From nobody Fri Apr 3 01:22:48 2026 Received: from out-170.mta0.migadu.com (out-170.mta0.migadu.com [91.218.175.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 35F813A63EB for ; Wed, 25 Mar 2026 14:14:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774448046; cv=none; b=FDX8mqPYP4t/jckEStjPHDcSbINZHAiMyIdvG6cLQimBBWHFHfPkZeSUNkWaxSWlSbVUjeXNABXHx5t7MzyPVhqpM4+oK1ddOnIeTQvMcTAIQ2mPnOWeMBex9kfV5L758iMP3+cfNFJlB/O1PiNb0qgrKYqfRJYfOkg4RZXsK0E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774448046; c=relaxed/simple; bh=2BH2uSjgXEyAB8uNC4bXBUtJIdrnB7eiL57E7Pco7kU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=d8dqUEvpQkx2Cit5lwSaFmKlaLyWOie1mmdkwqDkqD455/NdeyMn9ULgVq3qkiZzY/kPaIVUWg02Fykxfl6rWLR1oNA//UfQtUvnb8Ic+zdOBq5335kC3kK0hKGo9gygngWdZJsYrRILI1Ucc0zVtcI4srhLmkxdAVO/ywGAjFc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=mpnBZ0C6; arc=none smtp.client-ip=91.218.175.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="mpnBZ0C6" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1774448043; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=unxX+YCaGOR4hMqvOj24eLc6KtUp2XUHiBihi+jpnkM=; b=mpnBZ0C6cRs98GwpxSR2ONoc2LqnKnFzoIwX0CLtPwEVxLHw5GMlQ9nhNT+CDUNCR1jFkO OtCAl7FFMI/9yUQgxx5N1xcQtVlah9thpFUIGS2TjReEE17oFpVkupBqaDxiagMKeLZSTT VVVnZ5Fiwi4DCrTZeR56zpikeDPY4Bc= From: Qi Zheng To: hannes@cmpxchg.org, hughd@google.com, mhocko@suse.com, roman.gushchin@linux.dev, shakeel.butt@linux.dev, muchun.song@linux.dev, david@kernel.org, ljs@kernel.org, ziy@nvidia.com, harry.yoo@oracle.com, yosry.ahmed@linux.dev, imran.f.khan@oracle.com, kamalesh.babulal@oracle.com, axelrasmussen@google.com, yuanchu@google.com, weixugc@google.com, chenridong@huaweicloud.com, mkoutny@suse.com, akpm@linux-foundation.org, hamzamahfooz@linux.microsoft.com, apais@linux.microsoft.com, lance.yang@linux.dev, bhe@redhat.com, usamaarif642@gmail.com Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Qi Zheng Subject: [PATCH v2 1/4] mm: memcontrol: correct the type of stats_updates to unsigned long Date: Wed, 25 Mar 2026 22:13:22 +0800 Message-ID: <158fa0b1296168047342f02050e9d2bda6888d27.1774447069.git.zhengqi.arch@bytedance.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" From: Qi Zheng The memcg_rstat_updated() tracks updates for vmstats_percpu->state and lruvec_stats_percpu->state. Since these state values are of type long, change the val parameter passed to memcg_rstat_updated() to long as well. Correspondingly, change the type of stats_updates in struct memcg_vmstats_percpu and struct memcg_vmstats from unsigned int and atomic_t to unsigned long and atomic_long_t respectively to prevent potential overflow when handling large state updates during the reparenting of LRU folios. Signed-off-by: Qi Zheng Reviewed-by: Lorenzo Stoakes (Oracle) --- mm/memcontrol.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index a47fb68dd65f1..7fb9cbc10dfbb 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -608,7 +608,7 @@ static inline int memcg_events_index(enum vm_event_item= idx) =20 struct memcg_vmstats_percpu { /* Stats updates since the last flush */ - unsigned int stats_updates; + unsigned long stats_updates; =20 /* Cached pointers for fast iteration in memcg_rstat_updated() */ struct memcg_vmstats_percpu __percpu *parent_pcpu; @@ -639,7 +639,7 @@ struct memcg_vmstats { unsigned long events_pending[NR_MEMCG_EVENTS]; =20 /* Stats updates since the last flush */ - atomic_t stats_updates; + atomic_long_t stats_updates; }; =20 /* @@ -665,16 +665,16 @@ static u64 flush_last_time; =20 static bool memcg_vmstats_needs_flush(struct memcg_vmstats *vmstats) { - return atomic_read(&vmstats->stats_updates) > + return atomic_long_read(&vmstats->stats_updates) > MEMCG_CHARGE_BATCH * num_online_cpus(); } =20 -static inline void memcg_rstat_updated(struct mem_cgroup *memcg, int val, +static inline void memcg_rstat_updated(struct mem_cgroup *memcg, long val, int cpu) { struct memcg_vmstats_percpu __percpu *statc_pcpu; struct memcg_vmstats_percpu *statc; - unsigned int stats_updates; + unsigned long stats_updates; =20 if (!val) return; @@ -697,7 +697,7 @@ static inline void memcg_rstat_updated(struct mem_cgrou= p *memcg, int val, continue; =20 stats_updates =3D this_cpu_xchg(statc_pcpu->stats_updates, 0); - atomic_add(stats_updates, &statc->vmstats->stats_updates); + atomic_long_add(stats_updates, &statc->vmstats->stats_updates); } } =20 @@ -705,7 +705,7 @@ static void __mem_cgroup_flush_stats(struct mem_cgroup = *memcg, bool force) { bool needs_flush =3D memcg_vmstats_needs_flush(memcg->vmstats); =20 - trace_memcg_flush_stats(memcg, atomic_read(&memcg->vmstats->stats_updates= ), + trace_memcg_flush_stats(memcg, atomic_long_read(&memcg->vmstats->stats_up= dates), force, needs_flush); =20 if (!force && !needs_flush) @@ -4406,8 +4406,8 @@ static void mem_cgroup_css_rstat_flush(struct cgroup_= subsys_state *css, int cpu) } WRITE_ONCE(statc->stats_updates, 0); /* We are in a per-cpu loop here, only do the atomic write once */ - if (atomic_read(&memcg->vmstats->stats_updates)) - atomic_set(&memcg->vmstats->stats_updates, 0); + if (atomic_long_read(&memcg->vmstats->stats_updates)) + atomic_long_set(&memcg->vmstats->stats_updates, 0); } =20 static void mem_cgroup_fork(struct task_struct *task) --=20 2.20.1 From nobody Fri Apr 3 01:22:48 2026 Received: from out-170.mta0.migadu.com (out-170.mta0.migadu.com [91.218.175.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 15A8C3DDDA4 for ; Wed, 25 Mar 2026 14:14:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774448056; cv=none; b=kzelqnUE9PTclOUSIZ76Nl3F2kTddk/5Qyr5AocN7PphI8VdhyydB0XSM9CbisIkiwBvvpbmAo/kq08NozQXjSaSSzPqnEHdMcQPRUaVyKy5EBUPwENQoVBz33sc0HBxcnzdYJJ6pGnF9LAM2hBYR9ZxLwU1L705scC2Fko0LaE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774448056; c=relaxed/simple; bh=EYMxUsulYmcylgLOM4svUTJQAEsUTZhkeAj4esJy/cs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=BtPMCyRzaGY3h0aVZwzMZJRLIDTMoRB4EWfb2Y5uXVb4CdM886VsfU+uQii8CP6Pf+zg9Vp7WlG1Ql4wPY8/JzqT/9t6EusJiNFNMsaha0IRsUjqOil/Agv7fTh5gSuKecvsJu2bLEcSLU3QwyvpQFQm0qkFY1M5zct93eEKAF4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=H7cVHfis; arc=none smtp.client-ip=91.218.175.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="H7cVHfis" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1774448053; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=fUxL3aCWfBrV4Mh30s4f7F0Tm+DKPzxkGVhhwaaaROg=; b=H7cVHfisxoDodyEGI1H7uAcKULR+QbHbPyERexScdsEjhh8gOA6XneHqYCAAZKremhK9uy fmUBs9uAhFH777GqGsKo2ESInqi/hjOyyMFPzPk9qtVPadoIAVGs/I2j/qcEEEkmtvWk6b A77LKX2euCL8bOjJtA5r4W0FkHxQ3/g= From: Qi Zheng To: hannes@cmpxchg.org, hughd@google.com, mhocko@suse.com, roman.gushchin@linux.dev, shakeel.butt@linux.dev, muchun.song@linux.dev, david@kernel.org, ljs@kernel.org, ziy@nvidia.com, harry.yoo@oracle.com, yosry.ahmed@linux.dev, imran.f.khan@oracle.com, kamalesh.babulal@oracle.com, axelrasmussen@google.com, yuanchu@google.com, weixugc@google.com, chenridong@huaweicloud.com, mkoutny@suse.com, akpm@linux-foundation.org, hamzamahfooz@linux.microsoft.com, apais@linux.microsoft.com, lance.yang@linux.dev, bhe@redhat.com, usamaarif642@gmail.com Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Qi Zheng Subject: [PATCH v2 2/4] mm: memcontrol: change val type to long in __mod_memcg_{lruvec_}state() Date: Wed, 25 Mar 2026 22:13:23 +0800 Message-ID: <5c42058df0e52a4698da005e502deb2fae7bf819.1774447069.git.zhengqi.arch@bytedance.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" From: Qi Zheng The __mod_memcg_state() and __mod_memcg_lruvec_state() functions are also used to reparent non-hierarchical stats. In this scenario, the values passed to them are accumulated statistics that might be extremely large and exceed the upper limit of a 32-bit integer. Change the val parameter type from int to long in these functions and their corresponding tracepoints (memcg_rstat_stats) to prevent potential overflow issues. Signed-off-by: Qi Zheng Reviewed-by: Lorenzo Stoakes (Oracle) --- include/trace/events/memcg.h | 10 +++++----- mm/memcontrol.c | 8 ++++---- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/include/trace/events/memcg.h b/include/trace/events/memcg.h index dfe2f51019b4c..51b62c5931fc2 100644 --- a/include/trace/events/memcg.h +++ b/include/trace/events/memcg.h @@ -11,14 +11,14 @@ =20 DECLARE_EVENT_CLASS(memcg_rstat_stats, =20 - TP_PROTO(struct mem_cgroup *memcg, int item, int val), + TP_PROTO(struct mem_cgroup *memcg, int item, long val), =20 TP_ARGS(memcg, item, val), =20 TP_STRUCT__entry( __field(u64, id) __field(int, item) - __field(int, val) + __field(long, val) ), =20 TP_fast_assign( @@ -27,20 +27,20 @@ DECLARE_EVENT_CLASS(memcg_rstat_stats, __entry->val =3D val; ), =20 - TP_printk("memcg_id=3D%llu item=3D%d val=3D%d", + TP_printk("memcg_id=3D%llu item=3D%d val=3D%ld", __entry->id, __entry->item, __entry->val) ); =20 DEFINE_EVENT(memcg_rstat_stats, mod_memcg_state, =20 - TP_PROTO(struct mem_cgroup *memcg, int item, int val), + TP_PROTO(struct mem_cgroup *memcg, int item, long val), =20 TP_ARGS(memcg, item, val) ); =20 DEFINE_EVENT(memcg_rstat_stats, mod_memcg_lruvec_state, =20 - TP_PROTO(struct mem_cgroup *memcg, int item, int val), + TP_PROTO(struct mem_cgroup *memcg, int item, long val), =20 TP_ARGS(memcg, item, val) ); diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 7fb9cbc10dfbb..4a78550f6174e 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -527,7 +527,7 @@ unsigned long lruvec_page_state_local(struct lruvec *lr= uvec, =20 #ifdef CONFIG_MEMCG_V1 static void __mod_memcg_lruvec_state(struct mem_cgroup_per_node *pn, - enum node_stat_item idx, int val); + enum node_stat_item idx, long val); =20 void reparent_memcg_lruvec_state_local(struct mem_cgroup *memcg, struct mem_cgroup *parent, int idx) @@ -784,7 +784,7 @@ static int memcg_page_state_unit(int item); * Normalize the value passed into memcg_rstat_updated() to be in pages. R= ound * up non-zero sub-page updates to 1 page as zero page updates are ignored. */ -static int memcg_state_val_in_pages(int idx, int val) +static long memcg_state_val_in_pages(int idx, long val) { int unit =3D memcg_page_state_unit(idx); =20 @@ -831,7 +831,7 @@ static inline void get_non_dying_memcg_end(void) #endif =20 static void __mod_memcg_state(struct mem_cgroup *memcg, - enum memcg_stat_item idx, int val) + enum memcg_stat_item idx, long val) { int i =3D memcg_stats_index(idx); int cpu; @@ -896,7 +896,7 @@ void reparent_memcg_state_local(struct mem_cgroup *memc= g, #endif =20 static void __mod_memcg_lruvec_state(struct mem_cgroup_per_node *pn, - enum node_stat_item idx, int val) + enum node_stat_item idx, long val) { struct mem_cgroup *memcg =3D pn->memcg; int i =3D memcg_stats_index(idx); --=20 2.20.1 From nobody Fri Apr 3 01:22:48 2026 Received: from out-181.mta0.migadu.com (out-181.mta0.migadu.com [91.218.175.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E552E2BD5A8 for ; Wed, 25 Mar 2026 14:14:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.181 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774448067; cv=none; b=tef6X2jYeRNh3WyjmcipXV4KlAT2RqVEs/VNRtUBbOUDxjce/eKCaff05meRI3/j2elAVZhOi+hcOIS3Kf7/cI8nuMcmolOp1EL3U4kFzwy+FOGRoMnHfx75rMM4nBUFEbX3OxVBtPI6PytRmHqRS8WKIUnNR+whvYcmOnY46lQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774448067; c=relaxed/simple; bh=tRboF4s/sr+/rWnt4uHwHTDd65vHsItiZEkea8O8E6E=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=RT8lax2jvumCtDR7DNanLeKV7Kiyu81CQ6VKa+0iRchmCcHSVvmO6ZeXBx6+OkmHT5ge2sZ5YjQW+nRWByvFV7ygpcKGt3Wb1V0BUsGIMRGaTX+vdCFq06LL7z/8Ws4D3uYv8jU7sucz555MUkXUTt39PjgkISpKn1KH1YpQWDw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=ZAJ6icaC; arc=none smtp.client-ip=91.218.175.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="ZAJ6icaC" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1774448063; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=oW5WwMfr6eST7PZhdxPXZ5zdHEpOxSHtk2D9WvewHSs=; b=ZAJ6icaC2Mog6ze6nBhzlho9byETaTdXK5NdsvWgh2j5dvfkw0tycDQ3PcNU8Lgtukt+Gf 0S6coAB4SLLUVt5wVSQ9M7s1JWKqERa4uU2JNlbXBakpMS67d7CEtNOlEoLZSl4h/LGIuW wSzf3MXy5Wc+ZTr/0Vhtg0FVzh4ikTc= From: Qi Zheng To: hannes@cmpxchg.org, hughd@google.com, mhocko@suse.com, roman.gushchin@linux.dev, shakeel.butt@linux.dev, muchun.song@linux.dev, david@kernel.org, ljs@kernel.org, ziy@nvidia.com, harry.yoo@oracle.com, yosry.ahmed@linux.dev, imran.f.khan@oracle.com, kamalesh.babulal@oracle.com, axelrasmussen@google.com, yuanchu@google.com, weixugc@google.com, chenridong@huaweicloud.com, mkoutny@suse.com, akpm@linux-foundation.org, hamzamahfooz@linux.microsoft.com, apais@linux.microsoft.com, lance.yang@linux.dev, bhe@redhat.com, usamaarif642@gmail.com Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Qi Zheng Subject: [PATCH v2 3/4] mm: memcontrol: correct the nr_pages parameter type of mem_cgroup_update_lru_size() Date: Wed, 25 Mar 2026 22:13:24 +0800 Message-ID: In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" From: Qi Zheng The nr_pages parameter of mem_cgroup_update_lru_size() represents a page count. During the reparenting of LRU folios, the value passed to it can potentially exceed the maximum value of a 32-bit integer. It should be declared as long instead of int to match the types used in lruvec size accounting and to prevent possible overflow. Update the parameter type to long to ensure correctness. Reviewed-by: Lorenzo Stoakes (Oracle) Signed-off-by: Qi Zheng --- include/linux/memcontrol.h | 2 +- mm/memcontrol.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h index 0861589695298..dc3fa687759b4 100644 --- a/include/linux/memcontrol.h +++ b/include/linux/memcontrol.h @@ -878,7 +878,7 @@ static inline bool mem_cgroup_online(struct mem_cgroup = *memcg) } =20 void mem_cgroup_update_lru_size(struct lruvec *lruvec, enum lru_list lru, - int zid, int nr_pages); + int zid, long nr_pages); =20 static inline unsigned long mem_cgroup_get_zone_lru_size(struct lruvec *lruvec, diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 4a78550f6174e..04076a139dbe3 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -1466,7 +1466,7 @@ struct lruvec *folio_lruvec_lock_irqsave(struct folio= *folio, * to or just after a page is removed from an lru list. */ void mem_cgroup_update_lru_size(struct lruvec *lruvec, enum lru_list lru, - int zid, int nr_pages) + int zid, long nr_pages) { struct mem_cgroup_per_node *mz; unsigned long *lru_size; @@ -1483,7 +1483,7 @@ void mem_cgroup_update_lru_size(struct lruvec *lruvec= , enum lru_list lru, =20 size =3D *lru_size; if (WARN_ONCE(size < 0, - "%s(%p, %d, %d): lru_size %ld\n", + "%s(%p, %d, %ld): lru_size %ld\n", __func__, lruvec, lru, nr_pages, size)) { VM_BUG_ON(1); *lru_size =3D 0; --=20 2.20.1 From nobody Fri Apr 3 01:22:48 2026 Received: from out-179.mta0.migadu.com (out-179.mta0.migadu.com [91.218.175.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8175C3CF690 for ; Wed, 25 Mar 2026 14:14:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.179 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774448085; cv=none; b=f/fwJwzMK2PVHXUb94gwppQuQgSdlEFwPt/tdTs87otoarTtCKmNUF3q1BHKOeuUNncRWRUr56wgXK68DFrnZ4mH8ymIZ0VQYynmH/wd29JSHXa5D6KzwXEbxeXMUkk22Jjf8rKtrLW1zPRbqfA0xLbf2WaHMJyX+/LTSjZ6UB4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774448085; c=relaxed/simple; bh=RBr0GG8xIGT4fesfFWwXpgueLgDhL/RIVQ/ES9sL00I=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=S1fBLQtSjw3/epEDawlUkq9WvuTHMxvET3SbkqtZhUcG2t4QqjrGCVJoM0yNnxtKnKUbcWD1NON1xoewWmNvOdIisivrIdMYRZgIAsoR7zh/NMOrKh2l2TjavMacOent9Ju4+jfXmw/yrYL31dR2MFNvP/i7nW4kn/jvkE3BgrY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=IfW4H6mh; arc=none smtp.client-ip=91.218.175.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="IfW4H6mh" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1774448082; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=GfBsoDL0TdJCX01wAdt/UD4xIx2OOwlMqUeevckOt8M=; b=IfW4H6mhNJCubVgaXAbZu9//dP2m8TqmdlOA07BDlu2eFkZzJDy4Z89jxVfVbR/1/gMIl9 zCYGnGFEchRelxAFRAOxy44bDZK5T6Ehs3pLozBWFivDbUClgmIWGyFoa6McxTimHmRfMc Ud3mYvlHZBeL6mnT4hpLIGoiLDdSTDU= From: Qi Zheng To: hannes@cmpxchg.org, hughd@google.com, mhocko@suse.com, roman.gushchin@linux.dev, shakeel.butt@linux.dev, muchun.song@linux.dev, david@kernel.org, ljs@kernel.org, ziy@nvidia.com, harry.yoo@oracle.com, yosry.ahmed@linux.dev, imran.f.khan@oracle.com, kamalesh.babulal@oracle.com, axelrasmussen@google.com, yuanchu@google.com, weixugc@google.com, chenridong@huaweicloud.com, mkoutny@suse.com, akpm@linux-foundation.org, hamzamahfooz@linux.microsoft.com, apais@linux.microsoft.com, lance.yang@linux.dev, bhe@redhat.com, usamaarif642@gmail.com Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Qi Zheng , "Harry Yoo (Oracle)" Subject: [PATCH v2 4/4] mm: memcontrol: fix unexpected massive positive number in memcg_state_val_in_pages() Date: Wed, 25 Mar 2026 22:13:25 +0800 Message-ID: In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" From: Qi Zheng In memcg_state_val_in_pages(), if the passed val is negative, the expression val * unit / PAGE_SIZE could be implicitly converted to a massive positive number when compared with 1UL in the max() macro. This leads to returning an incorrect massive positive value. Fix this by using abs(val) to calculate the magnitude first, and then restoring the sign of the value before returning the result. Additionally, use mult_frac() to prevent potential overflow during the multiplication of val and unit. Reported-by: Harry Yoo (Oracle) Signed-off-by: Qi Zheng Reviewed-by: Lorenzo Stoakes (Oracle) --- mm/memcontrol.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 04076a139dbe3..0c249255ebefb 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -787,11 +787,14 @@ static int memcg_page_state_unit(int item); static long memcg_state_val_in_pages(int idx, long val) { int unit =3D memcg_page_state_unit(idx); + long res; =20 if (!val || unit =3D=3D PAGE_SIZE) return val; - else - return max(val * unit / PAGE_SIZE, 1UL); + + res =3D max(mult_frac(abs(val), unit, PAGE_SIZE), 1UL); + + return val < 0 ? -res : res; } =20 #ifdef CONFIG_MEMCG_V1 --=20 2.20.1