memcg: remove memcg_cgroup::id from IDR on mem_cgroup_css_alloc() failure (7e97de0b) · Commits · 戴 / test

In case of memcg_online_kmem() failure, memcg_cgroup::id remains hashed in mem_cgroup_idr even after memcg memory is freed. This leads to leak of ID in mem_cgroup_idr. This patch adds removal into mem_cgroup_css_alloc(), which fixes the problem. For better readability, it adds a generic helper which is used in mem_cgroup_alloc() and mem_cgroup_id_put_many() as well. Link: http://lkml.kernel.org/r/152354470916.22460.14397070748001974638.stgit@localhost.localdomain Fixes ("mm: memcontrol: fix cgroup creation failure after many small jobs") Signed-off-by:

Kirill Tkhai <ktkhai@virtuozzo.com> Acked-by:

Johannes Weiner <hannes@cmpxchg.org> Acked-by:

Vladimir Davydov <vdavydov.dev@gmail.com> Cc: Michal Hocko <mhocko@kernel.org> Signed-off-by:

Andrew Morton <akpm@linux-foundation.org> Signed-off-by:

Linus Torvalds <torvalds@linux-foundation.org>

mm/memcontrol.c

+11 −4

Original line number	Diff line number	Diff line
		@@ -4037,6 +4037,14 @@ static struct cftype mem_cgroup_legacy_files[] = {

		static DEFINE_IDR(mem_cgroup_idr);

		static void mem_cgroup_id_remove(struct mem_cgroup *memcg)
		{
		if (memcg->id.id > 0) {
		idr_remove(&mem_cgroup_idr, memcg->id.id);
		memcg->id.id = 0;
		}
		}

		static void mem_cgroup_id_get_many(struct mem_cgroup *memcg, unsigned int n)
		{
		VM_BUG_ON(atomic_read(&memcg->id.ref) <= 0);
		@@ -4047,8 +4055,7 @@ static void mem_cgroup_id_put_many(struct mem_cgroup *memcg, unsigned int n)
		{
		VM_BUG_ON(atomic_read(&memcg->id.ref) < n);
		if (atomic_sub_and_test(n, &memcg->id.ref)) {
		idr_remove(&mem_cgroup_idr, memcg->id.id);
		memcg->id.id = 0;
		mem_cgroup_id_remove(memcg);

		/* Memcg ID pins CSS */
		css_put(&memcg->css);
		@@ -4185,8 +4192,7 @@ static struct mem_cgroup *mem_cgroup_alloc(void)
		idr_replace(&mem_cgroup_idr, memcg, memcg->id.id);
		return memcg;
		fail:
		if (memcg->id.id > 0)
		idr_remove(&mem_cgroup_idr, memcg->id.id);
		mem_cgroup_id_remove(memcg);
		__mem_cgroup_free(memcg);
		return NULL;
		}
		@@ -4245,6 +4251,7 @@ mem_cgroup_css_alloc(struct cgroup_subsys_state *parent_css)

		return &memcg->css;
		fail:
		mem_cgroup_id_remove(memcg);
		mem_cgroup_free(memcg);
		return ERR_PTR(-ENOMEM);
		}

Admin message