Skip to content
This repository

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse code

page_cgroup: fix horrid swap accounting regression

Why is memcg's swap accounting so broken? Insane counts, wrong
ownership, unfreeable structures, which later get freed and then
accessed after free.

Turns out to be a tiny a little 3.3-rc1 regression in 9fb4b7c
"page_cgroup: add helper function to get swap_cgroup": the helper
function (actually named lookup_swap_cgroup()) returns an address using
void* arithmetic, but the structure in question is a short.

Signed-off-by: Hugh Dickins <hughd@google.com>
Reviewed-by: Bob Liu <lliubbo@gmail.com>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Johannes Weiner <jweiner@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  • Loading branch information...
commit c09ff089aa62380ad904ea785bd713c56720270e 1 parent f3969bf
authored March 05, 2012 torvalds committed March 06, 2012

Showing 1 changed file with 3 additions and 1 deletion. Show diff stats Hide diff stats

  1. 4  mm/page_cgroup.c
4  mm/page_cgroup.c
@@ -379,13 +379,15 @@ static struct swap_cgroup *lookup_swap_cgroup(swp_entry_t ent,
379 379
 	pgoff_t offset = swp_offset(ent);
380 380
 	struct swap_cgroup_ctrl *ctrl;
381 381
 	struct page *mappage;
  382
+	struct swap_cgroup *sc;
382 383
 
383 384
 	ctrl = &swap_cgroup_ctrl[swp_type(ent)];
384 385
 	if (ctrlp)
385 386
 		*ctrlp = ctrl;
386 387
 
387 388
 	mappage = ctrl->map[offset / SC_PER_PAGE];
388  
-	return page_address(mappage) + offset % SC_PER_PAGE;
  389
+	sc = page_address(mappage);
  390
+	return sc + offset % SC_PER_PAGE;
389 391
 }
390 392
 
391 393
 /**

0 notes on commit c09ff08

Please sign in to comment.
Something went wrong with that request. Please try again.