Oleg Nesterov f964b3b368 uprobes: Fix the memcg accounting ...

commit 6c4687cc17 upstream.

__replace_page() wronlgy calls mem_cgroup_cancel_charge() in "success" path,
it should only do this if page_check_address() fails.

This means that every enable/disable leads to unbalanced mem_cgroup_uncharge()
from put_page(old_page), it is trivial to underflow the page_counter->count
and trigger OOM.

Reported-and-tested-by: Brenden Blanco <bblanco@plumgrid.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Michal Hocko <mhocko@kernel.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vladimir Davydov <vdavydov@virtuozzo.com>
Fixes: 00501b531c ("mm: memcontrol: rewrite charge API")
Link: http://lkml.kernel.org/r/20160817153629.GB29724@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2016-09-15 08:27:53 +02:00

..

bpf

bpf, inode: disallow userns mounts

2016-06-24 10:18:17 -07:00

configs

…

debug

…

events

uprobes: Fix the memcg accounting

2016-09-15 08:27:53 +02:00

gcov

…

irq

genirq/msi: Make sure PCI MSIs are activated early

2016-09-07 08:32:38 +02:00

livepatch

…

locking

locking/qspinlock: Fix spin_unlock_wait() some more

2016-07-27 09:47:29 -07:00

power

PM / sleep: Clear pm_suspend_global_flags upon hibernate

2016-04-12 09:09:05 -07:00

printk

…

rcu

…

sched

sched/numa: Fix use-after-free bug in the task_numa_compare

2016-09-15 08:27:45 +02:00

time

timekeeping: Avoid taking lock in NMI path with CONFIG_DEBUG_TIMEKEEPING

2016-09-15 08:27:52 +02:00

trace

tracing: Handle NULL formats in hold_module_trace_bprintk_format()

2016-07-27 09:47:32 -07:00

.gitignore

…

acct.c

…

async.c

…

audit_fsnotify.c

…

audit_tree.c

…

audit_watch.c

…

audit.c

…

audit.h

…

auditfilter.c

…

auditsc.c

audit: fix a double fetch in audit_log_single_execve_arg()

2016-08-20 18:09:22 +02:00

backtracetest.c

…

bounds.c

…

capability.c

kernel: Add noaudit variant of ns_capable()

2016-09-15 08:27:50 +02:00

cgroup_freezer.c

…

cgroup_pids.c

…

cgroup.c

cgroup: set css->id to -1 during init

2016-08-10 11:49:27 +02:00

compat.c

…

configs.c

…

context_tracking.c

…

cpu_pm.c

…

cpu.c

…

cpuset.c

cgroup, cpuset: replace cpuset_post_attach_flush() with cgroup_subsys->post_attach callback

2016-05-04 14:48:49 -07:00

crash_dump.c

…

cred.c

cred: Reject inodes with invalid ids in set_create_file_as()

2016-09-15 08:27:49 +02:00

delayacct.c

…

dma.c

…

elfcore.c

…

exec_domain.c

…

exit.c

wait/ptrace: assume __WALL if the child is traced

2016-06-07 18:14:35 -07:00

extable.c

…

fork.c

cgroup: reduce read locked section of cgroup_threadgroup_rwsem during fork

2016-09-15 08:27:51 +02:00

freezer.c

…

futex_compat.c

…

futex.c

futex: Acknowledge a new waiter in counter before plist

2016-05-04 14:48:43 -07:00

groups.c

…

hung_task.c

…

irq_work.c

…

jump_label.c

locking/static_key: Fix concurrent static_key_slow_inc()

2016-07-27 09:47:29 -07:00

kallsyms.c

…

kcmp.c

…

Kconfig.freezer

…

Kconfig.hz

…

Kconfig.locks

…

Kconfig.preempt

…

kexec_core.c

…

kexec_file.c

…

kexec_internal.h

…

kexec.c

…

kmod.c

…

kprobes.c

…

ksysfs.c

…

kthread.c

…

latencytop.c

…

Makefile

…

membarrier.c

…

memremap.c

…

module_signing.c

…

module-internal.h

…

module.c

module: Invalidate signatures on force-loaded modules

2016-08-20 18:09:27 +02:00

notifier.c

…

nsproxy.c

…

padata.c

…

panic.c

…

params.c

…

pid_namespace.c

…

pid.c

…

profile.c

…

ptrace.c

…

range.c

…

reboot.c

…

relay.c

…

resource.c

…

seccomp.c

…

signal.c

…

smp.c

…

smpboot.c

…

smpboot.h

…

softirq.c

…

stacktrace.c

…

stop_machine.c

…

sys_ni.c

…

sys.c

…

sysctl_binary.c

fs/coredump: prevent fsuid=0 dumps into user-controlled directories

2016-04-12 09:08:58 -07:00

sysctl.c

pipe: limit the per-user amount of pages allocated in pipes

2016-06-07 18:14:35 -07:00

task_work.c

…

taskstats.c

…

test_kprobes.c

…

torture.c

…

tracepoint.c

…

tsacct.c

…

uid16.c

…

up.c

…

user_namespace.c

…

user-return-notifier.c

…

user.c

…

utsname_sysctl.c

…

utsname.c

…

watchdog.c

…

workqueue_internal.h

…

workqueue.c

workqueue: fix rebind bound workers warning

2016-05-18 17:06:50 -07:00