iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/mm
History
Roman Gushchin df2a419677 mm: fix null pointer dereference in mem_cgroup_protected 
Shakeel reported a crash in mem_cgroup_protected(), which can be triggered
by memcg reclaim if the legacy cgroup v1 use_hierarchy=0 mode is used:

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000120
  PGD 8000001ff55da067 P4D 8000001ff55da067 PUD 1fdc7df067 PMD 0
  Oops: 0000 [#4] SMP PTI
  CPU: 0 PID: 15581 Comm: bash Tainted: G      D 4.17.0-smp-clean #5
  Hardware name: ...
  RIP: 0010:mem_cgroup_protected+0x54/0x130
  Code: 4c 8b 8e 00 01 00 00 4c 8b 86 08 01 00 00 48 8d 8a 08 ff ff ff 48 85 d2 ba 00 00 00 00 48 0f 44 ca 48 39 c8 0f 84 cf 00 00 00 <48> 8b 81 20 01 00 00 4d 89 ca 4c 39 c8 4c 0f 46 d0 4d 85 d2 74 05
  RSP: 0000:ffffabe64dfafa58 EFLAGS: 00010286
  RAX: ffff9fb6ff03d000 RBX: ffff9fb6f5b1b000 RCX: 0000000000000000
  RDX: 0000000000000000 RSI: ffff9fb6f5b1b000 RDI: ffff9fb6f5b1b000
  RBP: ffffabe64dfafb08 R08: 0000000000000000 R09: 0000000000000000
  R10: 0000000000000000 R11: 000000000000c800 R12: ffffabe64dfafb88
  R13: ffff9fb6f5b1b000 R14: ffffabe64dfafb88 R15: ffff9fb77fffe000
  FS:  00007fed1f8ac700(0000) GS:ffff9fb6ff400000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 0000000000000120 CR3: 0000001fdcf86003 CR4: 00000000001606f0
  Call Trace:
   ? shrink_node+0x194/0x510
   do_try_to_free_pages+0xfd/0x390
   try_to_free_mem_cgroup_pages+0x123/0x210
   try_charge+0x19e/0x700
   mem_cgroup_try_charge+0x10b/0x1a0
   wp_page_copy+0x134/0x5b0
   do_wp_page+0x90/0x460
   __handle_mm_fault+0x8e3/0xf30
   handle_mm_fault+0xfe/0x220
   __do_page_fault+0x262/0x500
   do_page_fault+0x28/0xd0
   ? page_fault+0x8/0x30
   page_fault+0x1e/0x30
  RIP: 0033:0x485b72

The problem happens because parent_mem_cgroup() returns a NULL pointer,
which is dereferenced later without a check.

As cgroup v1 has no memory guarantee support, let's make
mem_cgroup_protected() immediately return MEMCG_PROT_NONE, if the given
cgroup has no parent (non-hierarchical mode is used).

Link: http://lkml.kernel.org/r/20180611175418.7007-2-guro@fb.com
Fixes: bf8d5d52ffe8 ("memcg: introduce memory.min")
Signed-off-by: Roman Gushchin <guro@fb.com>
Reported-by: Shakeel Butt <shakeelb@google.com>
Tested-by: Shakeel Butt <shakeelb@google.com>
Tested-by: John Stultz <john.stultz@linaro.org>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Michal Hocko <mhocko@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-06-15 07:55:23 +09:00
..
kasan
kasan: fix memory hotplug during boot
2018-05-25 18:12:11 -07:00
backing-dev.c
memcg: writeback: use memcg->cgwb_list directly
2018-06-07 17:34:36 -07:00
balloon_compaction.c
virtio_balloon: fix deadlock on OOM
2017-11-14 23:57:38 +02:00
bootmem.c
mm: docs: fix parameter names mismatch
2018-02-06 18:32:48 -08:00
cleancache.c
docs/vm: rename documentation files to .rst
2018-04-16 14:18:15 -06:00
cma_debug.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
cma.c
Revert "mm/cma: manage the memory of the CMA area by using the ZONE_MOVABLE"
2018-05-24 10:07:50 -07:00
cma.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
compaction.c
Revert "mm/cma: manage the memory of the CMA area by using the ZONE_MOVABLE"
2018-05-24 10:07:50 -07:00
debug_page_ref.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
debug.c
mm/debug.c: provide useful debugging information for VM_BUG
2018-01-04 16:45:09 -08:00
dmapool.c
lib/vsprintf.c: remove %Z support
2017-02-27 18:43:47 -08:00
early_ioremap.c
mm/early_ioremap: Fix boot hang with earlyprintk=efi,keep
2017-12-11 14:54:44 +01:00
fadvise.c
mm: add ksys_fadvise64_64() helper; remove in-kernel call to sys_fadvise64_64()
2018-04-02 20:16:10 +02:00
failslab.c
mm: make should_failslab always available for fault injection
2018-04-05 21:36:26 -07:00
filemap.c
mm: use new return type vm_fault_t
2018-06-07 17:34:36 -07:00
frame_vector.c
mm/frame_vector.c: release a semaphore in 'get_vaddr_frames()'
2017-12-14 16:00:48 -08:00
frontswap.c
docs/vm: rename documentation files to .rst
2018-04-16 14:18:15 -06:00
gup_benchmark.c
treewide: kvzalloc() -> kvcalloc()
2018-06-12 16:19:22 -07:00
gup.c
libnvdimm for 4.18
2018-06-08 17:21:52 -07:00
highmem.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
hmm.c
mm: introduce MEMORY_DEVICE_FS_DAX and CONFIG_DEV_PAGEMAP_OPS
2018-05-22 06:59:39 -07:00
huge_memory.c
treewide: kmalloc() -> kmalloc_array()
2018-06-12 16:19:22 -07:00
hugetlb_cgroup.c
mm: rename page_counter's count/limit into usage/max
2018-06-07 17:34:35 -07:00
hugetlb.c
treewide: kmalloc() -> kmalloc_array()
2018-06-12 16:19:22 -07:00
hwpoison-inject.c
mm/memory_failure: Remove unused trapno from memory_failure
2018-01-23 12:17:42 -06:00
init-mm.c
mm: introduce arg_lock to protect arg_start|end and env_start|end in mm_struct
2018-06-07 17:34:34 -07:00
internal.h
Changes for 4.18:
2018-06-05 13:24:20 -07:00
interval_tree.c
mm/interval_tree.c: use vma_pages() helper
2018-01-31 17:18:37 -08:00
Kconfig
libnvdimm for 4.18
2018-06-08 17:21:52 -07:00
Kconfig.debug
kmemcheck: rip it out
2017-11-15 18:21:05 -08:00
khugepaged.c
page cache: use xa_lock
2018-04-11 10:28:39 -07:00
kmemleak-test.c
mm: convert printk(KERN_<LEVEL> to pr_<level>
2016-03-17 15:09:34 -07:00
kmemleak.c
mm: kernel-doc: add missing parameter descriptions
2018-04-05 21:36:27 -07:00
ksm.c
mm/ksm.c: ignore STABLE_FLAG of rmap_item->address in rmap_walk_ksm()
2018-06-15 07:55:23 +09:00
list_lru.c
mm: make counting of list_lru_one::nr_items lockless
2018-04-05 21:36:27 -07:00
maccess.c
mm: docs: fix parameter names mismatch
2018-02-06 18:32:48 -08:00
madvise.c
mm/memory_failure: Remove unused trapno from memory_failure
2018-01-23 12:17:42 -06:00
Makefile
mm: restructure memfd code
2018-06-07 17:34:35 -07:00
memblock.c
mm/memblock: print memblock_remove
2018-06-07 17:34:36 -07:00
memcontrol.c
mm: fix null pointer dereference in mem_cgroup_protected
2018-06-15 07:55:23 +09:00
memfd.c
mm: restructure memfd code
2018-06-07 17:34:35 -07:00
memory_hotplug.c
mm: move is_pageblock_removable_nolock() to mm/memory_hotplug.c
2018-06-07 17:34:36 -07:00
memory-failure.c
mm, migrate: remove reason argument from new_page_t
2018-04-11 10:28:32 -07:00
memory.c
Merge branch 'akpm' (patches from Andrew)
2018-06-07 18:39:37 -07:00
mempolicy.c
mm: unclutter THP migration
2018-04-11 10:28:32 -07:00
mempool.c
mempool: Add mempool_init()/mempool_exit()
2018-05-14 13:14:23 -06:00
memtest.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
migrate.c
mm: migrate: fix double call of radix_tree_replace_slot()
2018-05-11 17:28:45 -07:00
mincore.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
mlock.c
mm, mlock, vmscan: no more skipping pagevecs
2018-02-21 15:35:42 -08:00
mm_init.c
mm: convert printk(KERN_<LEVEL> to pr_<level>
2016-03-17 15:09:34 -07:00
mmap.c
mm: change return type to vm_fault_t
2018-06-07 17:34:36 -07:00
mmu_context.c
sched/headers: Prepare to move the task_lock()/unlock() APIs to <linux/sched/task.h>
2017-03-02 08:42:38 +01:00
mmu_notifier.c
mm, mmu_notifier: annotate mmu notifiers with blockable invalidate callbacks
2018-01-31 17:18:38 -08:00
mmzone.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
mprotect.c
sched/numa: avoid trapping faults and attempting migration of file-backed dirty pages
2018-04-11 10:28:31 -07:00
mremap.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
msync.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
nobootmem.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
nommu.c
mm: use new return type vm_fault_t
2018-06-07 17:34:36 -07:00
oom_kill.c
mm: rename page_counter's count/limit into usage/max
2018-06-07 17:34:35 -07:00
page_alloc.c
mm, page_alloc: do not break __GFP_THISNODE by zonelist reset
2018-06-07 17:34:38 -07:00
page_counter.c
memcg: introduce memory.min
2018-06-07 17:34:36 -07:00
page_ext.c
mm/page_ext.c: make page_ext_init a noop when CONFIG_PAGE_EXTENSION but nothing uses it
2018-01-31 17:18:39 -08:00
page_idle.c
mm: thp: fix potential clearing to referenced flag in page_idle_clear_pte_refs_one()
2018-04-05 21:36:25 -07:00
page_io.c
block: convert to bio_first_bvec_all & bio_first_page_all
2018-01-06 09:18:00 -07:00
page_isolation.c
mm, migrate: remove reason argument from new_page_t
2018-04-11 10:28:32 -07:00
page_owner.c
mm/page_owner.c: make early_page_owner_param() __init
2018-04-05 21:36:26 -07:00
page_poison.c
mm/page_poison.c: make early_page_poison_param() __init
2018-04-05 21:36:26 -07:00
page_vma_mapped.c
mm, page_vma_mapped: Introduce pfn_in_hpage()
2018-01-22 12:15:57 -08:00
page-writeback.c
writeback: safer lock nesting
2018-04-20 17:18:35 -07:00
pagewalk.c
mm: kernel-doc: add missing parameter descriptions
2018-04-05 21:36:27 -07:00
percpu-internal.h
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
percpu-km.c
percpu: allow select gfp to be passed to underlying allocators
2018-02-18 05:33:01 -08:00
percpu-stats.c
treewide: Use array_size() in vmalloc()
2018-06-12 16:19:22 -07:00
percpu-vm.c
percpu: allow select gfp to be passed to underlying allocators
2018-02-18 05:33:01 -08:00
percpu.c
arch: remove obsolete architecture ports
2018-04-02 20:20:12 -07:00
pgtable-generic.c
mm: do not lose dirty and accessed bits in pmdp_invalidate()
2018-01-31 17:18:38 -08:00
process_vm_access.c
mm: docs: add blank lines to silence sphinx "Unexpected indentation" errors
2018-02-06 18:32:48 -08:00
quicklist.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
readahead.c
mm: split ->readpages calls to avoid non-contiguous pages lists
2018-06-01 18:37:32 -07:00
rmap.c
Linux 4.17-rc2
2018-04-27 17:13:20 -06:00
rodata_test.c
mm: fix RODATA_TEST failure "rodata_test: test data was not read only"
2017-10-03 17:54:24 -07:00
shmem.c
mm/shmem.c: zero out unused vma fields in shmem_pseudo_vma_init()
2018-06-07 17:34:38 -07:00
slab_common.c
mm: make should_failslab always available for fault injection
2018-04-05 21:36:26 -07:00
slab.c
treewide: kzalloc() -> kcalloc()
2018-06-12 16:19:22 -07:00
slab.h
slab, slub: skip unnecessary kasan_cache_shutdown()
2018-04-05 21:36:24 -07:00
slob.c
slab: __GFP_ZERO is incompatible with a constructor
2018-06-07 17:34:34 -07:00
slub.c
treewide: kzalloc() -> kcalloc()
2018-06-12 16:19:22 -07:00
sparse-vmemmap.c
mm: merge vmem_altmap_alloc into altmap_alloc_block_buf
2018-01-08 11:46:23 -08:00
sparse.c
mm/sparse.c: pass the __highest_present_section_nr + 1 to alloc_func()
2018-06-07 17:34:35 -07:00
swap_cgroup.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
swap_slots.c
treewide: kvzalloc() -> kvcalloc()
2018-06-12 16:19:22 -07:00
swap_state.c
treewide: kvzalloc() -> kvcalloc()
2018-06-12 16:19:22 -07:00
swap.c
mm: introduce MEMORY_DEVICE_FS_DAX and CONFIG_DEV_PAGEMAP_OPS
2018-05-22 06:59:39 -07:00
swapfile.c
treewide: kvzalloc() -> kvcalloc()
2018-06-12 16:19:22 -07:00
truncate.c
page cache: use xa_lock
2018-04-11 10:28:39 -07:00
usercopy.c
usercopy: WARN() on slab cache usercopy region violations
2018-01-15 12:07:48 -08:00
userfaultfd.c
userfaultfd: prevent non-cooperative events vs mcopy_atomic races
2018-06-07 17:34:38 -07:00
util.c
mm: kvmalloc does not fallback to vmalloc for incompatible gfp flags
2018-06-07 17:34:38 -07:00
vmacache.c
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
2017-11-02 11:10:55 +01:00
vmalloc.c
mm: vmalloc: pass proper vm_start into debugobjects
2018-06-07 17:34:35 -07:00
vmpressure.c
mm/vmpressure.c: convert to use match_string() helper
2018-06-07 17:34:36 -07:00
vmscan.c
memcg: introduce memory.min
2018-06-07 17:34:36 -07:00
vmstat.c
proc: introduce proc_create_seq{,_data}
2018-05-16 07:23:35 +02:00
workingset.c
page cache: use xa_lock
2018-04-11 10:28:39 -07:00
z3fold.c
z3fold: fix reclaim lock-ups
2018-05-11 17:28:45 -07:00
zbud.c
mm: docs: fix parameter names mismatch
2018-02-06 18:32:48 -08:00
zpool.c
mm/zpool.c: zpool_evictable: fix mismatch in parameter name and kernel-doc
2018-02-21 15:35:43 -08:00
zsmalloc.c
mm: kernel-doc: add missing parameter descriptions
2018-04-05 21:36:27 -07:00
zswap.c
mm, swap, frontswap: fix THP swap if frontswap enabled
2018-02-21 15:35:43 -08:00