Messages in this thread Patch in this message | | | From | Muchun Song <> | Subject | [PATCH] mm/memcg: fix NULL pointer dereference at workingset_eviction | Date | Mon, 30 Nov 2020 21:15:12 +0800 |
| |
We found a case of kernel panic. The stack trace is as follows (omit some irrelevant information):
BUG: kernel NULL pointer dereference, address: 00000000000000c8 RIP: 0010:workingset_eviction+0x26b/0x450 Call Trace: __remove_mapping+0x224/0x2b0 shrink_page_list+0x8c2/0x14e0 shrink_inactive_list+0x1bf/0x3f0 ? do_raw_spin_unlock+0x49/0xc0 ? _raw_spin_unlock+0xa/0x20 shrink_lruvec+0x401/0x640
This was caused by commit 76761ffa9ea1 ("mm/memcg: bail out early when !memcg in mem_cgroup_lruvec"). When the parameter of memcg is NULL, we should not use the &pgdat->__lruvec. So this just reverts commit 76761ffa9ea1 to fix it.
Fixes: 76761ffa9ea1 ("mm/memcg: bail out early when !memcg in mem_cgroup_lruvec") Signed-off-by: Muchun Song <songmuchun@bytedance.com> --- include/linux/memcontrol.h | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h index f9a496c4eac7..a1416205507c 100644 --- a/include/linux/memcontrol.h +++ b/include/linux/memcontrol.h @@ -610,17 +610,20 @@ mem_cgroup_nodeinfo(struct mem_cgroup *memcg, int nid) static inline struct lruvec *mem_cgroup_lruvec(struct mem_cgroup *memcg, struct pglist_data *pgdat) { + struct mem_cgroup_per_node *mz; struct lruvec *lruvec; - if (mem_cgroup_disabled() || !memcg) { + if (mem_cgroup_disabled()) { lruvec = &pgdat->__lruvec; - } else { - struct mem_cgroup_per_node *mz; - - mz = mem_cgroup_nodeinfo(memcg, pgdat->node_id); - lruvec = &mz->lruvec; + goto out; } + if (!memcg) + memcg = root_mem_cgroup; + + mz = mem_cgroup_nodeinfo(memcg, pgdat->node_id); + lruvec = &mz->lruvec; +out: /* * Since a node can be onlined after the mem_cgroup was created, * we have to be prepared to initialize lruvec->pgdat here; -- 2.11.0
| |