[Devel,rh7] mm/memcg: fix crashes on migrating THP.

Submitted by Andrey Ryabinin on Aug. 14, 2017, 1:16 p.m.

Details

Message ID 20170814131614.3357-1-aryabinin@virtuozzo.com
State New
Series "mm/memcg: fix crashes on migrating THP."
Headers show

Commit Message

Andrey Ryabinin Aug. 14, 2017, 1:16 p.m.
memcg_numa_isolate_pages() calls list_del() inside list_for_each_entry()
causing crashes. Use list_for_each_entry_safe() instead as it's safe
against removal of list entries.

https://jira.sw.ru/browse/PSBM-69999
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
---
 mm/memcontrol.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Patch hide | download patch | download mbox

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 5ab5e82c924e..7e4d7e534cd2 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4924,7 +4924,7 @@  static long memcg_numa_isolate_pages(struct lruvec *lruvec, enum lru_list lru,
 {
 	struct list_head *src = &lruvec->lists[lru];
 	struct zone *zone = lruvec_zone(lruvec);
-	struct page *page;
+	struct page *page, *tmp;
 	long scanned = 0, taken = 0;
 
 	spin_lock_irq(&zone->lru_lock);
@@ -4954,7 +4954,7 @@  static long memcg_numa_isolate_pages(struct lruvec *lruvec, enum lru_list lru,
 	__mod_zone_page_state(zone, NR_ISOLATED_ANON + is_file_lru(lru), taken);
 	spin_unlock_irq(&zone->lru_lock);
 
-	list_for_each_entry(page, dst, lru) {
+	list_for_each_entry_safe(page, tmp, dst, lru) {
 		if (PageTransHuge(page) && split_huge_page_to_list(page, dst)) {
 			list_del(&page->lru);
 			mod_zone_page_state(zone, NR_ISOLATED_ANON,