linux-kernel - [PATCH] mm/memcg: fix NULL pointer dereference at workingset

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20201130131512.6043-1-songmuchun@bytedance.com>
Date:   Mon, 30 Nov 2020 21:15:12 +0800
From:   Muchun Song <songmuchun@...edance.com>
To:     akpm@...ux-foundation.org, hannes@...xchg.org, shakeelb@...gle.com,
        guro@...com, sfr@...b.auug.org.au, alex.shi@...ux.alibaba.com,
        alexander.h.duyck@...ux.intel.com, laoar.shao@...il.com,
        richard.weiyang@...il.com
Cc:     linux-kernel@...r.kernel.org, linux-mm@...ck.org,
        Muchun Song <songmuchun@...edance.com>
Subject: [PATCH] mm/memcg: fix NULL pointer dereference at workingset_eviction

We found a case of kernel panic. The stack trace is as follows
(omit some irrelevant information):

    BUG: kernel NULL pointer dereference, address: 00000000000000c8
    RIP: 0010:workingset_eviction+0x26b/0x450
    Call Trace:
     __remove_mapping+0x224/0x2b0
     shrink_page_list+0x8c2/0x14e0
     shrink_inactive_list+0x1bf/0x3f0
     ? do_raw_spin_unlock+0x49/0xc0
     ? _raw_spin_unlock+0xa/0x20
     shrink_lruvec+0x401/0x640

This was caused by commit 76761ffa9ea1 ("mm/memcg: bail out early when
!memcg in mem_cgroup_lruvec"). When the parameter of memcg is NULL, we
should not use the &pgdat->__lruvec. So this just reverts commit
76761ffa9ea1 to fix it.

Fixes: 76761ffa9ea1 ("mm/memcg: bail out early when !memcg in mem_cgroup_lruvec")
Signed-off-by: Muchun Song <songmuchun@...edance.com>
---
 include/linux/memcontrol.h | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index f9a496c4eac7..a1416205507c 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -610,17 +610,20 @@ mem_cgroup_nodeinfo(struct mem_cgroup *memcg, int nid)
 static inline struct lruvec *mem_cgroup_lruvec(struct mem_cgroup *memcg,
 					       struct pglist_data *pgdat)
 {
+	struct mem_cgroup_per_node *mz;
 	struct lruvec *lruvec;
 
-	if (mem_cgroup_disabled() || !memcg) {
+	if (mem_cgroup_disabled()) {
 		lruvec = &pgdat->__lruvec;
-	} else {
-		struct mem_cgroup_per_node *mz;
-
-		mz = mem_cgroup_nodeinfo(memcg, pgdat->node_id);
-		lruvec = &mz->lruvec;
+		goto out;
 	}
 
+	if (!memcg)
+		memcg = root_mem_cgroup;
+
+	mz = mem_cgroup_nodeinfo(memcg, pgdat->node_id);
+	lruvec = &mz->lruvec;
+out:
 	/*
 	 * Since a node can be onlined after the mem_cgroup was created,
 	 * we have to be prepared to initialize lruvec->pgdat here;
-- 
2.11.0