lkml.org 
[lkml]   [2020]   [Nov]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] mm/memcg: fix NULL pointer dereference at workingset_eviction
On Mon 30-11-20 21:15:12, Muchun Song wrote:
> We found a case of kernel panic. The stack trace is as follows
> (omit some irrelevant information):
>
> BUG: kernel NULL pointer dereference, address: 00000000000000c8
> RIP: 0010:workingset_eviction+0x26b/0x450
> Call Trace:
> __remove_mapping+0x224/0x2b0
> shrink_page_list+0x8c2/0x14e0
> shrink_inactive_list+0x1bf/0x3f0
> ? do_raw_spin_unlock+0x49/0xc0
> ? _raw_spin_unlock+0xa/0x20
> shrink_lruvec+0x401/0x640
>
> This was caused by commit 76761ffa9ea1 ("mm/memcg: bail out early when
> !memcg in mem_cgroup_lruvec"). When the parameter of memcg is NULL, we
> should not use the &pgdat->__lruvec. So this just reverts commit
> 76761ffa9ea1 to fix it.
>
> Fixes: 76761ffa9ea1 ("mm/memcg: bail out early when !memcg in mem_cgroup_lruvec")

I do not see any commits like that in the current Linus tree. Is this a
commit id from the linux-next? If yes, can we just fold it into the
respective patch in mmotm tree please?

> Signed-off-by: Muchun Song <songmuchun@bytedance.com>
> ---
> include/linux/memcontrol.h | 15 +++++++++------
> 1 file changed, 9 insertions(+), 6 deletions(-)
>
> diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
> index f9a496c4eac7..a1416205507c 100644
> --- a/include/linux/memcontrol.h
> +++ b/include/linux/memcontrol.h
> @@ -610,17 +610,20 @@ mem_cgroup_nodeinfo(struct mem_cgroup *memcg, int nid)
> static inline struct lruvec *mem_cgroup_lruvec(struct mem_cgroup *memcg,
> struct pglist_data *pgdat)
> {
> + struct mem_cgroup_per_node *mz;
> struct lruvec *lruvec;
>
> - if (mem_cgroup_disabled() || !memcg) {
> + if (mem_cgroup_disabled()) {
> lruvec = &pgdat->__lruvec;
> - } else {
> - struct mem_cgroup_per_node *mz;
> -
> - mz = mem_cgroup_nodeinfo(memcg, pgdat->node_id);
> - lruvec = &mz->lruvec;
> + goto out;
> }
>
> + if (!memcg)
> + memcg = root_mem_cgroup;
> +
> + mz = mem_cgroup_nodeinfo(memcg, pgdat->node_id);
> + lruvec = &mz->lruvec;
> +out:
> /*
> * Since a node can be onlined after the mem_cgroup was created,
> * we have to be prepared to initialize lruvec->pgdat here;
> --
> 2.11.0
>

--
Michal Hocko
SUSE Labs

\
 
 \ /
  Last update: 2020-11-30 14:26    [W:0.093 / U:0.048 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site