From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail190.messagelabs.com (mail190.messagelabs.com [216.82.249.51]) by kanga.kvack.org (Postfix) with ESMTP id 145FD620090 for ; Thu, 8 Apr 2010 00:07:10 -0400 (EDT) Date: Thu, 8 Apr 2010 12:57:22 +0900 From: Daisuke Nishimura Subject: Re: [PATCH 67 of 67] memcg fix prepare migration Message-Id: <20100408125722.2a11257d.nishimura@mxp.nes.nec.co.jp> In-Reply-To: <545969ff079730c4d7f7.1270691510@v2.random> References: <545969ff079730c4d7f7.1270691510@v2.random> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-linux-mm@kvack.org To: Andrea Arcangeli Cc: linux-mm@kvack.org, Andrew Morton , Marcelo Tosatti , Adam Litke , Avi Kivity , Izik Eidus , Hugh Dickins , Nick Piggin , Rik van Riel , Mel Gorman , Dave Hansen , Benjamin Herrenschmidt , Ingo Molnar , Mike Travis , KAMEZAWA Hiroyuki , Christoph Lameter , Chris Wright , bpicco@redhat.com, KOSAKI Motohiro , Balbir Singh , Arnd Bergmann , "Michael S. Tsirkin" , Peter Zijlstra , Johannes Weiner , Chris Mason , Daisuke Nishimura List-ID: On Thu, 08 Apr 2010 03:51:50 +0200, Andrea Arcangeli wrote: > From: Andrea Arcangeli > > If a signal is pending (task being killed by sigkill) __mem_cgroup_try_charge > will write NULL into &mem, and css_put will oops on null pointer dereference. > > BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 > IP: [] mem_cgroup_prepare_migration+0x7c/0xc0 > PGD a5d89067 PUD a5d8a067 PMD 0 > Oops: 0000 [#1] SMP > last sysfs file: /sys/devices/platform/microcode/firmware/microcode/loading > CPU 0 > Modules linked in: nfs lockd nfs_acl auth_rpcgss sunrpc acpi_cpufreq pcspkr sg [last unloaded: microcode] > > Pid: 5299, comm: largepages Tainted: G W 2.6.34-rc3 #3 Penryn1600SLI-110dB/To Be Filled By O.E.M. > RIP: 0010:[] [] mem_cgroup_prepare_migration+0x7c/0xc0 > > Signed-off-by: Andrea Arcangeli Nice catch ! But I think this fix should be forwarded to 34-rc and stable. They all have the same problem if the "current" which is doing the page migration is being oom-killed. Thanks, Daisuke Nishimura. > --- > > diff --git a/mm/memcontrol.c b/mm/memcontrol.c > --- a/mm/memcontrol.c > +++ b/mm/memcontrol.c > @@ -2445,12 +2445,12 @@ int mem_cgroup_prepare_migration(struct > } > unlock_page_cgroup(pc); > > + *ptr = mem; > if (mem) { > - ret = __mem_cgroup_try_charge(NULL, GFP_KERNEL, &mem, false, > + ret = __mem_cgroup_try_charge(NULL, GFP_KERNEL, ptr, false, > PAGE_SIZE); > css_put(&mem->css); > } > - *ptr = mem; > return ret; > } > -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org