From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1756509AbcE0Rij (ORCPT <rfc822;w@1wt.eu>);
	Fri, 27 May 2016 13:38:39 -0400
Received: from gum.cmpxchg.org ([85.214.110.215]:56720 "EHLO gum.cmpxchg.org"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1756319AbcE0Rii (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
	Fri, 27 May 2016 13:38:38 -0400
Date: Fri, 27 May 2016 13:36:29 -0400
From: Johannes Weiner <hannes@cmpxchg.org>
To: Vladimir Davydov <vdavydov@virtuozzo.com>
Cc: Andrew Morton <akpm@linux-foundation.org>,
        Michal Hocko <mhocko@kernel.org>, linux-mm@kvack.org,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH] mm: memcontrol: fix possible css ref leak on oom
Message-ID: <20160527173629.GE2531@cmpxchg.org>
References: <1464019330-7579-1-git-send-email-vdavydov@virtuozzo.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1464019330-7579-1-git-send-email-vdavydov@virtuozzo.com>
User-Agent: Mutt/1.6.1 (2016-04-27)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Mon, May 23, 2016 at 07:02:10PM +0300, Vladimir Davydov wrote:
> mem_cgroup_oom may be invoked multiple times while a process is handling
> a page fault, in which case current->memcg_in_oom will be overwritten
> leaking the previously taken css reference.

There is a task_in_memcg_oom() check before calling mem_cgroup_oom().

How can this happen?