The patch titled
Subject: mm: fix null pointer dereference in mem_cgroup_protected
has been added to the -mm tree. Its filename is
mm-dont-skip-memory-guarantee-calculations-fix.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-dont-skip-memory-guarantee-calculations-fix.patch
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-dont-skip-memory-guarantee-calculations-fix.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Roman Gushchin <guro@xxxxxx>
Subject: mm: fix null pointer dereference in mem_cgroup_protected
Shakeel reported a crash in mem_cgroup_protected(), which can be triggered
by memcg reclaim if the legacy cgroup v1 use_hierarchy=0 mode is used:
[ 226.060572] BUG: unable to handle kernel NULL pointer dereference
at 0000000000000120
[ 226.068310] PGD 8000001ff55da067 P4D 8000001ff55da067 PUD 1fdc7df067 PMD 0
[ 226.075191] Oops: 0000 [#4] SMP PTI
[ 226.078637] CPU: 0 PID: 15581 Comm: bash Tainted: G D
4.17.0-smp-clean #5
[ 226.086635] Hardware name: ...
[ 226.094546] RIP: 0010:mem_cgroup_protected+0x54/0x130
[ 226.099533] Code: 4c 8b 8e 00 01 00 00 4c 8b 86 08 01 00 00 48 8d
8a 08 ff ff ff 48 85 d2 ba 00 00 00 00 48 0f 44 ca 48 39 c8 0f 84 cf
00 00 00 <48> 8b 81 20 01 00 00 4d 89 ca 4c 39 c8 4c 0f 46 d0 4d 85 d2
74 05
[ 226.118194] RSP: 0000:ffffabe64dfafa58 EFLAGS: 00010286
[ 226.123358] RAX: ffff9fb6ff03d000 RBX: ffff9fb6f5b1b000 RCX: 0000000000000000
[ 226.130406] RDX: 0000000000000000 RSI: ffff9fb6f5b1b000 RDI: ffff9fb6f5b1b000
[ 226.137454] RBP: ffffabe64dfafb08 R08: 0000000000000000 R09: 0000000000000000
[ 226.144503] R10: 0000000000000000 R11: 000000000000c800 R12: ffffabe64dfafb88
[ 226.151551] R13: ffff9fb6f5b1b000 R14: ffffabe64dfafb88 R15: ffff9fb77fffe000
[ 226.158602] FS: 00007fed1f8ac700(0000) GS:ffff9fb6ff400000(0000)
knlGS:0000000000000000
[ 226.166594] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 226.172270] CR2: 0000000000000120 CR3: 0000001fdcf86003 CR4: 00000000001606f0
[ 226.179317] Call Trace:
[ 226.181732] ? shrink_node+0x194/0x510
[ 226.185435] do_try_to_free_pages+0xfd/0x390
[ 226.189653] try_to_free_mem_cgroup_pages+0x123/0x210
[ 226.194643] try_charge+0x19e/0x700
[ 226.198088] mem_cgroup_try_charge+0x10b/0x1a0
[ 226.202478] wp_page_copy+0x134/0x5b0
[ 226.206094] do_wp_page+0x90/0x460
[ 226.209453] __handle_mm_fault+0x8e3/0xf30
[ 226.213498] handle_mm_fault+0xfe/0x220
[ 226.217285] __do_page_fault+0x262/0x500
[ 226.221158] do_page_fault+0x28/0xd0
[ 226.224689] ? page_fault+0x8/0x30
[ 226.228048] page_fault+0x1e/0x30
[ 226.231323] RIP: 0033:0x485b72
The problem happens because parent_mem_cgroup() returns a NULL pointer,
which is dereferenced later without a check.
As cgroup v1 has no memory guarantee support, let's make
mem_cgroup_protected() immediately return MEMCG_PROT_NONE, if the given
cgroup has no parent (non-hierarchical mode is used).
Link: http://lkml.kernel.org/r/20180608170607.29120-1-guro@xxxxxx
Signed-off-by: Roman Gushchin <guro@xxxxxx>
Reported-by: Shakeel Butt <shakeelb@xxxxxxxxxx>
Cc: Johannes Weiner <hannes@xxxxxxxxxxx>
Cc: Michal Hocko <mhocko@xxxxxxxxxx>
Cc: Vladimir Davydov <vdavydov.dev@xxxxxxxxx>
Cc: Greg Thelen <gthelen@xxxxxxxxxx>
Cc: Tejun Heo <tj@xxxxxxxxxx>
Cc: Shuah Khan <shuah@xxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
mm/memcontrol.c | 3 +++
1 file changed, 3 insertions(+)
diff -puN mm/memcontrol.c~mm-dont-skip-memory-guarantee-calculations-fix mm/memcontrol.c
--- a/mm/memcontrol.c~mm-dont-skip-memory-guarantee-calculations-fix
+++ a/mm/memcontrol.c
@@ -5750,6 +5750,9 @@ enum mem_cgroup_protection mem_cgroup_pr
elow = memcg->memory.low;
parent = parent_mem_cgroup(memcg);
+ if (!parent)
+ return MEMCG_PROT_NONE;
+
if (parent == root_mem_cgroup)
goto exit;
_
Patches currently in -mm which might be from guro@xxxxxx are
mm-oom-refactor-the-oom_kill_process-function.patch
mm-implement-mem_cgroup_scan_tasks-for-the-root-memory-cgroup.patch
mm-oom-cgroup-aware-oom-killer.patch
mm-oom-introduce-memoryoom_group.patch
mm-oom-introduce-memoryoom_group-fix.patch
mm-oom-add-cgroup-v2-mount-option-for-cgroup-aware-oom-killer.patch
mm-oom-docs-describe-the-cgroup-aware-oom-killer.patch
mm-oom-docs-describe-the-cgroup-aware-oom-killer-fix.patch
cgroup-list-groupoom-in-cgroup-features.patch
mm-fix-oom_kill-event-handling.patch
mm-propagate-memory-effective-protection-on-setting-memorymin-low.patch
mm-dont-skip-memory-guarantee-calculations.patch
mm-dont-skip-memory-guarantee-calculations-fix.patch
selftests-cgroup-add-test-for-memorylow-corner-cases.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
