+ mm-memcontrol-fix-forget-to-obtain-the-ref-to-objcg-in-split_page_memcg.patch added to -mm tree

+ mm-memcontrol-fix-forget-to-obtain-the-ref-to-objcg-in-split_page_memcg.patch added to -mm tree

[akpm]

The patch titled
     Subject: mm: memcontrol: fix forget to obtain the ref to objcg in split_page_memcg
has been added to the -mm tree.  Its filename is
     mm-memcontrol-fix-forget-to-obtain-the-ref-to-objcg-in-split_page_memcg.patch

This patch should soon appear at
    https://ozlabs.org/~akpm/mmots/broken-out/mm-memcontrol-fix-forget-to-obtain-the-ref-to-objcg-in-split_page_memcg.patch
and later at
    https://ozlabs.org/~akpm/mmotm/broken-out/mm-memcontrol-fix-forget-to-obtain-the-ref-to-objcg-in-split_page_memcg.patch

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next and is updated
there every 3-4 working days

------------------------------------------------------
From: Muchun Song <songmuchun@bytedance.com>
Subject: mm: memcontrol: fix forget to obtain the ref to objcg in split_page_memcg

Christian Borntraeger reported a warning about "percpu ref
(obj_cgroup_release) <= 0 (-1) after switching to atomic".  Because we
forgot to obtain the reference to the objcg and wrongly obtain the
reference of memcg.

Link: https://lkml.kernel.org/r/20210401030141.37061-1-songmuchun@bytedance.com
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Reported-by: Christian Borntraeger <borntraeger@de.ibm.com>
Acked-by: Roman Gushchin <guro@fb.com>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Xiongchun Duan <duanxiongchun@bytedance.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 include/linux/memcontrol.h |    6 ++++++
 mm/memcontrol.c            |    6 +++++-
 2 files changed, 11 insertions(+), 1 deletion(-)

--- a/include/linux/memcontrol.h~mm-memcontrol-fix-forget-to-obtain-the-ref-to-objcg-in-split_page_memcg
+++ a/include/linux/memcontrol.h
@@ -803,6 +803,12 @@ static inline void obj_cgroup_get(struct
 	percpu_ref_get(&objcg->refcnt);
 }
 
+static inline void obj_cgroup_get_many(struct obj_cgroup *objcg,
+				       unsigned long nr)
+{
+	percpu_ref_get_many(&objcg->refcnt, nr);
+}
+
 static inline void obj_cgroup_put(struct obj_cgroup *objcg)
 {
 	percpu_ref_put(&objcg->refcnt);
--- a/mm/memcontrol.c~mm-memcontrol-fix-forget-to-obtain-the-ref-to-objcg-in-split_page_memcg
+++ a/mm/memcontrol.c
@@ -3257,7 +3257,11 @@ void split_page_memcg(struct page *head,
 
 	for (i = 1; i < nr; i++)
 		head[i].memcg_data = head->memcg_data;
-	css_get_many(&memcg->css, nr - 1);
+
+	if (PageMemcgKmem(head))
+		obj_cgroup_get_many(__page_objcg(head), nr - 1);
+	else
+		css_get_many(&memcg->css, nr - 1);
 }
 
 #ifdef CONFIG_MEMCG_SWAP
_

Patches currently in -mm which might be from songmuchun@bytedance.com are

mm-memcontrol-fix-kernel-stack-account.patch
mm-memcontrol-slab-fix-obtain-a-reference-to-a-freeing-memcg.patch
mm-memcontrol-introduce-obj_cgroup_uncharge_pages.patch
mm-memcontrol-directly-access-page-memcg_data-in-mm-page_allocc.patch
mm-memcontrol-change-ug-dummy_page-only-if-memcg-changed.patch
mm-memcontrol-use-obj_cgroup-apis-to-charge-kmem-pages.patch
mm-memcontrol-inline-__memcg_kmem_uncharge-into-obj_cgroup_uncharge_pages.patch
mm-memcontrol-move-pagememcgkmem-to-the-scope-of-config_memcg_kmem.patch
mm-memcontrol-fix-forget-to-obtain-the-ref-to-objcg-in-split_page_memcg.patch