Michal Hocko 2bcf2e92c3 memcg: oom_notify use-after-free fix ...

Paul Furtado has reported the following GPF:

  general protection fault: 0000 [#1] SMP
  Modules linked in: ipv6 dm_mod xen_netfront coretemp hwmon x86_pkg_temp_thermal crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel ablk_helper cryptd lrw gf128mul glue_helper aes_x86_64 microcode pcspkr ext4 jbd2 mbcache raid0 xen_blkfront
  CPU: 3 PID: 3062 Comm: java Not tainted 3.16.0-rc5 #1
  task: ffff8801cfe8f170 ti: ffff8801d2ec4000 task.ti: ffff8801d2ec4000
  RIP: e030:mem_cgroup_oom_synchronize+0x140/0x240
  RSP: e02b:ffff8801d2ec7d48  EFLAGS: 00010283
  RAX: 0000000000000001 RBX: ffff88009d633800 RCX: 000000000000000e
  RDX: fffffffffffffffe RSI: ffff88009d630200 RDI: ffff88009d630200
  RBP: ffff8801d2ec7da8 R08: 0000000000000012 R09: 00000000fffffffe
  R10: 0000000000000000 R11: 0000000000000000 R12: ffff88009d633800
  R13: ffff8801d2ec7d48 R14: dead000000100100 R15: ffff88009d633a30
  FS:  00007f1748bb4700(0000) GS:ffff8801def80000(0000) knlGS:0000000000000000
  CS:  e033 DS: 0000 ES: 0000 CR0: 000000008005003b
  CR2: 00007f4110300308 CR3: 00000000c05f7000 CR4: 0000000000002660
  Call Trace:
    pagefault_out_of_memory+0x18/0x90
    mm_fault_error+0xa9/0x1a0
    __do_page_fault+0x478/0x4c0
    do_page_fault+0x2c/0x40
    page_fault+0x28/0x30
  Code: 44 00 00 48 89 df e8 40 ca ff ff 48 85 c0 49 89 c4 74 35 4c 8b b0 30 02 00 00 4c 8d b8 30 02 00 00 4d 39 fe 74 1b 0f 1f 44 00 00 <49> 8b 7e 10 be 01 00 00 00 e8 42 d2 04 00 4d 8b 36 4d 39 fe 75
  RIP  mem_cgroup_oom_synchronize+0x140/0x240

Commit fb2a6fc56b ("mm: memcg: rework and document OOM waiting and
wakeup") has moved mem_cgroup_oom_notify outside of memcg_oom_lock
assuming it is protected by the hierarchical OOM-lock.

Although this is true for the notification part the protection doesn't
cover unregistration of event which can happen in parallel now so
mem_cgroup_oom_notify can see already unlinked and/or freed
mem_cgroup_eventfd_list.

Fix this by using memcg_oom_lock also in mem_cgroup_oom_notify.

Addresses https://bugzilla.kernel.org/show_bug.cgi?id=80881

Fixes: fb2a6fc56b (mm: memcg: rework and document OOM waiting and wakeup)
Signed-off-by: Michal Hocko <mhocko@suse.cz>
Reported-by: Paul Furtado <paulfurtado91@gmail.com>
Tested-by: Paul Furtado <paulfurtado91@gmail.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: <stable@vger.kernel.org>	[3.12+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

2014-07-30 17:16:13 -07:00

..

backing-dev.c

arch: Mass conversion of smp_mb__*()

2014-04-18 14:20:48 +02:00

balloon_compaction.c

mm: print more details for bad_page()

2014-01-23 16:36:50 -08:00

bootmem.c

mm/bootmem.c: remove unused local `map'

2013-11-13 12:09:09 +09:00

cleancache.c

mm: dump page when hitting a VM_BUG_ON using VM_BUG_ON_PAGE

2014-01-23 16:36:50 -08:00

compaction.c

mm, compaction: properly signal and act upon lock and need_sched() contention

2014-06-04 16:54:11 -07:00

debug-pagealloc.c

mm, x86: Remove debug_pagealloc_enabled

2011-12-06 09:24:07 +01:00

dmapool.c

mm/dmapool.c: reuse devres_release() to free resources

2014-06-04 16:54:08 -07:00

early_ioremap.c

mm: create generic early_ioremap() support

2014-04-07 16:36:15 -07:00

fadvise.c

teach SYSCALL_DEFINE<n> how to deal with long long/unsigned long long

2013-03-03 22:46:22 -05:00

failslab.c

switch debugfs to umode_t

2012-01-03 22:54:56 -05:00

filemap_xip.c

seqcount: Add lockdep functionality to seqcount/seqlock structures

2013-11-06 12:40:26 +01:00

filemap.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2014-06-12 10:30:18 -07:00

fremap.c

mm: mark remap_file_pages() syscall as deprecated

2014-06-06 16:08:17 -07:00

frontswap.c

swap: change swap_list_head to plist, add swap_avail_head

2014-06-04 16:54:07 -07:00

gup.c

mm: cleanup __get_user_pages()

2014-06-04 16:54:05 -07:00

highmem.c

Merge tag 'virtio-next-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux

2012-12-20 08:37:05 -08:00

huge_memory.c

mm: let mm_find_pmd fix buggy race with THP fault

2014-06-23 16:47:44 -07:00

hugetlb_cgroup.c

cgroup: remove css_parent()

2014-05-16 13:22:48 -04:00

hugetlb.c

mm: hugetlb: fix copy_hugetlb_page_range()

2014-07-23 15:10:55 -07:00

hwpoison-inject.c

mm/hwpoison: add '#' to hwpoison_inject

2014-01-21 16:19:48 -08:00

init-mm.c

atomic: use <linux/atomic.h>

2011-07-26 16:49:47 -07:00

internal.h

mm, compaction: properly signal and act upon lock and need_sched() contention

2014-06-04 16:54:11 -07:00

interval_tree.c

mm: add CONFIG_DEBUG_VM_RB build option

2012-10-09 16:22:42 +09:00

iov_iter.c

bio_vec-backed iov_iter

2014-05-06 17:39:45 -04:00

Kconfig

mm/zsmalloc: make zsmalloc module-buildable

2014-06-04 16:54:14 -07:00

Kconfig.debug

mm: more intensive memory corruption debugging

2012-01-10 16:30:42 -08:00

kmemcheck.c

kmemcheck: Fix build errors due to missing slab.h

2010-03-30 22:02:32 +09:00

kmemleak-test.c

mm/kmemleak-test.c: use pr_fmt for logging

2014-06-06 16:08:18 -07:00

kmemleak.c

mm: introduce kmemleak_update_trace()

2014-06-06 16:08:17 -07:00

ksm.c

mm: let mm_find_pmd fix buggy race with THP fault

2014-06-23 16:47:44 -07:00

list_lru.c

mm: keep page cache radix tree nodes in check

2014-04-03 16:21:01 -07:00

maccess.c

mm: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

madvise.c

mm: madvise: fix MADV_WILLNEED on shmem swapouts

2014-05-23 09:37:29 -07:00

Makefile

mm: move get_user_pages()-related code to separate file

2014-06-04 16:54:04 -07:00

memblock.c

mm/memblock.c: call kmemleak directly from memblock_(alloc|free)

2014-06-06 16:08:17 -07:00

memcontrol.c

memcg: oom_notify use-after-free fix

2014-07-30 17:16:13 -07:00

memory_hotplug.c

mm, migration: add destination page freeing callback

2014-06-04 16:54:06 -07:00

memory-failure.c

hwpoison: call action_result() in failure path of hwpoison_user_mappings()

2014-07-30 17:16:13 -07:00

memory.c

mm: do not call do_fault_around for non-linear fault

2014-07-23 15:10:54 -07:00

mempolicy.c

Merge branch 'for-3.16-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup

2014-07-10 11:38:23 -07:00

mempool.c

mm/mempool.c: update the kmemleak stack trace for mempool allocations

2014-06-06 16:08:17 -07:00

migrate.c

mm: fix direct reclaim writeback regression

2014-07-26 14:38:50 -07:00

mincore.c

mm + fs: prepare for non-page entries in page cache radix trees

2014-04-03 16:21:00 -07:00

mlock.c

mm: try_to_unmap_cluster() should lock_page() before mlocking

2014-04-07 16:35:57 -07:00

mm_init.c

mm: bring back /sys/kernel/mm

2014-01-27 21:02:39 -08:00

mmap.c

mm: convert some level-less printks to pr_*

2014-06-06 16:08:18 -07:00

mmu_context.c

sched/mm: call finish_arch_post_lock_switch in idle_task_exit and use_mm

2014-02-21 08:50:17 +01:00

mmu_notifier.c

mm: audit/fix non-modular users of module_init in core code

2014-01-23 16:36:52 -08:00

mmzone.c

mm: numa: Change page last {nid,pid} into {cpu,pid}

2013-10-09 14:47:45 +02:00

mprotect.c

mm: move mmu notifier call from change_protection to change_pmd_range

2014-04-07 16:35:50 -07:00

mremap.c

mm, thp: close race between mremap() and split_huge_page()

2014-05-11 17:55:48 +09:00

msync.c

msync: fix incorrect fstart calculation

2014-07-03 09:21:53 -07:00

nobootmem.c

mm/memblock.c: call kmemleak directly from memblock_(alloc|free)

2014-06-06 16:08:17 -07:00

nommu.c

mm: nommu: per-thread vma cache fix

2014-06-23 16:47:43 -07:00

oom_kill.c

mm, oom: base root bonus on current usage

2014-01-30 16:56:56 -08:00

page_alloc.c

mm, thp: do not allow thp faults to avoid cpuset restrictions

2014-07-30 17:16:13 -07:00

page_cgroup.c

mm/page_cgroup.c: mark functions as static

2014-04-03 16:21:02 -07:00

page_io.c

fix __swap_writepage() compile failure on old gcc versions

2014-06-14 19:30:48 -05:00

page_isolation.c

mm: memory-hotplug: enable memory hotplug to handle hugepage

2013-09-11 15:57:48 -07:00

page-writeback.c

mm/page-writeback.c: fix divide by zero in bdi_dirty_limits()

2014-07-30 17:16:13 -07:00

pagewalk.c

mm/pagewalk.c: fix walk_page_range() access of wrong PTEs

2013-10-30 14:27:03 -07:00

percpu-km.c

percpu: clear memory allocated with the km allocator

2010-10-02 10:28:42 +03:00

percpu-vm.c

mm: fix kernel-doc warnings

2012-06-20 14:39:36 -07:00

percpu.c

percpu: make pcpu_alloc_chunk() use pcpu_mem_free() instead of kfree()

2014-04-14 16:18:06 -04:00

pgtable-generic.c

mm: fix TLB flush race between migration, and change_protection_range

2013-12-18 19:04:51 -08:00

process_vm_access.c

start adding the tag to iov_iter

2014-05-06 17:32:49 -04:00

quicklist.c

mm: delete various needless include <linux/module.h>

2011-10-31 09:20:11 -04:00

readahead.c

mm/readahead.c: inline ra_submit

2014-04-07 16:35:58 -07:00

rmap.c

mm/rmap.c: fix pgoff calculation to handle hugepage correctly

2014-07-23 15:10:54 -07:00

shmem.c

shmem: fix splicing from a hole while it's punched

2014-07-23 15:10:55 -07:00

slab_common.c

Merge branch 'slab/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/linux into for-3.16-rcX

2014-07-22 18:38:27 -04:00

slab.c

slab: fix oops when reading /proc/slab_allocators

2014-06-23 16:47:44 -07:00

slab.h

memcg, slab: merge memcg_{bind,release}_pages to memcg_{un}charge_slab

2014-06-04 16:54:01 -07:00

slob.c

slab: get_online_mems for kmem_cache_{create,destroy,shrink}

2014-06-04 16:53:59 -07:00

slub.c

slub: fix off by one in number of slab tests

2014-07-03 09:21:53 -07:00

sparse-vmemmap.c

mm/sparse: use memblock apis for early memory allocations

2014-01-21 16:19:47 -08:00

sparse.c

mm: use macros from compiler.h instead of __attribute__((...))

2014-04-07 16:35:54 -07:00

swap_state.c

mm: page_alloc: convert hot/cold parameter and immediate callers to bool

2014-06-04 16:54:09 -07:00

swap.c

mm: non-atomically mark page accessed during page cache allocation where possible

2014-06-04 16:54:10 -07:00

swapfile.c

mm/swapfile.c: delete the "last_in_cluster < scan_base" loop in the body of scan_swap_map()

2014-06-04 16:54:12 -07:00

truncate.c

mm/fs: fix pessimization in hole-punching pagecache

2014-07-23 15:10:55 -07:00

util.c

nick kvfree() from apparmor

2014-05-06 14:02:53 -04:00

vmacache.c

mm,vmacache: optimize overflow system-wide flushing

2014-06-04 16:53:57 -07:00

vmalloc.c

mm/vmalloc.c: export unmap_kernel_range()

2014-06-04 16:54:14 -07:00

vmpressure.c

arm, pm, vmpressure: add missing slab.h includes

2014-02-03 13:24:01 -05:00

vmscan.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2014-06-12 10:30:18 -07:00

vmstat.c

mm: use the light version __mod_zone_page_state in mlocked_vma_newpage()

2014-06-04 16:54:07 -07:00

workingset.c

mm: keep page cache radix tree nodes in check

2014-04-03 16:21:01 -07:00

zbud.c

mm/zbud.c: make size unsigned like unique callsite

2014-06-04 16:54:13 -07:00

zsmalloc.c

zsmalloc: fixup trivial zs size classes value in comments

2014-06-04 16:54:13 -07:00

zswap.c

mm/zswap: NUMA aware allocation for zswap_dstmem

2014-06-04 16:54:14 -07:00