From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752807AbcHQPgp (ORCPT ); Wed, 17 Aug 2016 11:36:45 -0400 Received: from mx1.redhat.com ([209.132.183.28]:51438 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752106AbcHQPgm (ORCPT ); Wed, 17 Aug 2016 11:36:42 -0400 Date: Wed, 17 Aug 2016 17:36:29 +0200 From: Oleg Nesterov To: Brenden Blanco , Ingo Molnar Cc: Johannes Weiner , Michal Hocko , Vladimir Davydov , linux-kernel@vger.kernel.org, Peter Zijlstra , Arnaldo Carvalho de Melo , Alexander Shishkin , Alexei Starovoitov Subject: [PATCH 1/2] uprobes: fix the memcg accounting Message-ID: <20160817153629.GB29724@redhat.com> References: <20160815205810.GA22619@gmail.com> <20160816141350.GA17006@redhat.com> <20160816142511.GB17006@redhat.com> <20160816143407.GC17006@redhat.com> <20160816165459.GA6687@gmail.com> <20160817153603.GA29724@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20160817153603.GA29724@redhat.com> User-Agent: Mutt/1.5.24 (2015-08-30) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.26]); Wed, 17 Aug 2016 15:36:32 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org __replace_page() wronlgy calls mem_cgroup_cancel_charge() in "success" path, it should only do this if page_check_address() fails. This means that every enable/disable leads to unbalanced mem_cgroup_uncharge() from put_page(old_page), it is trivial to underflow the page_counter->count and trigger OOM. Reported-and-tested-by: Brenden Blanco Signed-off-by: Oleg Nesterov Acked-by: Michal Hocko Reviewed-by: Johannes Weiner Fixes: 00501b531c47 ("mm: memcontrol: rewrite charge API") Cc: stable@vger.kernel.org # 3.17+ --- kernel/events/uprobes.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c index b7a525a..8c50276 100644 --- a/kernel/events/uprobes.c +++ b/kernel/events/uprobes.c @@ -172,8 +172,10 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr, mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end); err = -EAGAIN; ptep = page_check_address(page, mm, addr, &ptl, 0); - if (!ptep) + if (!ptep) { + mem_cgroup_cancel_charge(kpage, memcg, false); goto unlock; + } get_page(kpage); page_add_new_anon_rmap(kpage, vma, addr, false); @@ -200,7 +202,6 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr, err = 0; unlock: - mem_cgroup_cancel_charge(kpage, memcg, false); mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end); unlock_page(page); return err; -- 2.5.0