[PATCH] cgroup/dmem: Don't clobber pool in dmem_cgroup_calculate_protection

Friedrich Vock
2025-01-14T15:39:38Z

If the current css doesn't contain any pool that is a descendant of
the "pool" (i.e. when found_descendant == false), then "pool" will
point to some unrelated pool. If the current css has a child, we'll
overwrite parent_pool with this unrelated pool on the next iteration.

Fix this by overwriting "pool" only if it actually is a descendant of
parent_pool, and setting it to NULL otherwise. Also, skip traversing
subtrees if pool == NULL to avoid overwriting parent_pool (and because
it's pointless).

Fixes: b168ed458 ("kernel/cgroup: Add "dmem" memory accounting cgroup")
Signed-off-by: Friedrich Vock <friedrich.vock@gmx.de>
---
kernel/cgroup/dmem.c | 21 +++++++++++++--------
1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/kernel/cgroup/dmem.c b/kernel/cgroup/dmem.c
index 52736ef0ccf25..10d37df5d50f6 100644
--- a/kernel/cgroup/dmem.c
+++ b/kernel/cgroup/dmem.c
@@ -222,8 +222,7 @@ dmem_cgroup_calculate_protection(struct dmem_cgroup_pool_state *limit_pool,
struct page_counter *climit;
struct cgroup_subsys_state *css, *next_css;
struct dmemcg_state *dmemcg_iter;
- struct dmem_cgroup_pool_state *pool, *parent_pool;
- bool found_descendant;
+ struct dmem_cgroup_pool_state *pool, *candidate_pool, *parent_pool;

climit = &limit_pool->cnt;

@@ -241,7 +240,13 @@ dmem_cgroup_calculate_protection(struct dmem_cgroup_pool_state *limit_pool,
*/
while (pool != test_pool) {
next_css = css_next_child(NULL, css);
- if (next_css) {
+ /*
+ * pool is NULL when the current css does not contain a
+ * pool of the type we're interested in. In that case, it's
+ * impossible that any child css contains a relevant pool, so
+ * skip the subtree entirely and move on to the next sibling.
+ */
+ if (next_css && pool) {
parent_pool = pool;
} else {
while (css != &limit_pool->cs->css) {
@@ -260,16 +265,16 @@ dmem_cgroup_calculate_protection(struct dmem_cgroup_pool_state *limit_pool,
}
css = next_css;

- found_descendant = false;
dmemcg_iter = container_of(css, struct dmemcg_state, css);

- list_for_each_entry_rcu(pool, &dmemcg_iter->pools, css_node) {
- if (pool_parent(pool) == parent_pool) {
- found_descendant = true;
+ pool = NULL;
+ list_for_each_entry_rcu(candidate_pool, &dmemcg_iter->pools, css_node) {
+ if (pool_parent(candidate_pool) == parent_pool) {
+ pool = candidate_pool;
break;
}
}
- if (!found_descendant)
+ if (!pool)
continue;

page_counter_calculate_protection(
--
2.48.0