Anton Vorontsov 371528caec mm: memcg: Correct unregistring of events attached to the same eventfd ...

There is an issue when memcg unregisters events that were attached to
the same eventfd:

- On the first call mem_cgroup_usage_unregister_event() removes all
  events attached to a given eventfd, and if there were no events left,
  thresholds->primary would become NULL;

- Since there were several events registered, cgroups core will call
  mem_cgroup_usage_unregister_event() again, but now kernel will oops,
  as the function doesn't expect that threshold->primary may be NULL.

That's a good question whether mem_cgroup_usage_unregister_event()
should actually remove all events in one go, but nowadays it can't
do any better as cftype->unregister_event callback doesn't pass
any private event-associated cookie. So, let's fix the issue by
simply checking for threshold->primary.

FWIW, w/o the patch the following oops may be observed:

 BUG: unable to handle kernel NULL pointer dereference at 0000000000000004
 IP: [<ffffffff810be32c>] mem_cgroup_usage_unregister_event+0x9c/0x1f0
 Pid: 574, comm: kworker/0:2 Not tainted 3.3.0-rc4+ #9 Bochs Bochs
 RIP: 0010:[<ffffffff810be32c>]  [<ffffffff810be32c>] mem_cgroup_usage_unregister_event+0x9c/0x1f0
 RSP: 0018:ffff88001d0b9d60  EFLAGS: 00010246
 Process kworker/0:2 (pid: 574, threadinfo ffff88001d0b8000, task ffff88001de91cc0)
 Call Trace:
  [<ffffffff8107092b>] cgroup_event_remove+0x2b/0x60
  [<ffffffff8103db94>] process_one_work+0x174/0x450
  [<ffffffff8103e413>] worker_thread+0x123/0x2d0

Cc: stable <stable@vger.kernel.org>
Signed-off-by: Anton Vorontsov <anton.vorontsov@linaro.org>
Acked-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Kirill A. Shutemov <kirill@shutemov.name>
Cc: Michal Hocko <mhocko@suse.cz>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

2012-02-24 08:55:51 -08:00

..

backing-dev.c

backing-dev: fix wakeup timer races with bdi_unregister()

2012-02-01 16:52:49 +08:00

bootmem.c

mm: bootmem: try harder to free pages in bulk

2012-01-10 16:30:45 -08:00

bounce.c

Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux

2011-11-06 19:44:47 -08:00

cleancache.c

mm: cleancache core ops functions and config

2011-05-26 10:01:36 -06:00

compaction.c

mm: compaction: check for overlapping nodes during isolation for migration

2012-02-08 19:03:51 -08:00

debug-pagealloc.c

mm, x86: Remove debug_pagealloc_enabled

2011-12-06 09:24:07 +01:00

dmapool.c

mm: fix implicit stat.h usage in dmapool.c

2011-10-31 09:20:12 -04:00

fadvise.c

fadvise: only initiate writeback for specified range with FADV_DONTNEED

2012-01-10 16:30:43 -08:00

failslab.c

switch debugfs to umode_t

2012-01-03 22:54:56 -05:00

filemap_xip.c

mm/filemap_xip.c: fix race condition in xip_file_fault()

2012-02-03 16:16:41 -08:00

filemap.c

readahead: fix pipeline break caused by block plug

2012-02-03 16:16:41 -08:00

fremap.c

mm: delete various needless include <linux/module.h>

2011-10-31 09:20:11 -04:00

highmem.c

Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux

2011-11-06 19:44:47 -08:00

huge_memory.c

mm: fix UP THP spin_is_locked BUGs

2012-02-08 19:03:51 -08:00

hugetlb.c

mm/hugetlb.c: undo change to page mapcount in fault handler

2012-01-23 08:38:48 -08:00

hwpoison-inject.c

Fix common misspellings

2011-03-31 11:26:23 -03:00

init-mm.c

atomic: use <linux/atomic.h>

2011-07-26 16:49:47 -07:00

internal.h

mm: thp: tail page refcounting fix

2011-11-02 16:06:57 -07:00

Kconfig

Merge branch 'master' into x86/memblock

2011-11-28 09:46:22 -08:00

Kconfig.debug

mm: more intensive memory corruption debugging

2012-01-10 16:30:42 -08:00

kmemcheck.c

kmemcheck: Fix build errors due to missing slab.h

2010-03-30 22:02:32 +09:00

kmemleak-test.c

kmemleak: remove memset by using kzalloc

2011-01-27 18:31:51 +00:00

kmemleak.c

kmemleak: Disable early logging when kmemleak is off by default

2012-01-20 16:57:05 +00:00

ksm.c

memcg: clear pc->mem_cgroup if necessary.

2012-01-12 20:13:07 -08:00

maccess.c

mm: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

madvise.c

fs: kill i_alloc_sem

2011-07-20 20:47:46 -04:00

Makefile

Cross Memory Attach

2011-10-31 17:30:44 -07:00

memblock.c

memblock: Fix alloc failure due to dumb underflow protection in memblock_find_in_range_node()

2012-01-16 08:38:06 +01:00

memcontrol.c

mm: memcg: Correct unregistring of events attached to the same eventfd

2012-02-24 08:55:51 -08:00

memory_hotplug.c

mm: compaction: introduce sync-light migration for use by compaction

2012-01-12 20:13:09 -08:00

memory-failure.c

mm: compaction: introduce sync-light migration for use by compaction

2012-01-12 20:13:09 -08:00

memory.c

mm: fix rss count leakage during migration

2012-01-23 08:38:49 -08:00

mempolicy.c

mm: compaction: introduce sync-light migration for use by compaction

2012-01-12 20:13:09 -08:00

mempool.c

mempool: fix first round failure behavior

2012-01-10 16:30:45 -08:00

migrate.c

mm: postpone migrated page mapping reset

2012-02-03 16:16:40 -08:00

mincore.c

mm: clarify the radix_tree exceptional cases

2011-08-03 14:25:24 -10:00

mlock.c

Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux

2011-11-06 19:44:47 -08:00

mm_init.c

mm: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

mmap.c

mm: simplify find_vma_prev()

2012-01-10 16:30:44 -08:00

mmu_context.c

mm: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

mmu_notifier.c

mm: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

mmzone.c

mm: delete various needless include <linux/module.h>

2011-10-31 09:20:11 -04:00

mprotect.c

thp: mprotect: transparent huge page support

2011-01-13 17:32:44 -08:00

mremap.c

mremap: enforce rmap src/dst vma ordering in case of vma_merge() succeeding in copy_vma()

2012-01-10 16:30:44 -08:00

msync.c

sanitize vfs_fsync calling conventions

2010-05-21 18:31:21 -04:00

nobootmem.c

Merge branch 'master' into x86/memblock

2011-11-28 09:46:22 -08:00

nommu.c

xen: map foreign pages for shared rings by updating the PTEs directly

2011-11-16 12:13:08 -05:00

oom_kill.c

mm: unify remaining mem_cont, mem, etc. variable names to memcg

2012-01-12 20:13:06 -08:00

page_alloc.c

vfs: fix panic in __d_lookup() with high dentry hashtable counts

2012-02-13 20:45:38 -05:00

page_cgroup.c

page_cgroup: drop multi CONFIG_MEMORY_HOTPLUG

2012-01-12 20:13:08 -08:00

page_io.c

block: kill off REQ_UNPLUG

2011-03-10 08:52:27 +01:00

page_isolation.c

mm: page_isolation: codeclean fix comment and rm unneeded val init

2010-10-26 16:52:11 -07:00

page-writeback.c

Merge branch 'writeback-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/wfg/linux

2012-01-10 16:59:59 -08:00

pagewalk.c

pagewalk: fix code comment for THP

2011-07-25 20:57:09 -07:00

percpu-km.c

percpu: clear memory allocated with the km allocator

2010-10-02 10:28:42 +03:00

percpu-vm.c

percpu: fix chunk range calculation

2011-11-22 08:09:46 -08:00

percpu.c

Kmemleak patches

2012-01-14 18:11:11 -08:00

pgtable-generic.c

mm/pgtable-generic.c: fix CONFIG_SWAP=n build

2011-01-26 10:49:58 +10:00

prio_tree.c

sanitize <linux/prefetch.h> usage

2011-05-20 12:50:29 -07:00

process_vm_access.c

Fix race in process_vm_rw_core

2012-02-02 12:55:17 -08:00

quicklist.c

mm: delete various needless include <linux/module.h>

2011-10-31 09:20:11 -04:00

readahead.c

mm: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

rmap.c

mm: unify remaining mem_cont, mem, etc. variable names to memcg

2012-01-12 20:13:06 -08:00

shmem.c

SHM_UNLOCK: fix Unevictable pages stranded after swap

2012-01-23 08:38:48 -08:00

slab.c

Merge branch 'slab/for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/linux

2012-01-11 18:52:23 -08:00

slob.c

mm: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

slub.c

mm,x86,um: move CMPXCHG_DOUBLE config option

2012-01-12 20:13:03 -08:00

sparse-vmemmap.c

mm: delete various needless include <linux/module.h>

2011-10-31 09:20:11 -04:00

sparse.c

mm: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

swap_state.c

memcg: clear pc->mem_cgroup if necessary.

2012-01-12 20:13:07 -08:00

swap.c

mm: fix UP THP spin_is_locked BUGs

2012-02-08 19:03:51 -08:00

swapfile.c

mm: unify remaining mem_cont, mem, etc. variable names to memcg

2012-01-12 20:13:06 -08:00

thrash.c

mm/thrash.c: quiet sparse noise

2011-10-31 17:30:50 -07:00

truncate.c

mm: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

util.c

mm: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

vmalloc.c

mm/vmalloc.c: eliminate extra loop in pcpu_get_vm_areas error path

2012-01-12 20:13:10 -08:00

vmscan.c

SHM_UNLOCK: fix Unevictable pages stranded after swap

2012-01-23 08:38:48 -08:00

vmstat.c

mm,x86,um: move CMPXCHG_LOCAL config option

2012-01-12 20:13:03 -08:00