are enabled. Are there any flags or parameters that are specifically relevant to swap behavior that I need to be aware of? I'll probably also do a quick audit for swap related settings within the general config. Then, I'll trace the execution path of the core functions, specifically `__mem_cgroup_try_charge_swap` and `__mem_cgroup_uncharge_swap`. I need to figure out *where* these functions are defined and if they're subject to any conditional compilation. I have to understand how the charging and uncharging of swap space is managed within the memory cgroup framework. Are they always compiled in, or are there circumstances, configurations, or build options that would cause them to be omitted? Understanding the conditional logic is crucial for debugging. |
| 10/2 | 2026/09/01 19:48 | tool | grepper |
0mArgs:{
"Expression": "__mem_cgroup_try_charge_swap",
"PathPrefix": "mm/"
}Results: {
"Output": "mm/memcontrol.c=5758=int __init mem_cgroup_init(void)\n--\nmm/memcontrol.c-5795-/**\nmm/memcontrol.c:5796: * __mem_cgroup_try_charge_swap - try charging swap space for a folio\nmm/memcontrol.c-5797- * @folio: folio being added to swap\n--\nmm/memcontrol.c-5802- */\nmm/memcontrol.c:5803:int __mem_cgroup_try_charge_swap(struct folio *folio)\nmm/memcontrol.c-5804-{\n"
} |
| 11/2 | 2026/09/01 19:48 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 18717 output: 35 thoughts: 29 Thoughts: Here's my summary, as though I'm thinking through this process: **Diving into `mm/memcontrol.c` and the `#ifdef`s** Okay, so I need to understand the conditional compilation around `__mem_cgroup_try_charge_swap`. I'm going to jump into `mm/memcontrol.c` and take a look at the code. This function is pretty critical for memory cgroup accounting, especially when we're talking about swap usage. I'm guessing there's a good reason it might be conditionally compiled, probably related to different kernel configurations or maybe even feature flags. Let's see what the preprocessor directives are actually controlling. I need to figure out under what circumstances this function is *not* present and why, because that directly impacts how swap charges are handled in different deployment scenarios. I need to understand the implications of it being there and not being there for whatever the use case is. |
| 12/2 | 2026/09/01 19:48 | tool | read-file |
0mArgs:{
"File": "mm/memcontrol.c",
"FirstLine": 5785,
"LineCount": 40
}Results: {
"Contents": "5785:\t\tmemcg_cachep = kmem_cache_create(\"mem_cgroup\", memcg_size, 0,\n5786:\t\t\t\t\t\t SLAB_PANIC | SLAB_HWCACHE_ALIGN, NULL);\n5787:\t\n5788:\t\tmemcg_pn_cachep = KMEM_CACHE(mem_cgroup_per_node,\n5789:\t\t\t\t\t SLAB_PANIC | SLAB_HWCACHE_ALIGN);\n5790:\t\n5791:\t\treturn 0;\n5792:\t}\n5793:\t\n5794:\t#ifdef CONFIG_SWAP\n5795:\t/**\n5796:\t * __mem_cgroup_try_charge_swap - try charging swap space for a folio\n5797:\t * @folio: folio being added to swap\n5798:\t *\n5799:\t * Try to charge @folio's memcg for the swap space at folio-\u003eswap.\n5800:\t *\n5801:\t * Returns 0 on success, -ENOMEM on failure.\n5802:\t */\n5803:\tint __mem_cgroup_try_charge_swap(struct folio *folio)\n5804:\t{\n5805:\t\tunsigned int nr_pages = folio_nr_pages(folio);\n5806:\t\tstruct swap_cluster_info *ci;\n5807:\t\tstruct page_counter *counter;\n5808:\t\tstruct mem_cgroup *memcg;\n5809:\t\tstruct obj_cgroup *objcg;\n5810:\t\tunsigned short memcgid;\n5811:\t\n5812:\t\tif (do_memsw_account())\n5813:\t\t\treturn 0;\n5814:\t\n5815:\t\tobjcg = folio_objcg(folio);\n5816:\t\tVM_WARN_ON_ONCE_FOLIO(!objcg, folio);\n5817:\t\tif (!objcg)\n5818:\t\t\treturn 0;\n5819:\t\n5820:\t\trcu_read_lock();\n5821:\t\tmemcg = obj_cgroup_memcg(objcg);\n5822:\t\tif (!folio_test_swapcache(folio)) {\n5823:\t\t\tmemcg_memory_event(memcg, MEMCG_SWAP_FAIL);\n5824:\t\t\trcu_read_unlock();\n"
} |
| 13/2 | 2026/09/01 19:48 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 19610 output: 24 thoughts: 406 Thoughts: **Analyzing Memory Control Group Configuration Requirements** Okay, so I'm diving into these kernel configurations and how they relate to memory control groups. It seems pretty straightforward initially: `CONFIG_SWAP` is definitely needed because of those `__mem_cgroup_try_charge_swap` and `__mem_cgroup_uncharge_swap` functions – makes perfect sense. And obviously, `CONFIG_MEMCG` is a requirement, since it's fundamental to `memcontrol.o` and all the private ID functionality within memcgs. But I want to be thorough, so I'm checking for dependencies. Let's see about `CONFIG_MEMCG_V1`. Right, looking at `mm/memcontrol-v1.c`, I see `memcg1_swapout` is calling `mem_cgroup_private_id_get_online`. Okay, that adds another piece to the puzzle. Now, to get a handle on the scope of the changes, I'm going to look at the functions that have been modified or added. I see a decent number of them. The list is: 1. `__mem_cgroup_try_charge_swap` 2. `__mem_cgroup_uncharge_swap` 3. `mem_cgroup_from_private_id` 4. `mem_cgroup_private_id_get_online` 5. `list_lru_walk_node` 6. `workingset_test_recent` 7. `mem_cgroup_css_online` / `mem_cgroup_css_offline` (CSS callbacks) 8. `mem_cgroup_alloc` / `mem_cgroup_free` / `__mem_cgroup_private_id_put` / `mem_cgroup_private_id_put` / `mem_cgroup_private_id_kill` It looks like the first six are non-static, so, exported, and the last five, static. Finally, I need to understand `mem_cgroup_from_private_id` better, so I'm going to look at its definition and callers in `include/linux/memcontrol.h` and `mm/memcontrol.c`. That should give me the complete picture of how all these pieces fit together. |
| 14/2 | 2026/09/01 19:48 | tool | grepper |
0mArgs:{
"Expression": "mem_cgroup_from_private_id"
}Results: {
"Output": "include/linux/memcontrol.h=807=static inline unsigned short mem_cgroup_private_id(struct mem_cgroup *memcg)\n--\ninclude/linux/memcontrol.h-813-}\ninclude/linux/memcontrol.h:814:struct mem_cgroup *mem_cgroup_from_private_id(unsigned short id);\ninclude/linux/memcontrol.h-815-\n--\ninclude/linux/memcontrol.h=1293=static inline unsigned short mem_cgroup_private_id(struct mem_cgroup *memcg)\n--\ninclude/linux/memcontrol.h-1297-\ninclude/linux/memcontrol.h:1298:static inline struct mem_cgroup *mem_cgroup_from_private_id(unsigned short id)\ninclude/linux/memcontrol.h-1299-{\n--\nmm/list_lru.c=413=unsigned long list_lru_walk_node(struct list_lru *lru, int nid,\n--\nmm/list_lru.c-429-\t\t\trcu_read_lock();\nmm/list_lru.c:430:\t\t\tmemcg = mem_cgroup_from_private_id(index);\nmm/list_lru.c-431-\t\t\tif (!memcg || !mem_cgroup_tryget(memcg)) {\n--\nmm/memcontrol.c=4086=struct mem_cgroup *mem_cgroup_private_id_get_online(struct mem_cgroup *memcg, unsigned int n)\n--\nmm/memcontrol.c-4110-/**\nmm/memcontrol.c:4111: * mem_cgroup_from_private_id - look up a memcg from a memcg id\nmm/memcontrol.c-4112- * @id: the memcg id to look up\n--\nmm/memcontrol.c-4117- */\nmm/memcontrol.c:4118:struct mem_cgroup *mem_cgroup_from_private_id(unsigned short id)\nmm/memcontrol.c-4119-{\n--\nmm/memcontrol.c=4343=static int mem_cgroup_css_online(struct cgroup_subsys_state *css)\n--\nmm/memcontrol.c-4383-\t/*\nmm/memcontrol.c:4384:\t * Ensure mem_cgroup_from_private_id() works once we're fully online.\nmm/memcontrol.c-4385-\t *\n--\nmm/memcontrol.c=5352=int mem_cgroup_swapin_charge_folio(struct folio *folio, unsigned short id,\n--\nmm/memcontrol.c-5361-\trcu_read_lock();\nmm/memcontrol.c:5362:\tmemcg = mem_cgroup_from_private_id(id);\nmm/memcontrol.c-5363-\tif (!memcg || !css_tryget_online(\u0026memcg-\u003ecss))\n--\nmm/workingset.c=273=static bool lru_gen_test_recent(void *shadow, struct lruvec **lruvec,\n--\nmm/workingset.c-282-\nmm/workingset.c:283:\tmemcg = mem_cgroup_from_private_id(memcg_id);\nmm/workingset.c-284-\t*lruvec = mem_cgroup_lruvec(memcg, pgdat);\n--\nmm/workingset.c=430=bool workingset_test_recent(void *shadow, bool file, bool *workingset,\n--\nmm/workingset.c-471-\t */\nmm/workingset.c:472:\teviction_memcg = mem_cgroup_from_private_id(memcgid);\nmm/workingset.c-473-\tif (eviction_memcg \u0026\u0026 !mem_cgroup_tryget(eviction_memcg))\n"
} |
| 15/2 | 2026/09/01 19:48 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 21561 output: 26 thoughts: 20 Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience: **Investigating `mem_cgroup_private_id_get_online` Callers** Alright, time to dig into `mem_cgroup_private_id_get_online`. I need to understand its usage, and that means tracing its callers. This function is pretty core, so I expect a decent number of them, likely scattered throughout the memory management and cgroup subsystems. I'll need to identify the *why* behind those calls. Is it for identification within cgroups? Perhaps resource accounting? I need to quickly ascertain the context to determine if there are potential areas for optimization, bug fixes, or even design improvements. A targeted analysis of the call sites will be key. |
| 16/2 | 2026/09/01 19:48 | tool | grepper |
0mArgs:{
"Expression": "mem_cgroup_private_id_get_online"
}Results: {
"Output": "mm/memcontrol-v1.c=269=void __memcg1_swapout(struct folio *folio, struct swap_cluster_info *ci)\n--\nmm/memcontrol-v1.c-298-\tnr_entries = folio_nr_pages(folio);\nmm/memcontrol-v1.c:299:\tswap_memcg = mem_cgroup_private_id_get_online(memcg, nr_entries);\nmm/memcontrol-v1.c-300-\tmod_memcg_state(swap_memcg, MEMCG_SWAP, nr_entries);\n--\nmm/memcontrol-v1.h=23=int memory_stat_show(struct seq_file *m, void *v);\nmm/memcontrol-v1.h-24-\nmm/memcontrol-v1.h:25:struct mem_cgroup *mem_cgroup_private_id_get_online(struct mem_cgroup *memcg,\nmm/memcontrol-v1.h-26-\t\t\t\t\t\t unsigned int n);\n--\nmm/memcontrol.c=4081=static void mem_cgroup_private_id_kill(struct mem_cgroup *memcg)\n--\nmm/memcontrol.c-4085-\nmm/memcontrol.c:4086:struct mem_cgroup *mem_cgroup_private_id_get_online(struct mem_cgroup *memcg, unsigned int n)\nmm/memcontrol.c-4087-{\n--\nmm/memcontrol.c=5803=int __mem_cgroup_try_charge_swap(struct folio *folio)\n--\nmm/memcontrol.c-5839-\nmm/memcontrol.c:5840:\tmemcg = mem_cgroup_private_id_get_online(memcg, nr_pages);\nmm/memcontrol.c-5841-\tmemcgid = mem_cgroup_private_id(memcg);\n"
} |
| 17/2 | 2026/09/01 19:48 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 22263 output: 25 thoughts: 585 Thoughts: **Fuzzing Focus: Function Selection and Configuration Verification** Okay, let's get down to brass tacks. I need to pinpoint the functions in the kernel's memory management subsystem that are most promising for fuzzing. I've got a list already: `mem_cgroup_from_private_id`, `mem_cgroup_private_id_get_online`, `__mem_cgroup_try_charge_swap`, `__mem_cgroup_uncharge_swap`, `list_lru_walk_node`, and `workingset_test_recent`. First order of business: confirm that these are all exported or, at least, non-static functions. That makes them accessible for fuzzing. Now, let's verify their definitions. I'll quickly check `mm/memcontrol.c`, `mm/list_lru.c`, and `mm/workingset.c`. Ah, yes. Confirmed: * In `mm/memcontrol.c`, we have `mem_cgroup_private_id_get_online`, `mem_cgroup_from_private_id`, `__mem_cgroup_try_charge_swap`, and `__mem_cgroup_uncharge_swap` are all non-static. * In `mm/list_lru.c`, `list_lru_walk_node` is non-static. * And finally, in `mm/workingset.c`, `workingset_test_recent` is also non-static. Excellent. That's a good starting point. Next, I need to make sure the necessary kernel configurations are enabled. Specifically, I'll need `MEMCG` – the core config for memory cgroup support, enabling `mm/memcontrol.c` – and `SWAP` to enable swap support and, importantly, the swap accounting functions like `__mem_cgroup_try_charge_swap` and `__mem_cgroup_uncharge_swap`. I'll quickly double-check the dependencies. `CONFIG_MEMCG` looks straightforward, depending on nothing directly. It does, however, indirectly depend on other configs. `CONFIG_SWAP` also has its dependencies, and I'll need to scrutinize its definition in `mm/Kconfig` to be absolutely certain I've covered all the bases. This is crucial for ensuring the fuzzing environment is configured correctly and that the target functions are actually compiled into the kernel image. |
| 18/2 | 2026/09/01 19:48 | tool | grepper |
0mArgs:{
"Expression": "config SWAP",
"PathPrefix": "mm/"
}Results: {
"Output": "mm/Kconfig=9=config ARCH_NO_SWAP\n--\nmm/Kconfig-11-\nmm/Kconfig:12:menuconfig SWAP\nmm/Kconfig-13-\tbool \"Support for paging of anonymous memory (swap)\"\n"
} |
| 19/2 | 2026/09/01 19:48 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 23483 output: 207 thoughts: 56 Thoughts: **Considering Configuration Options** Okay, let's see, I need to decide if `CONFIG_MEMCG_V1` is worth including or testing alongside the main configurations. It's listed as optional, but given the critical role of `MEMCG` and `SWAP` in this area, it might be relevant. Best to include it for now to keep things thorough. Right, time to generate the outputs with `set-results` tool now. |
| 20/2 | 2026/09/01 19:48 | tool | set-results |
0mArgs:{
"EnableConfigs": [
"MEMCG",
"SWAP"
],
"FocusSymbols": [
"mem_cgroup_from_private_id",
"mem_cgroup_private_id_get_online",
"__mem_cgroup_try_charge_swap",
"__mem_cgroup_uncharge_swap",
"list_lru_walk_node",
"workingset_test_recent"
],
"Reasoning": "The patch refactors mem_cgroup private ID management, changing ownership and reference counting from mem_cgroup directly to obj_cgroup (memcgid_ref) so that private IDs reference obj_cgroup and allow proper lifetime management and reparenting during cgroup destruction and swap accounting. These are core memory management and cgroup changes that affect swap charging/uncharging, list_lru traversal, and workingset refault logic.",
"WorthFuzzing": true
}Results: {
"EnableConfigs": [
"MEMCG",
"SWAP"
],
"FocusSymbols": [
"mem_cgroup_from_private_id",
"mem_cgroup_private_id_get_online",
"__mem_cgroup_try_charge_swap",
"__mem_cgroup_uncharge_swap",
"list_lru_walk_node",
"workingset_test_recent"
],
"Reasoning": "The patch refactors mem_cgroup private ID management, changing ownership and reference counting from mem_cgroup directly to obj_cgroup (memcgid_ref) so that private IDs reference obj_cgroup and allow proper lifetime management and reparenting during cgroup destruction and swap accounting. These are core memory management and cgroup changes that affect swap charging/uncharging, list_lru traversal, and workingset refault logic.",
"WorthFuzzing": true
} |
| 21/1 | 2026/09/01 19:48 | action | If |
0mArgs:{
"WorthFuzzing": true
}Results: null |
| 22/2 | 2026/09/01 19:48 | agent | kmsan-evaluator |
0mModel:core Args: null Results: {
"KMSANReasoning": "The patch refactors the memory cgroup private ID tracking mechanism so that the private ID pins the corresponding obj_cgroup rather than the mem_cgroup CSS directly.\n\n1. Uninitialized memory analysis:\n- All modified structures (`struct obj_cgroup` and `struct mem_cgroup`) are zero-allocated using `kzalloc_obj()` and `kmem_cache_zalloc()`, and newly introduced fields (`memcgid_ref`, `id_objcg`, `id`) are explicitly initialized during allocation / online state.\n- Local variables across modified functions (`memcgid`, `objcg`, `memcg`) are initialized before being used in branching or assignments.\n- No uninitialized buffers or fields are read, branched upon, or passed to user space.\n\n2. KASAN vs KMSAN applicability:\n- The changes involve internal memory management, object lifecycle, and reference counting (refcount_t, percpu_ref, RCU, XArray).\n- Potential issues such as use-after-free, double-free, reference count imbalances, or NULL pointer dereferences are directly detectable by KASAN, refcount debugging, and standard kernel assertions.\n- KMSAN is not required as there are no uninitialized memory usage or info-leak risks.",
"NeedsKMSAN": false
}Instruction: You are an expert Linux kernel security engineer specializing in kernel memory
error detectors (KASAN and KMSAN). Your job is to review the provided patch series and
determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer)
fuzzing session in addition to standard KASAN fuzzing.
CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN:
- Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable
a comprehensive suite of debugging tools and sanitizers, including KASAN
(out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP
(locking bugs and deadlocks), UB-sanitizers, and memory corruption checks.
- KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap,
or page allocations) and kernel-to-user memory info-leaks.
Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN,
LOCKDEP, OR OTHER STANDARD BUG DETECTORS.
A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY
set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks
that are detected ONLY by KMSAN.
Look holistically at the patch series and surrounding code. Even if no direct
uninitialized field accesses or new buffer allocations are added in the diff itself,
a patch may alter control flow, bounds checking, or data length calculations in ways
that change how the rest of the code operates on existing buffers (e.g. allowing
uninitialized stack/heap memory to be read, copied to user space, or used in control
flow). Do not hesitate to use your code access tools to inspect the surrounding code,
called functions, and callers.
Set NeedsKMSAN=true ONLY IF the patch introduces or modifies:
1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb
attributes, ioctl output arguments, socket options, or BPF buffers) where fields
or structure padding might not be fully initialized/zeroed.
2. Conditional logic or branching that depends on potentially uninitialized variables
or struct fields.
3. Allocation or initialization of complex data structures where uninitialized fields
could be read later in reachable code paths.
4. Bounds checks, lengths, or logic in a way that allows surrounding code to access
uninitialized bytes of existing buffers.
Set NeedsKMSAN=false IF:
- The code changes primarily risk out-of-bounds access, array overflows, NULL pointer
dereferences, locking deadlocks, or use-after-free bugs (these are already caught
by KASAN, LOCKDEP, or standard bug detectors).
- All stack/heap structures touched or introduced by the patch are fully zeroed
or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied.
- The patch does not introduce any risk of uninitialized memory usage or info-leaks.
Use your code access tools to inspect the surrounding code if necessary, then provide
detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch.
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: For your convenience, here is the diff of the changes:
commit 5f8653600a227db799d6f3819216dbb595ecac63
Author: syz-cluster <triage@syzkaller.com>
Date: Tue Sep 1 19:46:59 2026 +0000
syz-cluster: applied patch under review
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index f227348a3f24a..eafc817ff244c 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -66,11 +66,6 @@ struct mem_cgroup_reclaim_cookie {
#define MEM_CGROUP_ID_SHIFT 16
-struct mem_cgroup_private_id {
- int id;
- refcount_t ref;
-};
-
struct memcg_vmstats_percpu;
struct memcg1_events_percpu;
struct memcg_vmstats;
@@ -173,6 +168,7 @@ struct obj_cgroup {
struct percpu_ref refcnt;
struct mem_cgroup *memcg;
atomic_t nr_charged_bytes;
+ refcount_t memcgid_ref;
union {
struct list_head list; /* protected by objcg_lock */
struct rcu_head rcu;
@@ -189,8 +185,8 @@ struct obj_cgroup {
struct mem_cgroup {
struct cgroup_subsys_state css;
- /* Private memcg ID. Used to ID objects that outlive the cgroup */
- struct mem_cgroup_private_id id;
+ /* The objcg holding private memcg ID. */
+ struct obj_cgroup *id_objcg;
/* Accounted resources */
struct page_counter memory; /* Both v1 & v2 */
@@ -255,6 +251,9 @@ struct mem_cgroup {
#endif
int kmemcg_id;
+ /* Private memcg ID. Used to ID objects that outlive the cgroup */
+ int id;
+
#ifdef CONFIG_CGROUP_WRITEBACK
struct list_head cgwb_list;
#endif
@@ -810,7 +809,7 @@ static inline unsigned short mem_cgroup_private_id(struct mem_cgroup *memcg)
if (mem_cgroup_disabled())
return 0;
- return memcg->id.id;
+ return memcg->id;
}
struct mem_cgroup *mem_cgroup_from_private_id(unsigned short id);
diff --git a/mm/list_lru.c b/mm/list_lru.c
index 36662d02ff963..bc956267f6835 100644
--- a/mm/list_lru.c
+++ b/mm/list_lru.c
@@ -428,7 +428,7 @@ unsigned long list_lru_walk_node(struct list_lru *lru, int nid,
xa_for_each(&lru->xa, index, mlru) {
rcu_read_lock();
memcg = mem_cgroup_from_private_id(index);
- if (!mem_cgroup_tryget(memcg)) {
+ if (!memcg || !mem_cgroup_tryget(memcg)) {
rcu_read_unlock();
continue;
}
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 256b68ffca70e..84dcab3acb8a2 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3773,7 +3773,7 @@ static void memcg_online_kmem(struct mem_cgroup *memcg)
static_branch_enable(&memcg_kmem_online_key);
- memcg->kmemcg_id = memcg->id.id;
+ memcg->kmemcg_id = memcg->id;
}
static void memcg_offline_kmem(struct mem_cgroup *memcg)
@@ -4032,25 +4032,65 @@ static DEFINE_XARRAY_ALLOC1(mem_cgroup_private_ids);
static void mem_cgroup_private_id_remove(struct mem_cgroup *memcg)
{
- if (memcg->id.id > 0) {
- xa_erase(&mem_cgroup_private_ids, memcg->id.id);
- memcg->id.id = 0;
+ if (memcg->id > 0) {
+ xa_erase(&mem_cgroup_private_ids, memcg->id);
+ memcg->id = 0;
}
}
-static inline void mem_cgroup_private_id_put(struct mem_cgroup *memcg, unsigned int n)
+static void __mem_cgroup_private_id_put(struct obj_cgroup *objcg,
+ unsigned short id, unsigned int n)
{
- if (refcount_sub_and_test(n, &memcg->id.ref)) {
- mem_cgroup_private_id_remove(memcg);
+ struct obj_cgroup *objcg_free;
- /* Memcg ID pins CSS */
- css_put(&memcg->css);
+ if (refcount_sub_and_test(n, &objcg->memcgid_ref)) {
+ objcg_free = xa_erase(&mem_cgroup_private_ids, id);
+ VM_WARN_ON(objcg_free != objcg);
+
+ /* Memcg ID pins the objcg */
+ obj_cgroup_put(objcg);
}
}
+/**
+ * mem_cgroup_private_id_put - put memcgid and get the nearest online memcg
+ * @id: the memcg private id got from mem_cgroup_id_get_online
+ * @n: count of references to put
+ */
+static struct mem_cgroup *mem_cgroup_private_id_put(unsigned short id, unsigned int n)
+{
+ struct mem_cgroup *memcg = NULL;
+ struct obj_cgroup *objcg;
+
+ rcu_read_lock();
+ objcg = xa_load(&mem_cgroup_private_ids, id);
+ if (unlikely(!objcg))
+ goto out;
+
+ memcg = obj_cgroup_memcg(objcg);
+ while (memcg_is_dying(memcg) || !mem_cgroup_tryget(memcg))
+ memcg = parent_mem_cgroup(memcg);
+
+ __mem_cgroup_private_id_put(objcg, id, n);
+
+out:
+ rcu_read_unlock();
+ return memcg;
+}
+
+static void mem_cgroup_private_id_kill(struct mem_cgroup *memcg)
+{
+ __mem_cgroup_private_id_put(memcg->id_objcg, memcg->id, 1);
+}
+
struct mem_cgroup *mem_cgroup_private_id_get_online(struct mem_cgroup *memcg, unsigned int n)
{
- while (!refcount_add_not_zero(n, &memcg->id.ref)) {
+ struct obj_cgroup *objcg;
+
+ rcu_read_lock();
+ objcg = memcg->id_objcg;
+
+ while (!refcount_add_not_zero(n, &objcg->memcgid_ref)) {
/*
* The root cgroup cannot be destroyed, so it's refcount must
* always be >= 1.
@@ -4060,7 +4100,10 @@ struct mem_cgroup *mem_cgroup_private_id_get_online(struct mem_cgroup *memcg, un
break;
}
memcg = parent_mem_cgroup(memcg);
+ objcg = memcg->id_objcg;
}
+
+ rcu_read_unlock();
return memcg;
}
@@ -4069,11 +4112,24 @@ struct mem_cgroup *mem_cgroup_private_id_get_online(struct mem_cgroup *memcg, un
* @id: the memcg id to look up
*
* Caller must hold rcu_read_lock().
+ *
+ * @return: the memcg, or NULL if the memcg is already reparented.
*/
struct mem_cgroup *mem_cgroup_from_private_id(unsigned short id)
{
+ struct obj_cgroup *objcg;
+ struct mem_cgroup *memcg;
WARN_ON_ONCE(!rcu_read_lock_held());
- return xa_load(&mem_cgroup_private_ids, id);
+
+ objcg = xa_load(&mem_cgroup_private_ids, id);
+ if (!objcg)
+ return NULL;
+
+ memcg = obj_cgroup_memcg(objcg);
+ if (mem_cgroup_private_id(memcg) != id)
+ return NULL;
+
+ return memcg;
}
struct mem_cgroup *mem_cgroup_get_from_id(u64 id)
@@ -4174,7 +4230,7 @@ static struct mem_cgroup *mem_cgroup_alloc(struct mem_cgroup *parent)
if (!memcg)
return ERR_PTR(-ENOMEM);
- error = xa_alloc(&mem_cgroup_private_ids, &memcg->id.id, NULL,
+ error = xa_alloc(&mem_cgroup_private_ids, &memcg->id, NULL,
XA_LIMIT(1, MEM_CGROUP_ID_MAX), GFP_KERNEL);
if (error)
goto fail;
@@ -4319,9 +4375,10 @@ static int mem_cgroup_css_online(struct cgroup_subsys_state *css)
FLUSH_TIME);
lru_gen_online_memcg(memcg);
- /* Online state pins memcg ID, memcg ID pins CSS */
- refcount_set(&memcg->id.ref, 1);
- css_get(css);
+ /* CSS pins memcg ID, memcg ID pins obj cgroup */
+ memcg->id_objcg = objcg;
+ refcount_set(&memcg->id_objcg->memcgid_ref, 1);
+ obj_cgroup_get(memcg->id_objcg);
/*
* Ensure mem_cgroup_from_private_id() works once we're fully online.
@@ -4333,7 +4390,7 @@ static int mem_cgroup_css_online(struct cgroup_subsys_state *css)
* publish it here at the end of onlining. This matches the
* regular ID destruction during offlining.
*/
- xa_store(&mem_cgroup_private_ids, memcg->id.id, memcg, GFP_KERNEL);
+ xa_store(&mem_cgroup_private_ids, memcg->id, memcg->id_objcg, GFP_KERNEL);
return 0;
free_objcg:
@@ -4385,7 +4442,7 @@ static void mem_cgroup_css_offline(struct cgroup_subsys_state *css)
drain_all_stock(memcg);
- mem_cgroup_private_id_put(memcg, 1);
+ mem_cgroup_private_id_kill(memcg);
}
static void mem_cgroup_css_released(struct cgroup_subsys_state *css)
@@ -5750,6 +5807,7 @@ int __mem_cgroup_try_charge_swap(struct folio *folio)
struct page_counter *counter;
struct mem_cgroup *memcg;
struct obj_cgroup *objcg;
+ unsigned short memcgid;
if (do_memsw_account())
return 0;
@@ -5767,22 +5825,24 @@ int __mem_cgroup_try_charge_swap(struct folio *folio)
return 0;
}
- memcg = mem_cgroup_private_id_get_online(memcg, nr_pages);
- /* memcg is pined by memcg ID. */
- rcu_read_unlock();
+ while (memcg_is_dying(memcg))
+ memcg = parent_mem_cgroup(memcg);
if (!mem_cgroup_is_root(memcg) &&
!page_counter_try_charge(&memcg->swap, nr_pages, &counter)) {
memcg_memory_event(memcg, MEMCG_SWAP_MAX);
memcg_memory_event(memcg, MEMCG_SWAP_FAIL);
- mem_cgroup_private_id_put(memcg, nr_pages);
+ rcu_read_unlock();
return -ENOMEM;
}
mod_memcg_state(memcg, MEMCG_SWAP, nr_pages);
+ memcg = mem_cgroup_private_id_get_online(memcg, nr_pages);
+ memcgid = mem_cgroup_private_id(memcg);
+ rcu_read_unlock();
+
ci = swap_cluster_get_and_lock(folio);
- __swap_cgroup_set(ci, swp_cluster_offset(folio->swap), nr_pages,
- mem_cgroup_private_id(memcg));
+ __swap_cgroup_set(ci, swp_cluster_offset(folio->swap), nr_pages, memcgid);
swap_cluster_unlock(ci);
return 0;
@@ -5798,18 +5858,23 @@ void __mem_cgroup_uncharge_swap(unsigned short id, unsigned int nr_pages)
struct mem_cgroup *memcg;
rcu_read_lock();
- memcg = mem_cgroup_from_private_id(id);
+ memcg = mem_cgroup_private_id_put(id, nr_pages);
if (memcg) {
- if (!mem_cgroup_is_root(memcg)) {
+ /*
+ * If the memcg was offline and reparented to root, swap needs
+ * uncharging as well. We check this by comparing the memcgid.
+ */
+ if (!mem_cgroup_is_root(memcg) || id != mem_cgroup_private_id(memcg)) {
if (do_memsw_account())
page_counter_uncharge(&memcg->memsw, nr_pages);
else
page_counter_uncharge(&memcg->swap, nr_pages);
}
mod_memcg_state(memcg, MEMCG_SWAP, -nr_pages);
- mem_cgroup_private_id_put(memcg, nr_pages);
}
rcu_read_unlock();
+
+ mem_cgroup_put(memcg);
}
long mem_cgroup_get_nr_swap_pages(struct mem_cgroup *memcg)
diff --git a/mm/workingset.c b/mm/workingset.c
index 7ac2b88c80ae5..4e9b7b163c01e 100644
--- a/mm/workingset.c
+++ b/mm/workingset.c
@@ -470,7 +470,7 @@ bool workingset_test_recent(void *shadow, bool file, bool *workingset,
* configurations instead.
*/
eviction_memcg = mem_cgroup_from_private_id(memcgid);
- if (!mem_cgroup_tryget(eviction_memcg))
+ if (eviction_memcg && !mem_cgroup_tryget(eviction_memcg))
eviction_memcg = NULL;
rcu_read_unlock();
|
| 23/3 | 2026/09/01 19:48 | llm | kmsan-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 6037 output: 20 thoughts: 550 Thoughts: **Analyzing the Patch for KMSAN Fuzzing Needs** Alright, let's break down this patch and figure out if it warrants a dedicated KMSAN fuzzing session. My initial thought is to assess its potential for introducing memory safety issues, specifically uninitialized memory risks. First, let's nail down what this patch actually *does*. It's messing with the memory cgroup private ID tracking mechanism, specifically in `include/linux/memcontrol.h`, `mm/list_lru.c`, `mm/memcontrol.c`, and `mm/workingset.c`. So, we're talking about core memory management here, which always piques my interest. The key changes jump out: `struct mem_cgroup_private_id` is gone. Instead, `struct obj_cgroup` gets a `refcount_t memcgid_ref`, and `struct mem_cgroup` is getting a `struct obj_cgroup *id_objcg;` and an `int id;`. There are also a couple of null checks in `mm/list_lru.c` and `mm/workingset.c`. We're getting some new functions in `mm/memcontrol.c` for managing the private IDs and their refcounting, and modifications in related functions like `mem_cgroup_alloc`, `mem_cgroup_css_online`, `mem_cgroup_css_offline`, etc. Plus, it touches `__mem_cgroup_try_charge_swap` and `__mem_cgroup_uncharge_swap`. That's a good amount of churn! Now, the important part: Does this patch introduce or modify anything that could lead to uninitialized memory being exposed? Let's go through the checklist. 1. **User-space exposure:** Nope, no direct copying of kernel structures to user space via things like `copy_to_user`, netlink, ioctls, or anything else that comes to mind. That's a relief. 2. **Conditional logic and uninitialized variables:** Okay, this is where it gets interesting. With all this struct manipulation, I need to focus on structure allocation, initialization, and how these new structures interact with existing code, especially the new `obj_cgroup`. It's possible uninitialized memory could be used in a conditional. I need to specifically look at how `struct obj_cgroup` is allocated. Let's do a quick search in the kernel tree. |
| 24/3 | 2026/09/01 19:49 | tool | grepper |
0mArgs:{
"Expression": "obj_cgroup_alloc"
}Results: {
"Output": "mm/memcontrol.c=149=static void obj_cgroup_release(struct percpu_ref *ref)\n--\nmm/memcontrol.c-195-\nmm/memcontrol.c:196:static struct obj_cgroup *obj_cgroup_alloc(void)\nmm/memcontrol.c-197-{\n--\nmm/memcontrol.c=4343=static int mem_cgroup_css_online(struct cgroup_subsys_state *css)\n--\nmm/memcontrol.c-4359-\tfor_each_node(nid) {\nmm/memcontrol.c:4360:\t\tobjcg = obj_cgroup_alloc();\nmm/memcontrol.c-4361-\t\tif (!objcg)\n"
} |
| 25/3 | 2026/09/01 19:49 | llm | kmsan-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 7339 output: 34 thoughts: 21 Thoughts: Here's a first-person summary, tailored for an expert audience, as requested: **Diving into obj_cgroup_alloc** Okay, time to get into the weeds of `mm/memcontrol.c` and specifically, let's dissect `obj_cgroup_alloc`. I need to refresh my memory on exactly how these object cgroups are handled, especially since we've been seeing some interesting behavior recently. I'm assuming, as usual, it's not a trivial allocation, and there will be some interesting interactions with the core memory management. I'll be looking for any potential contention points, any subtle inefficiencies in the allocation strategy itself, or anything that might lead to unexpected memory pressure scenarios. Knowing my luck, there’ll be some tricky pointer arithmetic in there too... looking forward to it. It's time to dig in. |
| 26/3 | 2026/09/01 19:49 | tool | read-file |
0mArgs:{
"File": "mm/memcontrol.c",
"FirstLine": 190,
"LineCount": 25
}Results: {
"Contents": " 190:\t\tspin_unlock_irqrestore(\u0026objcg_lock, flags);\n 191:\t\n 192:\t\tpercpu_ref_exit(ref);\n 193:\t\tkfree_rcu(objcg, rcu);\n 194:\t}\n 195:\t\n 196:\tstatic struct obj_cgroup *obj_cgroup_alloc(void)\n 197:\t{\n 198:\t\tstruct obj_cgroup *objcg;\n 199:\t\tint ret;\n 200:\t\n 201:\t\tobjcg = kzalloc_obj(struct obj_cgroup);\n 202:\t\tif (!objcg)\n 203:\t\t\treturn NULL;\n 204:\t\n 205:\t\tret = percpu_ref_init(\u0026objcg-\u003erefcnt, obj_cgroup_release, 0,\n 206:\t\t\t\t GFP_KERNEL);\n 207:\t\tif (ret) {\n 208:\t\t\tkfree(objcg);\n 209:\t\t\treturn NULL;\n 210:\t\t}\n 211:\t\tINIT_LIST_HEAD(\u0026objcg-\u003elist);\n 212:\t\treturn objcg;\n 213:\t}\n 214:\t\n"
} |
| 27/3 | 2026/09/01 19:49 | llm | kmsan-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 7912 output: 35 thoughts: 84 Thoughts: **Analyzing Memory Accounting in Control Groups** Okay, so I'm looking at how memory control groups, or `memcg`s, are initialized, specifically the reference counting. It seems like `objcg` is being allocated using `kzalloc_obj`, which is pretty standard and zero-initializes everything within that struct, including the memory region. Then, the critical part jumps out at me in `mem_cgroup_css_online`: we explicitly initialize `memcgid_ref` with `refcount_set` and set it to 1. This is a deliberate initialization, rather than a reliance on `kzalloc`. Now, the important question is why is that required? To answer that, I need to understand how the allocation works. I should check `mem_cgroup_alloc` to see if there is something else interesting happening there. I’m thinking there might be something important happening in there that I’m missing that is related to the reference counter. Perhaps there's an earlier interaction that I need to know about. |
| 28/3 | 2026/09/01 19:49 | tool | read-file |
0mArgs:{
"File": "mm/memcontrol.c",
"FirstLine": 4215,
"LineCount": 40
}Results: {
"Contents": "4215:\t\tlru_gen_exit_memcg(memcg);\n4216:\t\tmemcg_wb_domain_exit(memcg);\n4217:\t\t__mem_cgroup_free(memcg);\n4218:\t}\n4219:\t\n4220:\tstatic struct mem_cgroup *mem_cgroup_alloc(struct mem_cgroup *parent)\n4221:\t{\n4222:\t\tstruct memcg_vmstats_percpu *statc;\n4223:\t\tstruct memcg_vmstats_percpu __percpu *pstatc_pcpu;\n4224:\t\tstruct mem_cgroup *memcg;\n4225:\t\tint node, cpu;\n4226:\t\tint __maybe_unused i;\n4227:\t\tlong error;\n4228:\t\n4229:\t\tmemcg = kmem_cache_zalloc(memcg_cachep, GFP_KERNEL);\n4230:\t\tif (!memcg)\n4231:\t\t\treturn ERR_PTR(-ENOMEM);\n4232:\t\n4233:\t\terror = xa_alloc(\u0026mem_cgroup_private_ids, \u0026memcg-\u003eid, NULL,\n4234:\t\t\t\t XA_LIMIT(1, MEM_CGROUP_ID_MAX), GFP_KERNEL);\n4235:\t\tif (error)\n4236:\t\t\tgoto fail;\n4237:\t\terror = -ENOMEM;\n4238:\t\n4239:\t\tmemcg-\u003evmstats = kzalloc_obj(struct memcg_vmstats, GFP_KERNEL_ACCOUNT);\n4240:\t\tif (!memcg-\u003evmstats)\n4241:\t\t\tgoto fail;\n4242:\t\n4243:\t\tmemcg-\u003evmstats_percpu = alloc_percpu_gfp(struct memcg_vmstats_percpu,\n4244:\t\t\t\t\t\t\t GFP_KERNEL_ACCOUNT);\n4245:\t\tif (!memcg-\u003evmstats_percpu)\n4246:\t\t\tgoto fail;\n4247:\t\n4248:\t\tif (!memcg1_alloc_events(memcg))\n4249:\t\t\tgoto fail;\n4250:\t\n4251:\t\tpstatc_pcpu = parent ? parent-\u003evmstats_percpu : NULL;\n4252:\t\tfor_each_possible_cpu(cpu) {\n4253:\t\t\tstatc = per_cpu_ptr(memcg-\u003evmstats_percpu, cpu);\n4254:\t\t\tstatc-\u003eparent_pcpu = pstatc_pcpu;\n"
} |
| 29/3 | 2026/09/01 19:49 | llm | kmsan-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 8916 output: 295 thoughts: 474 Thoughts: **KMSAN Assessment: No Uninitialized Memory Risks Detected** Okay, let's break this down. My initial scan of the code strongly suggests KMSAN isn't necessary here. I've reviewed the core allocation, variable initialization, and data flow and, as I suspected, everything looks clean from an uninitialized memory perspective. Specifically, I see `memcg` instances are allocated with `kmem_cache_zalloc`, ensuring zero-initialization. All the critical variables within the functions being modified, like `__mem_cgroup_try_charge_swap`, are locally declared and initialized before use. I've also confirmed there aren't any kernel-to-user space copies that could inadvertently leak data. The entire scope of the patch seems limited to internal `memcg` refcounting, ID management using XArray, lifecycle tracking for `obj_cgroup` and `mem_cgroup` structures, and swap/LRU charging. The changes primarily revolve around correctly managing the reference counts and IDs and pinning the `obj_cgroup`. Given the nature of the modifications, any potential issues would likely stem from reference counting errors (UAFs, double frees, leaks), NULL pointer dereferences, or locking bugs. These are all the kinds of things that the standard kernel debug tools – KASAN, LOCKDEP, and `refcount_t` checks – are specifically designed to catch. I don't see anything here that KMSAN would add value to. I've also done a deep dive on the specific code changes: * The modifications to `include/linux/memcontrol.h` involve `struct obj_cgroup` (adding `refcount_t memcgid_ref`), `struct mem_cgroup` (adding `id_objcg`, replacing struct with `int id`), and the inline function `mem_cgroup_private_id`. * A `!memcg ||` check has been added to `mm/list_lru.c`. * Significant refactoring of memcg private ID allocation and refcounting logic to pin `obj_cgroup` instead of `memcg->css` has been done in `mm/memcontrol.c`. * A `null` check `eviction_memcg &&` has been added to `mm/workingset.c`. A quick analysis of those code modifications confirm the code is not introducing any uninitialized memory risks. With that in mind, I'm comfortable preparing the call to `set-results`. |
| 30/3 | 2026/09/01 19:49 | tool | set-results |
0mArgs:{
"KMSANReasoning": "The patch refactors the memory cgroup private ID tracking mechanism so that the private ID pins the corresponding obj_cgroup rather than the mem_cgroup CSS directly.\n\n1. Uninitialized memory analysis:\n- All modified structures (`struct obj_cgroup` and `struct mem_cgroup`) are zero-allocated using `kzalloc_obj()` and `kmem_cache_zalloc()`, and newly introduced fields (`memcgid_ref`, `id_objcg`, `id`) are explicitly initialized during allocation / online state.\n- Local variables across modified functions (`memcgid`, `objcg`, `memcg`) are initialized before being used in branching or assignments.\n- No uninitialized buffers or fields are read, branched upon, or passed to user space.\n\n2. KASAN vs KMSAN applicability:\n- The changes involve internal memory management, object lifecycle, and reference counting (refcount_t, percpu_ref, RCU, XArray).\n- Potential issues such as use-after-free, double-free, reference count imbalances, or NULL pointer dereferences are directly detectable by KASAN, refcount debugging, and standard kernel assertions.\n- KMSAN is not required as there are no uninitialized memory usage or info-leak risks.",
"NeedsKMSAN": false
}Results: {
"KMSANReasoning": "The patch refactors the memory cgroup private ID tracking mechanism so that the private ID pins the corresponding obj_cgroup rather than the mem_cgroup CSS directly.\n\n1. Uninitialized memory analysis:\n- All modified structures (`struct obj_cgroup` and `struct mem_cgroup`) are zero-allocated using `kzalloc_obj()` and `kmem_cache_zalloc()`, and newly introduced fields (`memcgid_ref`, `id_objcg`, `id`) are explicitly initialized during allocation / online state.\n- Local variables across modified functions (`memcgid`, `objcg`, `memcg`) are initialized before being used in branching or assignments.\n- No uninitialized buffers or fields are read, branched upon, or passed to user space.\n\n2. KASAN vs KMSAN applicability:\n- The changes involve internal memory management, object lifecycle, and reference counting (refcount_t, percpu_ref, RCU, XArray).\n- Potential issues such as use-after-free, double-free, reference count imbalances, or NULL pointer dereferences are directly detectable by KASAN, refcount debugging, and standard kernel assertions.\n- KMSAN is not required as there are no uninitialized memory usage or info-leak risks.",
"NeedsKMSAN": false
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|