[Devel] [PATCH RHEL7 COMMIT] mm/memcg: destroy stat2 percpu counters on deletion of the cgroup

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-514.26.1.vz7.33.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-514.26.1.vz7.33.18
------>
commit 0454d0327e506aad86a86ef4e423e94e7f04b387
Author: Andrey Ryabinin <aryabinin at virtuozzo.com>
Date:   Wed Jul 26 14:03:12 2017 +0400

    mm/memcg: destroy stat2 percpu counters on deletion of the cgroup
    
    Commit 6c37dde54e88 ("mm/memcg: improve mem_cgroup_dcache_is_low()
    performance.") didn't destroy percpu_counter's on deletion of the memcg.
    This is not just memleak but a memory corruption, because global
    'percpu_counters' list will contain pointers to the freed memory:
    	------------[ cut here ]------------
    	WARNING: at lib/debugobjects.c:260 debug_print_object+0x17d/0x210()
    	ODEBUG: free active (active state 0) object type: percpu_counter hint:           (null)
    	Call Trace:
    	 dump_stack+0x1e/0x20
    	 warn_slowpath_common+0x9f/0x100
    	 warn_slowpath_fmt+0xc4/0x100
    	 debug_print_object+0x17d/0x210
    	 debug_check_no_obj_freed+0x500/0x920
    	 kfree+0xd6/0x300
    	 __mem_cgroup_free+0x37e/0x4e0
    	 mem_cgroup_css_free+0x81/0xa0
    	 cgroup_free_fn+0xc9/0x4e0
    	 process_one_work+0x740/0x1910
    	 worker_thread+0x413/0xbf0
    	 kthread+0x1e6/0x250
    	 ret_from_fork+0x58/0x90
    
    Call percpu_counter_destroy() from ___mem_cgroup_free() to fix this.
    
    https://jira.sw.ru/browse/PSBM-69145
    Fixes: 6c37dde54e88 ("mm/memcg: improve mem_cgroup_dcache_is_low() performance.")
    
    Signed-off-by: Andrey Ryabinin <aryabinin at virtuozzo.com>
---
 mm/memcontrol.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 7264c05..4e14af2 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -5947,6 +5947,7 @@ static struct mem_cgroup *mem_cgroup_alloc(void)
 static void __mem_cgroup_free(struct mem_cgroup *memcg)
 {
 	int node;
+	int i;
 
 	mem_cgroup_remove_from_trees(memcg);
 	free_css_id(&mem_cgroup_subsys, &memcg->css);
@@ -5954,6 +5955,9 @@ static void __mem_cgroup_free(struct mem_cgroup *memcg)
 	for_each_node(node)
 		free_mem_cgroup_per_zone_info(memcg, node);
 
+	for (i = 0; i < MEM_CGROUP_STAT2_NSTATS; i++)
+		percpu_counter_destroy(&memcg->stat2.counters[i]);
+
 	free_percpu(memcg->stat);
 
 	/*