[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20090223145828.d14ff015.nishimura@mxp.nes.nec.co.jp>
Date: Mon, 23 Feb 2009 14:58:28 +0900
From: Daisuke Nishimura <nishimura@....nes.nec.co.jp>
To: KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com>
Cc: "linux-mm@...ck.org" <linux-mm@...ck.org>,
"balbir@...ux.vnet.ibm.com" <balbir@...ux.vnet.ibm.com>,
"lizf@...fujitsu.com" <lizf@...fujitsu.com>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
nishimura@....nes.nec.co.jp
Subject: Re: [RFC][PATCH] Reduce size of swap_cgroup by CSS ID v2
I'm sorry for my late reply.
It looks good basically, but I have 1 comment.
> static struct mem_cgroup *try_get_mem_cgroup_from_swapcache(struct page *page)
> {
> - struct mem_cgroup *mem;
> + unsigned short id;
> + struct mem_cgroup *mem = NULL;
> swp_entry_t ent;
>
> if (!PageSwapCache(page))
> return NULL;
>
> ent.val = page_private(page);
> - mem = lookup_swap_cgroup(ent);
> - if (!mem)
> - return NULL;
> + id = lookup_swap_cgroup(ent);
> + rcu_read_lock();
> + mem = mem_cgroup_lookup(id);
> if (!css_tryget(&mem->css))
We should check whether "mem" is NULL or not before css_tryget, because
"mem" can be NULL(or "id" can be 0) if the page is on swapcache,
that is, remove_from_swap_cache has not been called yet.
Actually, I got NULL pointer dereference bug here.
> - return NULL;
> + mem = NULL;
> + rcu_read_unlock();
> return mem;
> }
>
Thanks,
Daisuke Nishimura.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists