• Daisuke Nishimura's avatar
    memcg: ensure list is empty at rmdir · fce66477
    Daisuke Nishimura authored
    Current mem_cgroup_force_empty() only ensures mem->res.usage == 0 on
    success.  But this doesn't guarantee memcg's LRU is really empty, because
    there are some cases in which !PageCgrupUsed pages exist on memcg's LRU.
    
    For example:
    - Pages can be uncharged by its owner process while they are on LRU.
    - race between mem_cgroup_add_lru_list() and __mem_cgroup_uncharge_common().
    
    So there can be a case in which the usage is zero but some of the LRUs are not empty.
    
    OTOH, mem_cgroup_del_lru_list(), which can be called asynchronously with
    rmdir, accesses the mem_cgroup, so this access can cause a problem if it
    races with rmdir because the mem_cgroup might have been freed by rmdir.
    
    Actually, I saw a bug which seems to be caused by this race.
    
    	[1530745.949906] BUG: unable to handle kernel NULL pointer dereference at 0000000000000230
    	[1530745.950651] IP: [<ffffffff810fbc11>] mem_cgroup_del_lru_list+0x30/0x80
    	[1530745.950651] PGD 3863de067 PUD 3862c7067 PMD 0
    	[1530745.950651]...
    fce66477
memcontrol.c 86 KB