From nobody Tue Sep 29 01:17:50 2026 Received: from mta0.migadu.com (out-169.mta0.migadu.com [91.218.175.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E0A312EEE84 for ; Fri, 14 Aug 2026 01:29:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.169 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786670999; cv=none; b=ozec2nFW4pYbyvy9/wigDFjvNJ2CkNoXakY5bHEldCMn+lGHYO1O9QPH3BcaG8RlNFYbSsvrLqCnAfibNzqWH1mnX53/xPIBFJGtz7hEJbdu1yO6etpTXLFLMffj8fHd6kQxFlPmkGGq1TnWZnoEWmEpbJfTSWVlz6Z1L7vSXYU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786670999; c=relaxed/simple; bh=YRIK/awmx71exiVOjlgX7attdFmpDuckcomywEMtZlw=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=FlrhFU1JpqJa0DNIm2aLaHaAqKcAEYPHleWs4YnPUxIzOeRPUMvX4/m5EqcmHMpv3GicpkWlCXm7K/Mbmkv78E641qnBaq7qucuk2Gblp+MBOa5BDvFMun27jLYye24FLwkXRi2nm1PisvKSVEcgs7GBKx43CBOOfqZNxyAuG3c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=umpg/rpQ; arc=none smtp.client-ip=91.218.175.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="umpg/rpQ" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=YRIK/awmx71exiVOjlgX7attdFmpDuckcomywEMtZlw=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1786670988; v=1; x=1787275788; b=umpg/rpQ0RnezST5AyWEhNrlGcp9Ihpe2PksMoQcWQDlXU4R8wBA/WB1e+ajFOSZkEjI3oPW 7Iww2O7O1qIoVY0nTOABHu0X/YM44axR0fC36fO1MBpC7acU3Zg1tf04P8K2+vl/bpDcI6fm+AI Sx8Mh1hddQEV5PGthp5Dx/oo= X-Envelope-To: linux-kernel@vger.kernel.org Received: from mi-ThinkCentre-M760t.mioffice.cn (14.29.108.92) by smtp.migadu.com with ESMTPS id bbd37d40f1c9974b; Fri, 14 Aug 2026 01:29:48 +0000 X-Migadu-Flow: FLOW_OUT From: Ridong Chen To: Johannes Weiner , Michal Hocko , Roman Gushchin , Shakeel Butt , Andrew Morton Cc: Muchun Song , Tejun Heo , David Finkel , =?UTF-8?q?Michal=20Koutn=C3=BD?= , cgroups@vger.kernel.org (open list:CONTROL GROUP - MEMORY RESOURCE CONTROLLER (MEMCG)), linux-mm@kvack.org (open list:CONTROL GROUP - MEMORY RESOURCE CONTROLLER (MEMCG)), linux-kernel@vger.kernel.org, Tao Cui , Ridong Chen , Ridong Chen Subject: [PATCH v3 1/2] memcg: acquire peaks_lock when reading memory.peak Date: Fri, 14 Aug 2026 09:29:23 +0800 Message-Id: <20260814012924.2388613-2-ridong.chen@linux.dev> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260814012924.2388613-1-ridong.chen@linux.dev> References: <20260814012924.2388613-1-ridong.chen@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Ridong Chen Sashiko reported that a reader can transiently observe a lower peak within a race window [1]. peak_show() returns max(local_watermark, ofp->value), but peak_write() updates those two under peaks_lock while the reader takes no lock. The interleaving is: writer (reset on fd A) reader (fd B) ---------------------- ------------- usage =3D page_counter_read(pc) WRITE_ONCE(local_watermark, usage) // watermark lowered to usage lw =3D READ_ONCE(local_watermark) // sees the lowered usage val =3D READ_ONCE(ofp->value) // B's value not updated yet return max(lw, val) // both low -> low peak WRITE_ONCE(peer_ctx->value, usage) // B updated, but too late Fix it by acquiring peaks_lock when reading the peak, so the reader sees a consistent snapshot of local_watermark and the per-fd values. The same race applies to memory.swap.peak, which shares peaks_lock and the peak_write() path, so take the lock there as well. [1] https://sashiko.dev/#/patchset/20260730115314.1069089-1-ridong.chen@lin= ux.dev?part=3D1 Fixes: c6f53ed8f213 ("mm, memcg: cg2 memory{.swap,}.peak write handlers") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Ridong Chen Acked-by: Johannes Weiner Acked-by: Shakeel Butt --- mm/memcontrol.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 17da1f43b7d3..6dd8756870ff 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -4713,8 +4713,13 @@ static int peak_show(struct seq_file *sf, void *v, s= truct page_counter *pc) static int memory_peak_show(struct seq_file *sf, void *v) { struct mem_cgroup *memcg =3D mem_cgroup_from_css(seq_css(sf)); + int ret; =20 - return peak_show(sf, v, &memcg->memory); + spin_lock(&memcg->peaks_lock); + ret =3D peak_show(sf, v, &memcg->memory); + spin_unlock(&memcg->peaks_lock); + + return ret; } =20 static int peak_open(struct kernfs_open_file *of) @@ -5858,8 +5863,13 @@ static u64 swap_current_read(struct cgroup_subsys_st= ate *css, static int swap_peak_show(struct seq_file *sf, void *v) { struct mem_cgroup *memcg =3D mem_cgroup_from_css(seq_css(sf)); + int ret; =20 - return peak_show(sf, v, &memcg->swap); + spin_lock(&memcg->peaks_lock); + ret =3D peak_show(sf, v, &memcg->swap); + spin_unlock(&memcg->peaks_lock); + + return ret; } =20 static ssize_t swap_peak_write(struct kernfs_open_file *of, char *buf, --=20 2.34.1 From nobody Tue Sep 29 01:17:50 2026 Received: from mta1.migadu.com (out-199.mta1.migadu.com [95.215.58.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8E0E034750D for ; Fri, 14 Aug 2026 01:30:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.199 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786671013; cv=none; b=mVjQk0NZ+HxFidBVJgKmfEUwfVp1naevbxF7wxfS1colZok1Djlv2qRxl6GQ99m1PT/FkR6Ml3bUXBJGvo1KPWYaFmcD7pqwsJH9vrmCWe0rwVhWZMqlZ+ecD03QAC3voN1cqvoB6XE1T+X5YEnlTyivb7SRfHskErcPQIoiMsI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786671013; c=relaxed/simple; bh=mJVpl+4xZO80M/OyNFMbUx08bRvBm8AGaGXAAVqZKA8=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=UcBHZhzPF28AxUdOdZa9MBZVsQSWiM2TLRTkdTO7RmOfHZey2Pe1Ex+z6qJYt8sGK/PLjSfoy0ypM4BfXyncI3u98l3EbOE80FN/ujqziuEBScfoLPzycbHnjQ4e8t6vuTsrwPF6AC7Nk2IE6j2YScDPwFuRYqMsH9+SedD0dZg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=DY1hXoZ6; arc=none smtp.client-ip=95.215.58.199 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="DY1hXoZ6" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=mJVpl+4xZO80M/OyNFMbUx08bRvBm8AGaGXAAVqZKA8=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1786670996; v=1; x=1787275796; b=DY1hXoZ6vTmcsBXsYod4ZqC5V+KXAxrFf57kesxFOQRMAENF5GuaCE468aJspN4VQLLlo+Ap Jr55opKuLFMIdV0AsWfgBLpWHaQjZ8ZecWNZs2GpwEy5+/20NvtaFm7xValiZLcPgy6Y/+9RJuV GtsLoq8sF0YTHVmmZx+SwOzg= X-Envelope-To: linux-kernel@vger.kernel.org Received: from mi-ThinkCentre-M760t.mioffice.cn (14.29.108.92) by smtp.migadu.com with ESMTPS id b69033f2e9e602e1; Fri, 14 Aug 2026 01:29:56 +0000 X-Migadu-Flow: FLOW_OUT From: Ridong Chen To: Johannes Weiner , Michal Hocko , Roman Gushchin , Shakeel Butt , Andrew Morton Cc: Muchun Song , Tejun Heo , David Finkel , =?UTF-8?q?Michal=20Koutn=C3=BD?= , cgroups@vger.kernel.org (open list:CONTROL GROUP - MEMORY RESOURCE CONTROLLER (MEMCG)), linux-mm@kvack.org (open list:CONTROL GROUP - MEMORY RESOURCE CONTROLLER (MEMCG)), linux-kernel@vger.kernel.org, Tao Cui , Ridong Chen , Ridong Chen Subject: [PATCH v3 2/2] mm, memcg: fix memory.peak reset clobbering other fds' watermark Date: Fri, 14 Aug 2026 09:29:24 +0800 Message-Id: <20260814012924.2388613-3-ridong.chen@linux.dev> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260814012924.2388613-1-ridong.chen@linux.dev> References: <20260814012924.2388613-1-ridong.chen@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Ridong Chen Writing to memory.peak resets the peak for that fd only. Each fd is a watcher and reads back max(its own value, the shared local_watermark). peak_write() resets by lowering local_watermark to the current usage. To keep the other watchers' peaks it then walks the watcher list, but it stores the current usage into them instead of the old watermark. So once usage has dropped from a peak, a reset on one fd wrongly drags every other fd's peak down too, even fds that never reset. Reproduced on 7.2.0-rc5-next under QEMU, two fds A and B on one cgroup: B sees the peak (410624 KB), usage drops, then A resets -- and B's peak collapses to 1060 KB although B never reset. With this patch B keeps reading 410624 KB. Fix: save the old watermark before lowering it and use that to floor the other watchers, so a reset only affects the fd that issued it. Fixes: c6f53ed8f213 ("mm, memcg: cg2 memory{.swap,}.peak write handlers") Closes: https://sashiko.dev/#/patchset/20260807090000.1532495-1-ridong.chen= @linux.dev Assisted-by: Claude:claude-opus-4-8 Acked-by: Tao Cui Acked-by: Johannes Weiner Signed-off-by: Ridong Chen --- mm/memcontrol.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 6dd8756870ff..5e5edc988119 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -4748,7 +4748,7 @@ static ssize_t peak_write(struct kernfs_open_file *of= , char *buf, size_t nbytes, loff_t off, struct page_counter *pc, struct list_head *watchers) { - unsigned long usage; + unsigned long usage, old_watermark; struct cgroup_of_peak *peer_ctx; struct mem_cgroup *memcg =3D mem_cgroup_from_css(of_css(of)); struct cgroup_of_peak *ofp =3D of_peak(of); @@ -4756,11 +4756,12 @@ static ssize_t peak_write(struct kernfs_open_file *= of, char *buf, size_t nbytes, spin_lock(&memcg->peaks_lock); =20 usage =3D page_counter_read(pc); + old_watermark =3D READ_ONCE(pc->local_watermark); WRITE_ONCE(pc->local_watermark, usage); =20 list_for_each_entry(peer_ctx, watchers, list) - if (usage > peer_ctx->value) - WRITE_ONCE(peer_ctx->value, usage); + if (peer_ctx !=3D ofp && old_watermark > peer_ctx->value) + WRITE_ONCE(peer_ctx->value, old_watermark); =20 /* initial write, register watcher */ if (ofp->value =3D=3D OFP_PEAK_UNSET) --=20 2.34.1