From: Andrea Arcangeli <aarcange@xxxxxxxxxx>
Subject: fork,memcg: alloc_thread_stack_node needs to set tsk->stack
5eed6f1dff87b ("fork,memcg: fix crash in free_thread_stack on memcg charge
fail") corrected two instances, but there was a third instance of this
bug.
Without setting tsk->stack, if memcg_charge_kernel_stack fails, it'll
execute free_thread_stack() on a dangling pointer.
Enterprise kernels are compiled with VMAP_STACK=y so this isn't critical,
but custom VMAP_STACK=n builds should have some performance advantage,
with the drawback of risking to fail fork because compaction didn't
succeed. So as long as VMAP_STACK=n is a supported option it's worth
fixing it upstream.
Link: http://lkml.kernel.org/r/20190619011450.28048-1-aarcange@xxxxxxxxxx
Fixes: 9b6f7e163cd0 ("mm: rework memcg kernel stack accounting")
Signed-off-by: Andrea Arcangeli <aarcange@xxxxxxxxxx>
Reviewed-by: Rik van Riel <riel@xxxxxxxxxxx>
Acked-by: Roman Gushchin <guro@xxxxxx>
Acked-by: Michal Hocko <mhocko@xxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
kernel/fork.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/kernel/fork.c~forkmemcg-alloc_thread_stack_node-needs-to-set-tsk-stack
+++ a/kernel/fork.c
@@ -248,7 +248,11 @@ static unsigned long *alloc_thread_stack
struct page *page = alloc_pages_node(node, THREADINFO_GFP,
THREAD_SIZE_ORDER);
- return page ? page_address(page) : NULL;
+ if (likely(page)) {
+ tsk->stack = page_address(page);
+ return tsk->stack;
+ }
+ return NULL;
#endif
}
_
