> On Mar 6, 2025, at 22:37, Johannes Weiner <hannes@xxxxxxxxxxx> wrote:
>
> On Thu, Mar 06, 2025 at 10:54:12AM +0800, Kairui Song wrote:
>> On Thu, Mar 6, 2025 at 10:32 AM Muchun Song <songmuchun@xxxxxxxxxxxxx> wrote:
>>>
>>> The commit 6769183166b3 has removed the parameter of id from
>>> swap_cgroup_record() and get the memcg id from
>>> mem_cgroup_id(folio_memcg(folio)). However, the caller of it
>>> may update a different memcg's counter instead of
>>> folio_memcg(folio). E.g. in the caller of mem_cgroup_swapout(),
>>> @swap_memcg could be different with @memcg and update the counter
>>> of @swap_memcg, but swap_cgroup_record() records the wrong memcg's
>>> ID. When it is uncharged from __mem_cgroup_uncharge_swap(), the
>>> swap counter will leak since the wrong recorded ID. Fix it by
>>> bring the parameter of id back.
>>>
>>> Fixes: 6769183166b3 ("mm/swap_cgroup: decouple swap cgroup recording and clearing")
>>> Cc: <stable@xxxxxxxxxxxxxxx>
>>> Signed-off-by: Muchun Song <songmuchun@xxxxxxxxxxxxx>
>
> Acked-by: Johannes Weiner <hannes@xxxxxxxxxxx>
>
> Looking at the original commit again, we also should do this:
>
> ---
>
> From 2685ca87d73d0c2b91cfd6959e381a40db235119 Mon Sep 17 00:00:00 2001
> From: Johannes Weiner <hannes@xxxxxxxxxxx>
> Date: Thu, 6 Mar 2025 09:31:42 -0500
> Subject: [PATCH] mm: swap_cgroup: remove double initialization of locals
>
> Fixes: 6769183166b3 ("mm/swap_cgroup: decouple swap cgroup recording and clearing")
> Signed-off-by: Johannes Weiner <hannes@xxxxxxxxxxx>
Yes.
Reviewed-by: Muchun Song <muchun.song@xxxxxxxxx>
Thanks.
> ---
> mm/swap_cgroup.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/mm/swap_cgroup.c b/mm/swap_cgroup.c
> index 1007c30f12e2..de779fed8c21 100644
> --- a/mm/swap_cgroup.c
> +++ b/mm/swap_cgroup.c
> @@ -92,8 +92,7 @@ void swap_cgroup_record(struct folio *folio, unsigned short id,
> */
> unsigned short swap_cgroup_clear(swp_entry_t ent, unsigned int nr_ents)
> {
> - pgoff_t offset = swp_offset(ent);
> - pgoff_t end = offset + nr_ents;
> + pgoff_t offset, end;
> struct swap_cgroup *map;
> unsigned short old, iter = 0;
>
> --
> 2.48.1
