We found a case of kernel panic. The stack trace is as follows
(omit some irrelevant information):
BUG: kernel NULL pointer dereference, address: 00000000000000c8
RIP: 0010:workingset_eviction+0x26b/0x450
Call Trace:
__remove_mapping+0x224/0x2b0
shrink_page_list+0x8c2/0x14e0
shrink_inactive_list+0x1bf/0x3f0
? do_raw_spin_unlock+0x49/0xc0
? _raw_spin_unlock+0xa/0x20
shrink_lruvec+0x401/0x640
This was caused by commit 76761ffa9ea1 ("mm/memcg: bail out early when
!memcg in mem_cgroup_lruvec"). When the parameter of memcg is NULL, we
should not use the &pgdat->__lruvec. So this just reverts commit
76761ffa9ea1 to fix it.
Fixes: 76761ffa9ea1 ("mm/memcg: bail out early when !memcg in mem_cgroup_lruvec")
Signed-off-by: Muchun Song <songmuchun@xxxxxxxxxxxxx>
---
include/linux/memcontrol.h | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index f9a496c4eac7..a1416205507c 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -610,17 +610,20 @@ mem_cgroup_nodeinfo(struct mem_cgroup *memcg, int nid)
static inline struct lruvec *mem_cgroup_lruvec(struct mem_cgroup *memcg,
struct pglist_data *pgdat)
{
+ struct mem_cgroup_per_node *mz;
struct lruvec *lruvec;
- if (mem_cgroup_disabled() || !memcg) {
+ if (mem_cgroup_disabled()) {
lruvec = &pgdat->__lruvec;
- } else {
- struct mem_cgroup_per_node *mz;
-
- mz = mem_cgroup_nodeinfo(memcg, pgdat->node_id);
- lruvec = &mz->lruvec;
+ goto out;
}
+ if (!memcg)
+ memcg = root_mem_cgroup;
+
+ mz = mem_cgroup_nodeinfo(memcg, pgdat->node_id);
+ lruvec = &mz->lruvec;
+out:
/*
* Since a node can be onlined after the mem_cgroup was created,
* we have to be prepared to initialize lruvec->pgdat here;
--
2.11.0
