lkml.org 
[lkml]   [2020]   [Nov]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] mm/memcg: fix NULL pointer dereference at workingset_eviction
Date
We found a case of kernel panic. The stack trace is as follows
(omit some irrelevant information):

BUG: kernel NULL pointer dereference, address: 00000000000000c8
RIP: 0010:workingset_eviction+0x26b/0x450
Call Trace:
__remove_mapping+0x224/0x2b0
shrink_page_list+0x8c2/0x14e0
shrink_inactive_list+0x1bf/0x3f0
? do_raw_spin_unlock+0x49/0xc0
? _raw_spin_unlock+0xa/0x20
shrink_lruvec+0x401/0x640

This was caused by commit 76761ffa9ea1 ("mm/memcg: bail out early when
!memcg in mem_cgroup_lruvec"). When the parameter of memcg is NULL, we
should not use the &pgdat->__lruvec. So this just reverts commit
76761ffa9ea1 to fix it.

Fixes: 76761ffa9ea1 ("mm/memcg: bail out early when !memcg in mem_cgroup_lruvec")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
---
include/linux/memcontrol.h | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index f9a496c4eac7..a1416205507c 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -610,17 +610,20 @@ mem_cgroup_nodeinfo(struct mem_cgroup *memcg, int nid)
static inline struct lruvec *mem_cgroup_lruvec(struct mem_cgroup *memcg,
struct pglist_data *pgdat)
{
+ struct mem_cgroup_per_node *mz;
struct lruvec *lruvec;

- if (mem_cgroup_disabled() || !memcg) {
+ if (mem_cgroup_disabled()) {
lruvec = &pgdat->__lruvec;
- } else {
- struct mem_cgroup_per_node *mz;
-
- mz = mem_cgroup_nodeinfo(memcg, pgdat->node_id);
- lruvec = &mz->lruvec;
+ goto out;
}

+ if (!memcg)
+ memcg = root_mem_cgroup;
+
+ mz = mem_cgroup_nodeinfo(memcg, pgdat->node_id);
+ lruvec = &mz->lruvec;
+out:
/*
* Since a node can be onlined after the mem_cgroup was created,
* we have to be prepared to initialize lruvec->pgdat here;
--
2.11.0
\
 
 \ /
  Last update: 2020-11-30 14:19    [W:0.056 / U:0.424 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site