On 7/28/26 8:54 AM, Emil Tsalapatis wrote:
On Mon Jul 27, 2026 at 2:24 AM EDT, Jiayuan Chen wrote:A child joins a memcg capped at 64M and faults an arena in until it runs out of the budget. Without the kernel fix the child dies with SIGSEGV on a valid arena address; with it, the child is killed by the memcg OOM killer. With the fix: serial_test_arena_memcg:PASS:child killed by signal serial_test_arena_memcg:PASS:not killed by SIGSEGV #5 arena_memcg:OK # dmesg arena_vm_fault+0x655/0xa90 Memory cgroup out of memory: Killed process 512, file-rss:67920kB Without the fix: serial_test_arena_memcg:PASS:child killed by signal serial_test_arena_memcg:FAIL:not killed by SIGSEGV: actual 11 #5 arena_memcg:FAIL # dmesg test_progs[508]: segfault at 100004025000 ... Signed-off-by: Jiayuan Chen <[email protected]> --- .../selftests/bpf/prog_tests/arena_memcg.c | 158 ++++++++++++++++++ .../testing/selftests/bpf/progs/arena_memcg.c | 24 +++ 2 files changed, 182 insertions(+) create mode 100644 tools/testing/selftests/bpf/prog_tests/arena_memcg.c create mode 100644 tools/testing/selftests/bpf/progs/arena_memcg.c diff --git a/tools/testing/selftests/bpf/prog_tests/arena_memcg.c b/tools/testing/selftests/bpf/prog_tests/arena_memcg.c new file mode 100644 index 000000000000..9665946fa29e --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/arena_memcg.c @@ -0,0 +1,158 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <test_progs.h> +#include <fcntl.h> +#include <signal.h> +#include <sys/mman.h> +#include <sys/wait.h> +#include <unistd.h> +#include <sys/user.h> +#ifndef PAGE_SIZE /* on some archs it comes in sys/user.h */ +#include <unistd.h> +#define PAGE_SIZE getpagesize() +#endif + +#include "cgroup_helpers.h" +#include "arena_memcg.skel.h" + +#define CG_PATH "/arena_memcg" + +/* Budget the arena gets on top of whatever is already charged after load. */ +#define ARENA_BUDGET (64 * 1024 * 1024) + +/* + * cgroup_helpers builds paths from getpid(), but the work dir belongs to the + * process that set the environment up. The child references it through that + * pid, so build the path explicitly. + */ +static void cg_file_path(char *buf, size_t sz, pid_t owner, const char *file) +{ + snprintf(buf, sz, "/mnt/cgroup-test-work-dir%d%s/%s", owner, CG_PATH, file);These are copied over from cgroup_helpers.c, but it's not obvious they originate from there. Maybe let's move them to cgroup_helpers.h where we can use them everywhere for consistency.
Agreed.
The main issue I see is that this only triggers consistently with PREEMPT_RT, correct?
It's not RT specified issue.
I tried with the default vmtest config we have but it does not trigger at all. More importantly, it doesn't trigger reliably with PREEMPT_RT, either. Does it for you? Can we cycle forks/frees multiple times to try and trigger this more reliably?
I stated vm(RT and non-RT) locally and ran test_progs 100 times and all tests passed.
I also used official bpf CI(non-RT) to run selftest, but still all tests passed...
So I'm not clear which config is associated with... https://github.com/kernel-patches/bpf/actions/runs/30795982316 https://github.com/kernel-patches/bpf/actions/runs/30798024430 https://github.com/kernel-patches/bpf/actions/runs/30801539977 https://github.com/kernel-patches/bpf/actions/runs/30808717560
