summaryrefslogtreecommitdiffstats
path: root/mm
diff options
context:
space:
mode:
authorMichal Hocko <mhocko@suse.com>2018-04-10 16:29:52 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2018-04-11 10:28:32 -0700
commit4eaf431f6f71bbed40a4c733ffe93a7e8cedf9d9 (patch)
treeb4121b55c22e052d0847796ad22574eaedf281d6 /mm
parenta06ad633a37c64a0cd4c229fc605cee8725d376e (diff)
downloadlinux-4eaf431f6f71bbed40a4c733ffe93a7e8cedf9d9.tar.bz2
memcg: fix per_node_info cleanup
syzbot has triggered a NULL ptr dereference when allocation fault injection enforces a failure and alloc_mem_cgroup_per_node_info initializes memcg->nodeinfo only half way through. But __mem_cgroup_free still tries to free all per-node data and dereferences pn->lruvec_stat_cpu unconditioanlly even if the specific per-node data hasn't been initialized. The bug is quite unlikely to hit because small allocations do not fail and we would need quite some numa nodes to make struct mem_cgroup_per_node large enough to cross the costly order. Link: http://lkml.kernel.org/r/20180406100906.17790-1-mhocko@kernel.org Reported-by: syzbot+8a5de3cce7cdc70e9ebe@syzkaller.appspotmail.com Fixes: 00f3ca2c2d66 ("mm: memcontrol: per-lruvec stats infrastructure") Signed-off-by: Michal Hocko <mhocko@suse.com> Reviewed-by: Andrey Ryabinin <aryabinin@virtuozzo.com> Cc: Johannes Weiner <hannes@cmpxchg.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'mm')
-rw-r--r--mm/memcontrol.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index f314334546a2..7978c6faae06 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4108,6 +4108,9 @@ static void free_mem_cgroup_per_node_info(struct mem_cgroup *memcg, int node)
{
struct mem_cgroup_per_node *pn = memcg->nodeinfo[node];
+ if (!pn)
+ return;
+
free_percpu(pn->lruvec_stat_cpu);
kfree(pn);
}