lkml.org 
[lkml]   [2010]   [May]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[08/98] memcg: fix prepare migration
    2.6.32-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Andrea Arcangeli <aarcange@redhat.com>

    commit 93d5c9be1ddd57d4063ce463c9ac2be1e5ee14f1 upstream.

    If a signal is pending (task being killed by sigkill)
    __mem_cgroup_try_charge will write NULL into &mem, and css_put will oops
    on null pointer dereference.

    BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
    IP: [<ffffffff810fc6cc>] mem_cgroup_prepare_migration+0x7c/0xc0
    PGD a5d89067 PUD a5d8a067 PMD 0
    Oops: 0000 [#1] SMP
    last sysfs file: /sys/devices/platform/microcode/firmware/microcode/loading
    CPU 0
    Modules linked in: nfs lockd nfs_acl auth_rpcgss sunrpc acpi_cpufreq pcspkr sg [last unloaded: microcode]

    Pid: 5299, comm: largepages Tainted: G W 2.6.34-rc3 #3 Penryn1600SLI-110dB/To Be Filled By O.E.M.
    RIP: 0010:[<ffffffff810fc6cc>] [<ffffffff810fc6cc>] mem_cgroup_prepare_migration+0x7c/0xc0

    [nishimura@mxp.nes.nec.co.jp: fix merge issues]
    Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
    Acked-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
    Cc: Balbir Singh <balbir@in.ibm.com>
    Signed-off-by: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    mm/memcontrol.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    --- a/mm/memcontrol.c
    +++ b/mm/memcontrol.c
    @@ -2008,12 +2008,12 @@ int mem_cgroup_prepare_migration(struct
    }
    unlock_page_cgroup(pc);

    + *ptr = mem;
    if (mem) {
    - ret = __mem_cgroup_try_charge(NULL, GFP_KERNEL, &mem, false,
    + ret = __mem_cgroup_try_charge(NULL, GFP_KERNEL, ptr, false,
    page);
    css_put(&mem->css);
    }
    - *ptr = mem;
    return ret;
    }




    \
     
     \ /
      Last update: 2010-05-12 10:11    [W:4.060 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site