memcg: css_id() must be called under rcu_read_lock()

This patch fixes task_in_mem_cgroup(), mem_cgroup_uncharge_swapcache(),
mem_cgroup_move_swap_account(), and is_target_pte_for_mc() to protect
calls to css_id().  An additional RCU lockdep splat was reported for
memcg_oom_wake_function(), however, this function is not yet in
mainline as of 2.6.34-rc5.

Reported-by: Li Zefan <lizf@cn.fujitsu.com>
Cc: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
Cc: Balbir Singh <balbir@linux.vnet.ibm.com>
Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Tested-by: Li Zefan <lizf@cn.fujitsu.com>
Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Andrew Morton <akpm@linux-foundation.org>

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index f4ede99c8b9b5671841021afe04d82bd32dfbda0..e06490d4ae5e3b3b2d0e3f466f5b0edc66f0100c 100644 (file)
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -811,10 +811,12 @@ int task_in_mem_cgroup(struct task_struct *task, const struct mem_cgroup *mem)
         * enabled in "curr" and "curr" is a child of "mem" in *cgroup*
         * hierarchy(even if use_hierarchy is disabled in "mem").
         */
+       rcu_read_lock();
        if (mem->use_hierarchy)
                ret = css_is_ancestor(&curr->css, &mem->css);
        else
                ret = (curr == mem);
+       rcu_read_unlock();
        css_put(&curr->css);
        return ret;
 }
@@ -2312,7 +2314,9 @@ mem_cgroup_uncharge_swapcache(struct page *page, swp_entry_t ent, bool swapout)
 
        /* record memcg information */
        if (do_swap_account && swapout && memcg) {
+               rcu_read_lock();
                swap_cgroup_record(ent, css_id(&memcg->css));
+               rcu_read_unlock();
                mem_cgroup_get(memcg);
        }
        if (swapout && memcg)
@@ -2369,8 +2373,10 @@ static int mem_cgroup_move_swap_account(swp_entry_t entry,
 {
        unsigned short old_id, new_id;
 
+       rcu_read_lock();
        old_id = css_id(&from->css);
        new_id = css_id(&to->css);
+       rcu_read_unlock();
 
        if (swap_cgroup_cmpxchg(entry, old_id, new_id) == old_id) {
                mem_cgroup_swap_statistics(from, false);
@@ -4038,11 +4044,16 @@ static int is_target_pte_for_mc(struct vm_area_struct *vma,
                        put_page(page);
        }
        /* throught */
-       if (ent.val && do_swap_account && !ret &&
-                       css_id(&mc.from->css) == lookup_swap_cgroup(ent)) {
-               ret = MC_TARGET_SWAP;
-               if (target)
-                       target->ent = ent;
+       if (ent.val && do_swap_account && !ret) {
+               unsigned short id;
+               rcu_read_lock();
+               id = css_id(&mc.from->css);
+               rcu_read_unlock();
+               if (id == lookup_swap_cgroup(ent)) {
+                       ret = MC_TARGET_SWAP;
+                       if (target)
+                               target->ent = ent;
+               }
        }
        return ret;
 }