KAMEZAWA Hiroyuki ebb76ce16d memcg: fix wrong VM_BUG_ON() in try_charge()'s mm->owner check ...

At __mem_cgroup_try_charge(), VM_BUG_ON(!mm->owner) is checked.
But as commented in mem_cgroup_from_task(), mm->owner can be NULL
in some racy case. This check of VM_BUG_ON() is bad.

A possible story to hit this is at swapoff()->try_to_unuse(). It passes
mm_struct to mem_cgroup_try_charge_swapin() while mm->owner is NULL. If we
can't get proper mem_cgroup from swap_cgroup information, mm->owner is used
as charge target and we see NULL.

Cc: Daisuke Nishimura <[email protected]>
Cc: KOSAKI Motohiro <[email protected]>
Reported-by: Hugh Dickins <[email protected]>
Reported-by: Thomas Meyer <[email protected]>
Signed-off-by: KAMEZAWA Hiroyuki <[email protected]>
Reviewed-by: Balbir Singh <[email protected]>
Signed-off-by: Hugh Dickins <[email protected]>
Cc: [email protected]
Signed-off-by: Linus Torvalds <[email protected]>

2010-12-30 10:07:06 -08:00

..

backing-dev.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6

2010-10-26 17:58:44 -07:00

bootmem.c

x86, memblock: Replace e820_/_early string with memblock_

2010-08-27 11:13:47 -07:00

bounce.c

bounce: call flush_dcache_page() after bounce_copy_vec()

2010-09-09 18:57:25 -07:00

compaction.c

mm/compaction.c: avoid double mem_cgroup_del_lru()

2010-12-22 19:43:33 -08:00

debug-pagealloc.c

…

dmapool.c

mm: add a might_sleep_if() to dma_pool_alloc()

2010-10-26 16:52:08 -07:00

fadvise.c

…

failslab.c

…

filemap_xip.c

…

filemap.c

Call the filesystem back whenever a page is removed from the page cache

2010-12-02 09:55:21 -05:00

fremap.c

Avoid pgoff overflow in remap_file_pages

2010-09-25 09:34:58 -07:00

highmem.c

mm,x86: fix kmap_atomic_push vs ioremap_32.c

2010-10-27 18:03:05 -07:00

hugetlb.c

mm/hugetlb.c: avoid double unlock_page() in hugetlb_fault()

2010-12-02 14:51:14 -08:00

hwpoison-inject.c

HWPOISON, hugetlb: support hwpoison injection for hugepage

2010-08-11 09:23:11 +02:00

init-mm.c

mm: provide init_mm mm_context initializer

2010-08-09 20:44:54 -07:00

internal.h

mm: fix is_mem_section_removable() page_order BUG_ON check

2010-10-26 16:52:11 -07:00

Kconfig

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu

2010-10-22 17:31:36 -07:00

Kconfig.debug

…

kmemcheck.c

…

kmemleak-test.c

…

kmemleak.c

…

ksm.c

ksm: annotate ksm_thread_mutex is no deadlock source

2010-12-02 14:51:15 -08:00

maccess.c

MN10300: Save frame pointer in thread_info struct rather than global var

2010-10-27 17:29:01 +01:00

madvise.c

…

Makefile

percpu: use percpu allocator on UP too

2010-10-02 10:26:05 +03:00

memblock.c

memblock: Annotate memblock functions with __init_memblock

2010-10-11 16:00:52 -07:00

memcontrol.c

memcg: fix wrong VM_BUG_ON() in try_charge()'s mm->owner check

2010-12-30 10:07:06 -08:00

memory_hotplug.c

mem-hotplug: introduce {un}lock_memory_hotplug()

2010-12-02 14:51:15 -08:00

memory-failure.c

mem-hotplug: introduce {un}lock_memory_hotplug()

2010-12-02 14:51:15 -08:00

memory.c

use clear_page()/copy_page() in favor of memset()/memcpy() on whole pages

2010-10-26 16:52:13 -07:00

mempolicy.c

mm/mempolicy.c: add rcu read lock to protect pid structure

2010-12-02 14:51:14 -08:00

mempool.c

…

migrate.c

mm/migrate.c: fix compilation error

2010-12-22 19:43:34 -08:00

mincore.c

…

mlock.c

mm: Move vma_stack_continue into mm.h

2010-09-09 09:05:06 -07:00

mm_init.c

…

mmap.c

install_special_mapping skips security_file_mmap check.

2010-12-15 12:30:36 -08:00

mmu_context.c

…

mmu_notifier.c

…

mmzone.c

mm: page allocator: calculate a better estimate of NR_FREE_PAGES when memory is low and kswapd is awake

2010-09-09 18:57:25 -07:00

mprotect.c

perf_events: Fix perf_counter_mmap() hook in mprotect()

2010-11-09 10:19:38 -08:00

mremap.c

mm: remove pte_*map_nested()

2010-10-26 16:52:08 -07:00

msync.c

…

nommu.c

nommu: Provide stubbed alloc/free_vm_area() implementation.

2010-12-24 12:08:30 +09:00

oom_kill.c

oom: kill all threads sharing oom killed task's mm

2010-10-26 16:52:05 -07:00

page_alloc.c

PM / Hibernate: Fix memory corruption related to swap

2010-12-06 23:52:08 +01:00

page_cgroup.c

…

page_io.c

…

page_isolation.c

mm: page_isolation: codeclean fix comment and rm unneeded val init

2010-10-26 16:52:11 -07:00

page-writeback.c

writeback: do uninterruptible sleep in balance_dirty_pages()

2010-12-22 19:43:33 -08:00

pagewalk.c

mm: remove call to find_vma in pagewalk for non-hugetlbfs

2010-11-25 06:50:46 +09:00

percpu-km.c

percpu: clear memory allocated with the km allocator

2010-10-02 10:28:42 +03:00

percpu-vm.c

…

percpu.c

percpu: print out alloc information with KERN_DEBUG instead of KERN_INFO

2010-12-22 14:19:14 +01:00

prio_tree.c

…

quicklist.c

…

readahead.c

…

rmap.c

rmap: make anon_vma_chain_free() static

2010-10-26 16:52:10 -07:00

shmem.c

convert get_sb_nodev() users

2010-10-29 04:16:31 -04:00

slab.c

replace nested max/min macros with {max,min}3 macro

2010-10-26 16:52:12 -07:00

slob.c

slob: fix gfp flags for order-0 page allocations

2010-10-02 10:24:28 +03:00

slub.c

slub: Fix a crash during slabinfo -v

2010-12-04 09:53:49 +02:00

sparse-vmemmap.c

x86: Use memblock to replace early_res

2010-08-27 11:12:29 -07:00

sparse.c

…

swap_state.c

…

swap.c

fuse: use release_pages()

2010-10-27 18:03:17 -07:00

swapfile.c

/proc/swaps: support polling

2010-10-26 16:52:11 -07:00

thrash.c

…

truncate.c

Call the filesystem back whenever a page is removed from the page cache

2010-12-02 09:55:21 -05:00

util.c

export __get_user_pages_fast() function

2010-10-24 10:51:24 +02:00

vmalloc.c

vmalloc: eagerly clear ptes on vunmap

2010-12-02 14:51:15 -08:00

vmscan.c

Call the filesystem back whenever a page is removed from the page cache

2010-12-02 09:55:21 -05:00

vmstat.c

vmstat: fix dirty threshold ordering

2010-12-02 14:51:14 -08:00