The patch titled memcg: handle null dereference of mm->owner has been added to the -mm tree. Its filename is mm-owner-fix-race-between-swap-and-exit-fix-fix.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find out what to do about this The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: memcg: handle null dereference of mm->owner From: Daisuke Nishimura <nishimura@xxxxxxxxxxxxxxxxx> mm_update_next_owner() may clear mm->owner to NULL if it races with swapoff, page migration, etc. (This behavior was introduced by mm-owner-fix-race-between-swap-and-exit.patch.) But memcg doesn't take account of this situation, and causes: BUG: unable to handle kernel NULL pointer dereference at 0000000000000630 This fixes it. Signed-off-by: Daisuke Nishimura <nishimura@xxxxxxxxxxxxxxxxx> Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@xxxxxxxxxxxxxx> Cc: Balbir Singh <balbir@xxxxxxxxxx> Cc: Paul Menage <menage@xxxxxxxxxx> Cc: Jiri Slaby <jirislaby@xxxxxxxxx> Cc: Hugh Dickins <hugh@xxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- mm/memcontrol.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff -puN mm/memcontrol.c~mm-owner-fix-race-between-swap-and-exit-fix-fix mm/memcontrol.c --- a/mm/memcontrol.c~mm-owner-fix-race-between-swap-and-exit-fix-fix +++ a/mm/memcontrol.c @@ -250,6 +250,14 @@ static struct mem_cgroup *mem_cgroup_fro struct mem_cgroup *mem_cgroup_from_task(struct task_struct *p) { + /* + * mm_update_next_owner() may clear mm->owner to NULL + * if it races with swapoff, page migration, etc. + * So this can be called with p == NULL. + */ + if (unlikely(!p)) + return NULL; + return container_of(task_subsys_state(p, mem_cgroup_subsys_id), struct mem_cgroup, css); } @@ -549,6 +557,11 @@ static int mem_cgroup_charge_common(stru if (likely(!memcg)) { rcu_read_lock(); mem = mem_cgroup_from_task(rcu_dereference(mm->owner)); + if (unlikely(!mem)) { + rcu_read_unlock(); + kmem_cache_free(page_cgroup_cache, pc); + return 0; + } /* * For every charge from the cgroup, increment reference count */ @@ -801,6 +814,10 @@ int mem_cgroup_shrink_usage(struct mm_st rcu_read_lock(); mem = mem_cgroup_from_task(rcu_dereference(mm->owner)); + if (unlikely(!mem)) { + rcu_read_unlock(); + return 0; + } css_get(&mem->css); rcu_read_unlock(); _ Patches currently in -mm which might be from nishimura@xxxxxxxxxxxxxxxxx are mm-owner-fix-race-between-swap-and-exit-fix-fix.patch unevictable-lru-infrastructure.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html