From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from m16.mail.163.com (m16.mail.163.com [117.135.210.3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A5A113ABD83 for ; Wed, 24 Jun 2026 09:56:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=117.135.210.3 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782294976; cv=none; b=kGPqTHpN8Kpj4VEWNHn8VEieZCVfZkKQpl6s5j8PxPAzsHbz44PpsXbL4cD0ZRVaqB25yg87pK6oxsjA/rnzjVFt79nRD2RoRc/Pxeh1DC9fi1WpWWn0LMZiGcaaqajr5gohklLseGII1+ockBsSjjuPWHYBFCP0ViwoyVJ91Qc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782294976; c=relaxed/simple; bh=KlUshWRtMd9tMqsW2PzTtLAtQTiDC4xPA/hk+yKRwG8=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=fniedIu+1aXNPx+INr7A0nTXH9vxBx1FQlu3d0ehUlXxkeTMPDjWef0hwPdr9NlMfyRySMg0vwz5/xAOPPtao8Yi6muh0r9YyUjwEwHFLwaRITepzc4sDqGlB5/dP7p1LBBKHUGP+IqDuiOdXnLKrE7/1hBvQn4ag2YB/LeHEqo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=163.com; spf=pass smtp.mailfrom=163.com; dkim=pass (1024-bit key) header.d=163.com header.i=@163.com header.b=VUApR/uB; arc=none smtp.client-ip=117.135.210.3 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=163.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=163.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=163.com header.i=@163.com header.b="VUApR/uB" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:To:Subject:Date:Message-Id:MIME-Version; bh=oU kW/KEdBAdFt0ECdeaOfS5Jd+P4aZridifd41QEJnc=; b=VUApR/uBuoCW7Ev5KH +raOi7Z6xmvY+9+9RDM69Elpez01x8QqScwrmjQdN9/WRE+AS4Vhjc1jsl7a1apS xnyaOIxlf/QVI0CI7h55VLupFbFU13JCBsPBjfXoKXrHE9uZofu3xZ45eqOPEO/3 9179CoxGbhW5NzLeZHsiU87XA= Received: from localhost.localdomain (unknown []) by gzga-smtp-mtada-g1-3 (Coremail) with SMTP id _____wD3f2SRqTtqDMx0Ew--.31S2; Wed, 24 Jun 2026 17:55:31 +0800 (CST) From: fffsqian@163.com To: Andrew Morton , Dave Chinner , Qi Zheng , Roman Gushchin , Muchun Song Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org, Qingshuang Fu Subject: [PATCH 1/1] mm/shrinker: add NULL checks after rcu_dereference() in shrinker bit functions Date: Wed, 24 Jun 2026 17:55:27 +0800 Message-Id: <20260624095527.277586-1-fffsqian@163.com> X-Mailer: git-send-email 2.25.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CM-TRANSID:_____wD3f2SRqTtqDMx0Ew--.31S2 X-Coremail-Antispam: 1Uf129KBjvJXoWxCw4fAw1DKrW3Kw1DJFy5urg_yoW5Ar4rpF WDKryDJr45ArnYgw12y3Z8JFyFvw18Ca4rJr92gw1IyryFq3ZxXr4xtFW2vry5Ca4fGryq qa4UXw1q9r1UZaDanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07jw8n5UUUUU= X-CM-SenderInfo: 5iii21xldqqiywtou0bp/xtbC6hT4w2o7qZQccQAA3E From: Qingshuang Fu The functions set_shrinker_bit(), xchg_nr_deferred_memcg(), and add_nr_deferred_memcg() access shrinker_info fields immediately after rcu_dereference() without checking for NULL. This is inconsistent with shrink_slab_memcg() which properly checks "if (unlikely(!info)) goto unlock;" before accessing info fields. The shrinker_info can be NULL during memcg initialization or after shrinker_info expansion failure. Directly accessing info->map_nr_max or info->unit[] without NULL validation could cause kernel NULL pointer dereference and panic. Fix this by adding proper NULL checks in all three functions to ensure consistent RCU protection and prevent potential crashes in the shrinker subsystem. Fixes: 307bececcd1205bcb ("mm: shrinker: add a secondary array for shrinker_info::{map, nr_deferred}") Cc: Andrew Morton Cc: Dave Chinner Cc: Qi Zheng Cc: Roman Gushchin Cc: Muchun Song Cc: linux-mm@kvack.org Signed-off-by: Qingshuang Fu --- mm/shrinker.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/mm/shrinker.c b/mm/shrinker.c index 7082d01c8c9d..ecde3cc44459 100644 --- a/mm/shrinker.c +++ b/mm/shrinker.c @@ -200,6 +200,8 @@ void set_shrinker_bit(struct mem_cgroup *memcg, int nid, int shrinker_id) rcu_read_lock(); info = rcu_dereference(memcg->nodeinfo[nid]->shrinker_info); + if (unlikely(!info)) + goto unlock; if (!WARN_ON_ONCE(shrinker_id >= info->map_nr_max)) { struct shrinker_info_unit *unit; @@ -208,6 +210,7 @@ void set_shrinker_bit(struct mem_cgroup *memcg, int nid, int shrinker_id) smp_mb__before_atomic(); set_bit(shrinker_id_to_offset(shrinker_id), unit->map); } +unlock: rcu_read_unlock(); } } @@ -258,6 +261,10 @@ static long xchg_nr_deferred_memcg(int nid, struct shrinker *shrinker, rcu_read_lock(); info = rcu_dereference(memcg->nodeinfo[nid]->shrinker_info); + if (unlikely(!info)) { + rcu_read_unlock(); + return 0; + } unit = info->unit[shrinker_id_to_index(shrinker->id)]; nr_deferred = atomic_long_xchg(&unit->nr_deferred[shrinker_id_to_offset(shrinker->id)], 0); rcu_read_unlock(); @@ -274,6 +281,10 @@ static long add_nr_deferred_memcg(long nr, int nid, struct shrinker *shrinker, rcu_read_lock(); info = rcu_dereference(memcg->nodeinfo[nid]->shrinker_info); + if (unlikely(!info)) { + rcu_read_unlock(); + return 0; + } unit = info->unit[shrinker_id_to_index(shrinker->id)]; nr_deferred = atomic_long_add_return(nr, &unit->nr_deferred[shrinker_id_to_offset(shrinker->id)]); base-commit: 840ef6c78e6a2f694b578ecb9063241c992aaa9e -- 2.25.1