Re: [PATCH] memcg: Fix NULL pointer deref in task_in_mem_cgroup()

[Johannes Weiner <hannes@cmpxchg.org>]

On Fri, Oct 24, 2014 at 10:58:07AM +0200, Michal Hocko wrote:
> On Thu 23-10-14 14:19:29, Johannes Weiner wrote:
> > On Thu, Oct 23, 2014 at 06:47:45PM +0200, Jan Kara wrote:
> > > 'curr' pointer in task_in_mem_cgroup() can be NULL when we race with
> > > somebody clearing task->mm. Check for it before dereferencing the
> > > pointer.
> > 
> > If task->mm is already NULL, we fall back to mem_cgroup_from_task(),
> > which definitely returns a memcg unless you pass NULL in there.  So I
> > don't see how that could happen, and the NULL checks in the fallback
> > branch as well as in __mem_cgroup_same_or_subtree seem bogus to me.
> 
> It came from 3a981f482cc2 (memcg: fix use_hierarchy css_is_ancestor oops
> regression). I do not see mem_cgroup_same_or_subtree called from
> page_referenced path so it is probably gone.

It's still there in invalid_page_referenced_vma().  And it can still
pass NULL.

> task_in_mem_cgroup is just confused because curr can never be NULL as
> the task is never NULL.

That's correct.

My patches to clean all this up have been stress-tested over night, I
will send them out in a jiffy.

Thanks

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>