[lkml]   [2020]   [Jul]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH 4.4 34/54] mm/memcg: fix refcount error while moving and swapping
From: Hugh Dickins <>

commit 8d22a9351035ef2ff12ef163a1091b8b8cf1e49c upstream.

It was hard to keep a test running, moving tasks between memcgs with
move_charge_at_immigrate, while swapping: mem_cgroup_id_get_many()'s
refcount is discovered to be 0 (supposedly impossible), so it is then
forced to REFCOUNT_SATURATED, and after thousands of warnings in quick
succession, the test is at last put out of misery by being OOM killed.

This is because of the way moved_swap accounting was saved up until the
task move gets completed in __mem_cgroup_clear_mc(), deferred from when
mem_cgroup_move_swap_account() actually exchanged old and new ids.
Concurrent activity can free up swap quicker than the task is scanned,
bringing id refcount down 0 (which should only be possible when

Just skip that optimization: do that part of the accounting immediately.

Fixes: 615d66c37c75 ("mm: memcontrol: fix memcg id ref counter on swap charge move")
Signed-off-by: Hugh Dickins <>
Signed-off-by: Andrew Morton <>
Reviewed-by: Alex Shi <>
Cc: Johannes Weiner <>
Cc: Alex Shi <>
Cc: Shakeel Butt <>
Cc: Michal Hocko <>
Cc: <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>

mm/memcontrol.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4889,7 +4889,6 @@ static void __mem_cgroup_clear_mc(void)
if (!mem_cgroup_is_root(
page_counter_uncharge(&>memory, mc.moved_swap);

- mem_cgroup_id_get_many(, mc.moved_swap);
css_put_many(&>css, mc.moved_swap);

mc.moved_swap = 0;
@@ -5067,7 +5066,8 @@ put: /* get_mctgt_type() gets the page
ent = target.ent;
if (!mem_cgroup_move_swap_account(ent, mc.from, {
- /* we fixup refcnts and charges later. */
+ mem_cgroup_id_get_many(, 1);
+ /* we fixup other refcnts and charges later. */

 \ /
  Last update: 2020-07-30 10:15    [W:0.165 / U:6.900 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site