mm: multi-gen LRU: skip rotation of offlined memcgs

Commit cc65a5d ("mm: memcontrol: use obj_cgroup APIs to charge
the LRU pages") removes memcgs from the per-node memcg-LRU list
when they are offlined.

However, because the list is RCU-protected, shrink_many() can still see
an offlined memcg and try to rotate: mem_cgroup_tryget() can grab
a reference to offline memcgs, leading to lru_gen_rotate_memcg().
That function assumes the memcg is still on the list and will crash
if it has already been removed:

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  [...]
  RIP: 0010:lru_gen_rotate_memcg+0x18a/0x2f0
  [...]
  Call Trace:
   <TASK>
   shrink_many+0x254/0x8a0
   ? shrink_many+0x73/0x8a0
   shrink_node+0x3e3/0x440
   ? __raw_spin_lock_irqsave+0x49/0x70
   balance_pgdat+0x2d7/0x7d0
   kswapd+0x114/0x1e0
   ? __pfx_kswapd+0x10/0x10
   kthread+0xd3/0x110
   ? __pfx_kthread+0x10/0x10
   ret_from_fork+0x31/0x50
   ? __pfx_kthread+0x10/0x10
   ret_from_fork_asm+0x1a/0x30
   </TASK>

Switch to mem_cgroup_tryget_online() so that offlined memcgs
are skipped.

Drop lru_gen_release_memcg(); offlining already removes the memcg
from the list, so nothing is left to do at release step.

Note that it is still feasible to call lru_gen_offline_memcg() in
shrink_many() to prevent kswapd from waiting for memcgs to be
offlined in a workqueue (See commit 6867c7a ("mm: multi-gen LRU:
don't spin during memcg release") for more detail).

Orabug: 37997501

Fixes: cc65a5d ("mm: memcontrol: use obj_cgroup APIs to charge the LRU pages")
Reviewed-by: Sidhartha Kumar <[email protected]>
Reviewed-by: Imran Khan <[email protected]>
Signed-off-by: Harry Yoo <[email protected]>

Author: Harry Yoo

include/linux/mmzone.h

@@ -562,7 +562,6 @@ void lru_gen_init_memcg(struct mem_cgroup *memcg);
 void lru_gen_exit_memcg(struct mem_cgroup *memcg);
 void lru_gen_online_memcg(struct mem_cgroup *memcg);
 void lru_gen_offline_memcg(struct mem_cgroup *memcg);
-void lru_gen_release_memcg(struct mem_cgroup *memcg);
 void lru_gen_soft_reclaim(struct mem_cgroup *memcg, int nid);
 
 #else /* !CONFIG_LRU_GEN */
@@ -596,10 +595,6 @@ static inline void lru_gen_offline_memcg(struct mem_cgroup *memcg)
 {
 }
 
-static inline void lru_gen_release_memcg(struct mem_cgroup *memcg)
-{
-}
-
 static inline void lru_gen_soft_reclaim(struct mem_cgroup *memcg, int nid)
 {
 }

mm/memcontrol.c

@@ -3851,7 +3851,6 @@ static void mem_cgroup_css_released(struct cgroup_subsys_state *css)
 	struct mem_cgroup *memcg = mem_cgroup_from_css(css);
 
 	invalidate_reclaim_iterators(memcg);
-	lru_gen_release_memcg(memcg);
 }
 
 static void mem_cgroup_css_free(struct cgroup_subsys_state *css)

mm/vmscan.c

@@ -4249,11 +4249,6 @@ void lru_gen_online_memcg(struct mem_cgroup *memcg)
 }
 
 void lru_gen_offline_memcg(struct mem_cgroup *memcg)
-{
-	lru_gen_release_memcg(memcg);
-}
-
-void lru_gen_release_memcg(struct mem_cgroup *memcg)
 {
 	int gen;
 	int nid;
@@ -4903,8 +4898,8 @@ static void shrink_many(struct pglist_data *pgdat, struct scan_control *sc)
 		lruvec = container_of(lrugen, struct lruvec, lrugen);
 		memcg = lruvec_memcg(lruvec);
 
-		if (!mem_cgroup_tryget(memcg)) {
-			lru_gen_release_memcg(memcg);
+		if (!mem_cgroup_tryget_online(memcg)) {
+			lru_gen_offline_memcg(memcg);
 			memcg = NULL;
 			continue;
 		}