Messages in this thread Patch in this message | | | Date | Fri, 13 Mar 2020 15:39:20 -0700 | Subject | [PATCH -next] hugetlb_cgroup: fix illegal access to memory | From | Mina Almasry <> |
| |
This appears to be a mistake in commit faced7e0806cf ("mm: hugetlb controller for cgroups v2"). Essentially that commit does a hugetlb_cgroup_from_counter assuming that page_counter_try_charge has initialized counter, but if page_counter_try_charge has failed then it seems it does not initialize counter, so hugetlb_cgroup_from_counter(counter) ends up pointing to random memory, causing kasan to complain.
Solution, simply use h_cg, instead of hugetlb_cgroup_from_counter(counter), since that is a reference to the hugetlb_cgroup anyway. After this change kasan ceases to complain.
Signed-off-by: Mina Almasry <almasrymina@google.com> Reported-by: syzbot+cac0c4e204952cf449b1@syzkaller.appspotmail.com Fixes: commit faced7e0806cf ("mm: hugetlb controller for cgroups v2") Cc: Andrew Morton <akpm@linux-foundation.org> Cc: linux-mm@kvack.org Cc: linux-kernel@vger.kernel.org Cc: Giuseppe Scrivano <gscrivan@redhat.com> Cc: Tejun Heo <tj@kernel.org> Cc: mike.kravetz@oracle.com Cc: rientjes@google.com
--- mm/hugetlb_cgroup.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/mm/hugetlb_cgroup.c b/mm/hugetlb_cgroup.c index 7994eb8a2a0b4..aabf65d4d91ba 100644 --- a/mm/hugetlb_cgroup.c +++ b/mm/hugetlb_cgroup.c @@ -259,8 +259,7 @@ static int __hugetlb_cgroup_charge_cgroup(int idx, unsigned long nr_pages, __hugetlb_cgroup_counter_from_cgroup(h_cg, idx, rsvd), nr_pages, &counter)) { ret = -ENOMEM; - hugetlb_event(hugetlb_cgroup_from_counter(counter, idx), idx, - HUGETLB_MAX); + hugetlb_event(h_cg, idx, HUGETLB_MAX); css_put(&h_cg->css); goto done; } -- 2.25.1.481.gfbce0eb801-goog
| |