Re: [RFC][PATCH] Reduce size of swap_cgroup by CSS ID v2

[Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>]

I'm sorry for my late reply.

It looks good basically, but I have 1 comment.

>  static struct mem_cgroup *try_get_mem_cgroup_from_swapcache(struct page *page)
>  {
> -	struct mem_cgroup *mem;
> +	unsigned short id;
> +	struct mem_cgroup *mem = NULL;
>  	swp_entry_t ent;
>  
>  	if (!PageSwapCache(page))
>  		return NULL;
>  
>  	ent.val = page_private(page);
> -	mem = lookup_swap_cgroup(ent);
> -	if (!mem)
> -		return NULL;
> +	id = lookup_swap_cgroup(ent);
> +	rcu_read_lock();
> +	mem = mem_cgroup_lookup(id);
>  	if (!css_tryget(&mem->css))
We should check whether "mem" is NULL or not before css_tryget, because
"mem" can be NULL(or "id" can be 0) if the page is on swapcache,
that is, remove_from_swap_cache has not been called yet.

Actually, I got NULL pointer dereference bug here.

> -		return NULL;
> +		mem = NULL;
> +	rcu_read_unlock();
>  	return mem;
>  }
>  


Thanks,
Daisuke Nishimura.

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>