From patchwork Thu Dec 13 13:57:14 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: [069/241] mm: bugfix: set current->reclaim_state to NULL while returning from kswapd() Date: Thu, 13 Dec 2012 03:57:14 -0000 From: Herton Ronaldo Krzesinski X-Patchwork-Id: 205919 Message-Id: <1355407206-17100-70-git-send-email-herton.krzesinski@canonical.com> To: linux-kernel@vger.kernel.org, stable@vger.kernel.org, kernel-team@lists.ubuntu.com Cc: Takamori Yamaguchi , Andrew Morton , Aaditya Kumar , Linus Torvalds 3.5.7.2 -stable review patch. If anyone has any objections, please let me know. ------------------ From: Takamori Yamaguchi commit b0a8cc58e6b9aaae3045752059e5e6260c0b94bc upstream. In kswapd(), set current->reclaim_state to NULL before returning, as current->reclaim_state holds reference to variable on kswapd()'s stack. In rare cases, while returning from kswapd() during memory offlining, __free_slab() and freepages() can access the dangling pointer of current->reclaim_state. Signed-off-by: Takamori Yamaguchi Signed-off-by: Aaditya Kumar Acked-by: David Rientjes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Herton Ronaldo Krzesinski --- mm/vmscan.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/vmscan.c b/mm/vmscan.c index f0f8ebb..cdfdfc5 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -2835,6 +2835,8 @@ static int kswapd(void *p) &balanced_classzone_idx); } } + + current->reclaim_state = NULL; return 0; }