Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a7fe942e authored by KAMEZAWA Hiroyuki's avatar KAMEZAWA Hiroyuki Committed by Linus Torvalds
Browse files

memcg: swapout refcnt fix 



css's refcnt is dropped before end of following access.
Hold it until end of access.

Reported-by: default avatarLi Zefan <lizf@cn.fujitsu.com>
Signed-off-by: default avatarKAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Balbir Singh <balbir@in.ibm.com>
Cc: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
Cc: Hugh Dickins <hugh@veritas.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent b85a96c0

mm/memcontrol.c

+5 −1
Original line number Diff line number Diff line
@@ -1171,6 +1171,8 @@ __mem_cgroup_uncharge_common(struct page *page, enum charge_type ctype) 
	mz = page_cgroup_zoneinfo(pc);

	unlock_page_cgroup(pc);



	/* at swapout, this memcg will be accessed to record to swap */

	if (ctype != MEM_CGROUP_CHARGE_TYPE_SWAPOUT)

		css_put(&mem->css);



	return mem;
@@ -1212,6 +1214,8 @@ void mem_cgroup_uncharge_swapcache(struct page *page, swp_entry_t ent) 
		swap_cgroup_record(ent, memcg);

		mem_cgroup_get(memcg);

	}

	if (memcg)

		css_put(&memcg->css);

}



#ifdef CONFIG_CGROUP_MEM_RES_CTLR_SWAP