Re: [PATCH] mm/hugetlb_cgroup: call page_counter_set_max() outside VM_BUG_ON()

On Mon, 17 Aug 2026 10:34:33 +0000 Narek Jilavyan <[email protected]> wrote:

> hugetlb_cgroup_css_alloc() rounds the counter limit down to a multiple of
> the huge page size and then applies it inside an assertion:
> 
> 	VM_BUG_ON(page_counter_set_max(fault, limit));
> 	VM_BUG_ON(page_counter_set_max(rsvd, limit));
> 
> With CONFIG_DEBUG_VM=n, VM_BUG_ON(cond) is BUILD_BUG_ON_INVALID(cond),
> i.e. ((void)(sizeof((__force long)(cond)))), whose operand is never
> evaluated.  page_counter_set_max() is not a predicate - it performs
> xchg(&counter->max, nr_pages) - so on every non-debug kernel the limit is
> never applied and the counters keep page_counter_init()'s
> PAGE_COUNTER_MAX.
> 
> That is user-visible, because hugetlb_cgroup_read_u64_max() recomputes
> the same rounded value and uses equality as its "unlimited" sentinel.
> PAGE_COUNTER_MAX is LONG_MAX / PAGE_SIZE = 2251799813685247, which is
> odd, so round_down() really does change it and the two sides disagree.
> With CONFIG_DEBUG_VM=n:
> 
> 	$ cat /sys/fs/cgroup/t/hugetlb.2MB.max
> 	9223372036854771712
> 
> and with this patch:
> 
> 	$ cat /sys/fs/cgroup/t/hugetlb.2MB.max
> 	max
> 
> A debug option should not change cgroup output.
> 
> Call the function, then assert the result, as v6.12 did.  Use
> VM_WARN_ON_ONCE() rather than restoring VM_BUG_ON(): the two are
> identical under CONFIG_DEBUG_VM=n, and checkpatch asks that new code not
> use BUG() variants.

Nice, thanks, I'll add cc:stable to this, to help ensure that users of
earlier kernels get to enjoy it.