Re: [PATCH 1/9] fix error path of mem_cgroup_create and refnct handling

[Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>]

On Tue, 16 Dec 2008 18:10:41 +0900, KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> wrote:
> 
> From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
> 
>  1. Fix double-free BUG in error route of mem_cgroup_create().
>     mem_cgroup_free() itself frees per-zone-info.
>  2. Making refcnt of memcg simple.
>     Add 1 refcnt at creation and call free when refcnt goes down to 0.
> 
I like this change.

> Singed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>

	Reviewed-by: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>

Thanks,
Daisuke Nishimura.

> ---
> Index: mmotm-2.6.28-Dec15/mm/memcontrol.c
> ===================================================================
> --- mmotm-2.6.28-Dec15.orig/mm/memcontrol.c
> +++ mmotm-2.6.28-Dec15/mm/memcontrol.c
> @@ -2087,14 +2087,10 @@ static struct mem_cgroup *mem_cgroup_all
>   * Removal of cgroup itself succeeds regardless of refs from swap.
>   */
>  
> -static void mem_cgroup_free(struct mem_cgroup *mem)
> +static void __mem_cgroup_free(struct mem_cgroup *mem)
>  {
>  	int node;
>  
> -	if (atomic_read(&mem->refcnt) > 0)
> -		return;
> -
> -
>  	for_each_node_state(node, N_POSSIBLE)
>  		free_mem_cgroup_per_zone_info(mem, node);
>  
> @@ -2111,11 +2107,8 @@ static void mem_cgroup_get(struct mem_cg
>  
>  static void mem_cgroup_put(struct mem_cgroup *mem)
>  {
> -	if (atomic_dec_and_test(&mem->refcnt)) {
> -		if (!mem->obsolete)
> -			return;
> -		mem_cgroup_free(mem);
> -	}
> +	if (atomic_dec_and_test(&mem->refcnt))
> +		__mem_cgroup_free(mem);
>  }
>  
>  
> @@ -2165,12 +2158,10 @@ mem_cgroup_create(struct cgroup_subsys *
>  
>  	if (parent)
>  		mem->swappiness = get_swappiness(parent);
> -
> +	atomic_set(&mem->refcnt, 1);
>  	return &mem->css;
>  free_out:
> -	for_each_node_state(node, N_POSSIBLE)
> -		free_mem_cgroup_per_zone_info(mem, node);
> -	mem_cgroup_free(mem);
> +	__mem_cgroup_free(mem);
>  	return ERR_PTR(-ENOMEM);
>  }
>  
> @@ -2185,7 +2176,7 @@ static void mem_cgroup_pre_destroy(struc
>  static void mem_cgroup_destroy(struct cgroup_subsys *ss,
>  				struct cgroup *cont)
>  {
> -	mem_cgroup_free(mem_cgroup_from_cont(cont));
> +	mem_cgroup_put(mem_cgroup_from_cont(cont));
>  }
>  
>  static int mem_cgroup_populate(struct cgroup_subsys *ss,
> 
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>