[Devel] [PATCH RH7] mm: Fix race between reparenting memcg and list_lru_del()

[Kirill Tkhai]

From: Roman Gushchin <guro at fb.com>

On reparenting struct list_lru_one::nr_items may become
negative, so all the shrinker bits logic works as not expected.

This leads to cleared shrinker bit while LRU is not
actually empty.

(We will pull description from ms git later, when it's available).

https://lkml.org/lkml/2020/11/30/1093

Signed-off-by: Kirill Tkhai <ktkhai at virtuozzo.com>
---
 mm/list_lru.c |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/mm/list_lru.c b/mm/list_lru.c
index 21e12a8364ff..05d517197fbe 100644
--- a/mm/list_lru.c
+++ b/mm/list_lru.c
@@ -511,7 +511,6 @@ static void memcg_drain_list_lru_node(struct list_lru *lru, int nid,
 	struct list_lru_node *nlru = &lru->node[nid];
 	int dst_idx = memcg_cache_id(dst_memcg);
 	struct list_lru_one *src, *dst;
-	bool set;
 
 	/*
 	 * Since list_lru_{add,del} may be called under an IRQ-safe lock,
@@ -523,9 +522,8 @@ static void memcg_drain_list_lru_node(struct list_lru *lru, int nid,
 	dst = list_lru_from_memcg_idx(nlru, dst_idx);
 
 	list_splice_init(&src->list, &dst->list);
-	set = (!dst->nr_items && src->nr_items);
 	dst->nr_items += src->nr_items;
-	if (set)
+	if (src->nr_items)
 		memcg_set_shrinker_bit(dst_memcg, nid, lru_shrinker_id(lru));
 	src->nr_items = 0;