From 64a1f34050c6323002d36f90e344fc278d4d5021 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?= Date: Sat, 3 Dec 2016 19:45:01 +0100 Subject: [PATCH] Backport fix for NULL ptr dereference in mem_cgroup_node_nr_lru_pages Details in patch header. --- patches.backports/memcg-null-ptr.patch | 78 ++++++++++++++++++++++++++ series.conf | 4 ++ 2 files changed, 82 insertions(+) create mode 100644 patches.backports/memcg-null-ptr.patch diff --git a/patches.backports/memcg-null-ptr.patch b/patches.backports/memcg-null-ptr.patch new file mode 100644 index 0000000..319ac52 --- /dev/null +++ b/patches.backports/memcg-null-ptr.patch @@ -0,0 +1,78 @@ +From: Michal Hocko +Subject: mm: workingset: fix NULL ptr in count_shadow_nodes + +0a6b76dd23fa ("mm: workingset: make shadow node shrinker memcg aware") +has made the workingset shadow nodes shrinker memcg aware. The +implementation is not correct though because memcg_kmem_enabled() might +become true while we are doing a global reclaim when the sc->memcg might +be NULL which is exactly what Marek has seen: + +[ 15.665196] BUG: unable to handle kernel NULL pointer dereference at 0000000000000400 +[ 15.665213] IP: [] mem_cgroup_node_nr_lru_pages+0x20/0x40 +[ 15.665225] PGD 0 +[ 15.665230] Oops: 0000 [#1] SMP +[ 15.665285] CPU: 0 PID: 60 Comm: kswapd0 Tainted: G O 4.8.10-12.pvops.qubes.x86_64 #1 +[ 15.665292] task: ffff880011863b00 task.stack: ffff880011868000 +[ 15.665297] RIP: e030:[] [] mem_cgroup_node_nr_lru_pages+0x20/0x40 +[ 15.665307] RSP: e02b:ffff88001186bc70 EFLAGS: 00010293 +[ 15.665311] RAX: 0000000000000000 RBX: ffff88001186bd20 RCX: 0000000000000002 +[ 15.665317] RDX: 000000000000000c RSI: 0000000000000000 RDI: 0000000000000000 +[ 15.665322] RBP: ffff88001186bc70 R08: 28f5c28f5c28f5c3 R09: 0000000000000000 +[ 15.665327] R10: 0000000000006c34 R11: 0000000000000333 R12: 00000000000001f6 +[ 15.665332] R13: ffffffff81c6f6a0 R14: 0000000000000000 R15: 0000000000000000 +[ 15.665343] FS: 0000000000000000(0000) GS:ffff880013c00000(0000) knlGS:ffff880013d00000 +[ 15.665351] CS: e033 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 15.665358] CR2: 0000000000000400 CR3: 00000000122f2000 CR4: 0000000000042660 +[ 15.665366] Stack: +[ 15.665371] ffff88001186bc98 ffffffff811e0dda 00000000000002eb 0000000000000080 +[ 15.665384] ffffffff81c6f6a0 ffff88001186bd70 ffffffff811c36d9 0000000000000000 +[ 15.665397] ffff88001186bcb0 ffff88001186bcb0 ffff88001186bcc0 000000000000abc5 +[ 15.665410] Call Trace: +[ 15.665419] [] count_shadow_nodes+0x9a/0xa0 +[ 15.665428] [] shrink_slab.part.42+0x119/0x3e0 +[ 15.666049] [] shrink_node+0x22c/0x320 +[ 15.666049] [] kswapd+0x32c/0x700 +[ 15.666049] [] ? mem_cgroup_shrink_node+0x180/0x180 +[ 15.666049] [] kthread+0xd8/0xf0 +[ 15.666049] [] ret_from_fork+0x1f/0x40 +[ 15.666049] [] ? kthread_create_on_node+0x190/0x190 +[ 15.666049] Code: 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 3b 35 dd eb b1 00 55 48 89 e5 73 2c 89 d2 31 c9 31 c0 4c 63 ce 48 0f a3 ca 73 13 <4a> 8b b4 cf 00 04 00 00 41 89 c8 4a 03 84 c6 80 00 00 00 83 c1 +[ 15.666049] RIP [] mem_cgroup_node_nr_lru_pages+0x20/0x40 +[ 15.666049] RSP +[ 15.666049] CR2: 0000000000000400 +[ 15.666049] ---[ end trace 100494b9edbdfc4d ]--- + +This patch fixes the issue by checking sc->memcg rather than +memcg_kmem_enabled() which is sufficient because shrink_slab makes sure +that only memcg aware shrinkers will get non-NULL memcgs and only if +memcg_kmem_enabled is true. + +Fixes: 0a6b76dd23fa ("mm: workingset: make shadow node shrinker memcg aware") +Link: http://lkml.kernel.org/r/20161201132156.21450-1-mhocko@kernel.org +Signed-off-by: Michal Hocko +Reported-by: Marek Marczykowski-Górecki +Tested-by: Marek Marczykowski-Górecki +Acked-by: Vladimir Davydov +Acked-by: Johannes Weiner +Acked-by: Balbir Singh +Cc: [4.6+] +Signed-off-by: Andrew Morton +--- + + mm/workingset.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff -puN mm/workingset.c~mm-workingset-fix-null-ptr-in-count_shadow_nodes mm/workingset.c +--- a/mm/workingset.c~mm-workingset-fix-null-ptr-in-count_shadow_nodes ++++ a/mm/workingset.c +@@ -348,7 +348,7 @@ static unsigned long count_shadow_nodes( + shadow_nodes = list_lru_shrink_count(&workingset_shadow_nodes, sc); + local_irq_enable(); + +- if (memcg_kmem_enabled()) { ++ if (sc->memcg) { + pages = mem_cgroup_node_nr_lru_pages(sc->memcg, sc->nid, + LRU_ALL_FILE); + } else { +_ + diff --git a/series.conf b/series.conf index 0950b46..528f6e4 100644 --- a/series.conf +++ b/series.conf @@ -5,6 +5,9 @@ patches.xen/xen-netfront-detach-crash.patch patches.xen/0001-mce-hide-EBUSY-initialization-error-on-Xen.patch patches.xen/irq-bind-debug-log.patch +# Backports +patches.backports/memcg-null-ptr.patch + # Additional features #patches.xen/pvops-0100-usb-xen-pvusb-driver.patch patches.xen/pvops-blkfront-removable-flag.patch @@ -22,3 +25,4 @@ patches.xen/xsa155-linux44-0013-xen-blkfront-prepare-request-locally-only-then-p # MSI-X enabled device passthrough fix (#1734) patches.xen/pci_op-cleanup.patch +