[BUGFIX(resend)][PATCH mmotm] memcg: fix for hierarchical reclaim

Daisuke Nishimura
2008-11-23T09:44:31Z

mem_cgroup_from_res_counter should handle both mem->res and mem->memsw.

When exceeding memory.memsw.limit_in_bytes, fail_res points to
mem_cgroup.memsw, not to mem_cgroup.res.
So, mem_cgroup_hierarchical_reclaim() would be called with
invalid mem_cgroup.

This bug leads to NULL pointer dereference BUG at mem_cgroup_calc_reclaim.

Signed-off-by: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
Tested-by: Balbir Singh <balbir@linux.vnet.ibm.com>
Acked-by: Balbir Singh <balbir@linux.vnet.ibm.com>
---
This is fix for memory-cgroup-hierarchical-reclaim-v4.patch.

mm/memcontrol.c | 23 +++++++++--------------
1 files changed, 9 insertions(+), 14 deletions(-)

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index d177ed7..ac445cf 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -468,11 +468,8 @@ unsigned long mem_cgroup_isolate_pages(unsigned long nr_to_scan,
return nr_taken;
}

-static struct mem_cgroup *
-mem_cgroup_from_res_counter(struct res_counter *counter)
-{
- return container_of(counter, struct mem_cgroup, res);
-}
+#define mem_cgroup_from_res_counter(counter, member) \
+ container_of(counter, struct mem_cgroup, member)

/*
* This routine finds the DFS walk successor. This routine should be
@@ -665,18 +662,16 @@ static int __mem_cgroup_try_charge(struct mm_struct *mm,
/* mem+swap counter fails */
res_counter_uncharge(&mem->res, PAGE_SIZE);
noswap = true;
- }
+ mem_over_limit = mem_cgroup_from_res_counter(fail_res,
+ memsw);
+ } else
+ /* mem counter fails */
+ mem_over_limit = mem_cgroup_from_res_counter(fail_res,
+ res);
+
if (!(gfp_mask & __GFP_WAIT))
goto nomem;

- /*
- * Is one of our ancestors over their limit?
- */
- if (fail_res)
- mem_over_limit = mem_cgroup_from_res_counter(fail_res);
- else
- mem_over_limit = mem;
-
ret = mem_cgroup_hierarchical_reclaim(mem_over_limit, gfp_mask,
noswap);