• Roman Gushchin's avatar
    mm: fix null pointer dereference in mem_cgroup_protected · df2a4196
    Roman Gushchin authored
    Shakeel reported a crash in mem_cgroup_protected(), which can be triggered
    by memcg reclaim if the legacy cgroup v1 use_hierarchy=0 mode is used:
    
      BUG: unable to handle kernel NULL pointer dereference at 0000000000000120
      PGD 8000001ff55da067 P4D 8000001ff55da067 PUD 1fdc7df067 PMD 0
      Oops: 0000 [#4] SMP PTI
      CPU: 0 PID: 15581 Comm: bash Tainted: G      D 4.17.0-smp-clean #5
      Hardware name: ...
      RIP: 0010:mem_cgroup_protected+0x54/0x130
      Code: 4c 8b 8e 00 01 00 00 4c 8b 86 08 01 00 00 48 8d 8a 08 ff ff ff 48 85 d2 ba 00 00 00 00 48 0f 44 ca 48 39 c8 0f 84 cf 00 00 00 <48> 8b 81 20 01 00 00 4d 89 ca 4c 39 c8 4c 0f 46 d0 4d 85 d2 74 05
      RSP: 0000:ffffabe64dfafa58 EFLAGS: 00010286
      RAX: ffff9fb6ff03d000 RBX: ffff9fb6f5b1b000 RCX: 0000000000000000
      RDX: 0000000000000000 RSI: ffff9fb6f5b1b000 RDI: ffff9fb6f5b1b000
      RBP: ffffabe64dfafb08 R08: 0000000000000000 R09: 0000000000000000
      R10: 0000000000000000 R11: 000000000000c800 R12: ffffabe64dfafb88
      R13: ffff9fb6f5b1b000 R14: ffffabe64dfafb88 R15: ffff9fb77fffe000
      FS:  00007fed1f8ac700(0000) GS:ffff9fb6ff400000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000000000000120 CR3: 0000001fdcf86003 CR4: 00000000001606f0
      Call Trace:
       ? shrink_node+0x194/0x510
       do_try_to_free_pages+0xfd/0x390
       try_to_free_mem_cgroup_pages+0x123/0x210
       try_charge+0x19e/0x700
       mem_cgroup_try_charge+0x10b/0x1a0
       wp_page_copy+0x134/0x5b0
       do_wp_page+0x90/0x460
       __handle_mm_fault+0x8e3/0xf30
       handle_mm_fault+0xfe/0x220
       __do_page_fault+0x262/0x500
       do_page_fault+0x28/0xd0
       ? page_fault+0x8/0x30
       page_fault+0x1e/0x30
      RIP: 0033:0x485b72
    
    The problem happens because parent_mem_cgroup() returns a NULL pointer,
    which is dereferenced later without a check.
    
    As cgroup v1 has no memory guarantee support, let's make
    mem_cgroup_protected() immediately return MEMCG_PROT_NONE, if the given
    cgroup has no parent (non-hierarchical mode is used).
    
    Link: http://lkml.kernel.org/r/20180611175418.7007-2-guro@fb.com
    Fixes: bf8d5d52 ("memcg: introduce memory.min")
    Signed-off-by: default avatarRoman Gushchin <guro@fb.com>
    Reported-by: default avatarShakeel Butt <shakeelb@google.com>
    Tested-by: default avatarShakeel Butt <shakeelb@google.com>
    Tested-by: default avatarJohn Stultz <john.stultz@linaro.org>
    Acked-by: default avatarJohannes Weiner <hannes@cmpxchg.org>
    Acked-by: default avatarMichal Hocko <mhocko@kernel.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    df2a4196
memcontrol.c 162 KB