Skip to contentSkip to conversation

memcg: null dereference on allocation failure

PATCH In review Dan Carpenter 4 participants 4 messages Oct 28, 2010 – Oct 29, 2010

Subsystems (3)
Memory management Kernel janitors memcg
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 memcg: null dereference on allocation failure

The original code had a null dereference if alloc_percpu() failed. This was introduced in 711d3d2c9bc3 "memcg: cpu hotplug aware percpu count updates"

Signed-off-by Dan Carpenter <[email protected]>
mm/memcontrol.c +9 -7
index 9a99cfa..2efa8ea 100644
@@ -4208,15 +4208,17 @@ static struct mem_cgroup *mem_cgroup_alloc(void)
 
 	memset(mem, 0, size);
 	mem->stat = alloc_percpu(struct mem_cgroup_stat_cpu);
-	if (!mem->stat) {
-		if (size < PAGE_SIZE)
-			kfree(mem);
-		else
-			vfree(mem);
-		mem = NULL;
-	}
+	if (!mem->stat)
+		goto out_free;
 	spin_lock_init(&mem->pcp_counter_lock);
 	return mem;
+
+out_free:
+	if (size < PAGE_SIZE)
+		kfree(mem);
+	else
+		vfree(mem);
+	return NULL;
 }
 
 /*
Reviewed-by on v1 1/1
#1 lore raw
Quoted 23 lines · Dan Carpenter

The original code had a null dereference if alloc_percpu() failed. This was introduced in 711d3d2c9bc3 "memcg: cpu hotplug aware percpu count updates"

Signed-off-by Dan Carpenter <[email protected]>
mm/memcontrol.c +2 -7
index 9a99cfa..2efa8ea 100644
@@ -4208,15 +4208,17 @@ static struct mem_cgroup *mem_cgroup_alloc(void)
 
 	memset(mem, 0, size);
 	mem->stat = alloc_percpu(struct mem_cgroup_stat_cpu);
-	if (!mem->stat) {
-		if (size < PAGE_SIZE)
-			kfree(mem);
-		else
-			vfree(mem);
-		mem = NULL;
-	}
+	if (!mem->stat)
+		goto out_free;

mm/memcontrol.c static struct mem_cgroup *mem_cgroup_alloc(void) · line 4222

Quoted 10 lines
mm/memcontrol.c +7 -0
 	spin_lock_init(&mem->pcp_counter_lock);
 	return mem;
+
+out_free:
+	if (size < PAGE_SIZE)
+		kfree(mem);
+	else
+		vfree(mem);
+	return NULL;
 }

Good catch!

Reviewed-by Balbir Singh <[email protected]>
Signature · 8 lines
	Three Cheers,
	Balbir

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to [email protected].  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>
Acked-by on v1 1/1
#3 lore raw
In reply to Dan Carpenter

(I add Andrew to CC-list)

Quoted 6 lines · On Thu, 28 Oct 2010 13:12:41 +0200 Dan Carpenter <[email protected]> wrote:

The original code had a null dereference if alloc_percpu() failed. This was introduced in 711d3d2c9bc3 "memcg: cpu hotplug aware percpu count updates"

Signed-off-by Dan Carpenter <[email protected]>
Acked-by Daisuke Nishimura <[email protected]>
Quoted 29 lines
mm/memcontrol.c +9 -7
index 9a99cfa..2efa8ea 100644
@@ -4208,15 +4208,17 @@ static struct mem_cgroup *mem_cgroup_alloc(void)
 
 	memset(mem, 0, size);
 	mem->stat = alloc_percpu(struct mem_cgroup_stat_cpu);
-	if (!mem->stat) {
-		if (size < PAGE_SIZE)
-			kfree(mem);
-		else
-			vfree(mem);
-		mem = NULL;
-	}
+	if (!mem->stat)
+		goto out_free;
 	spin_lock_init(&mem->pcp_counter_lock);
 	return mem;
+
+out_free:
+	if (size < PAGE_SIZE)
+		kfree(mem);
+	else
+		vfree(mem);
+	return NULL;
 }
 
 /*