The commit is pushed to "branch-rh10-6.12.0-211.16.1.12.x.vz10-ovz" and will
appear at [email protected]:openvz/vzkernel.git
after rh10-6.12.0-211.16.1.el10
------>
commit 5044f47a9e029a7f13242a7253b549d05be437cb
Author: Konstantin Khorenko <[email protected]>
Date: Wed Jun 3 23:56:13 2026 +0200
memcg: guard mm_overdraft() against NULL memcg (cgroup_disable=memory)
get_mem_cgroup_from_mm() returns NULL when mem_cgroup_disabled() is true
(e.g. the kernel was booted with "cgroup_disable=memory"). mm_overdraft()
dereferenced the result unconditionally:
memcg = get_mem_cgroup_from_mm(mm);
overdraft = memcg->overdraft; /* NULL deref */
css_put(&memcg->css);
It is called from oom_badness() (*overdraft = mm_overdraft(p->mm)) on
every OOM scoring pass, so any OOM kill on a memory-cgroup-disabled
kernel NULL-derefs. Return 0 (no overdraft) when memcg is NULL.
Fixes: 0ba4e907e1ae ("memcg: add oom_guarantee")
https://virtuozzo.atlassian.net/browse/VSTOR-132310
Feature: mm/oom: OOM guarantee feature
Signed-off-by: Konstantin Khorenko <[email protected]>
---
include/linux/memcontrol.h | 2 ++
1 file changed, 2 insertions(+)
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 23ab42e5978e..bf2440e36941 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -907,6 +907,8 @@ static inline unsigned long mm_overdraft(struct mm_struct
*mm)
unsigned long overdraft;
memcg = get_mem_cgroup_from_mm(mm);
+ if (!memcg)
+ return 0;
overdraft = memcg->overdraft;
css_put(&memcg->css);
_______________________________________________
Devel mailing list
[email protected]
https://lists.openvz.org/mailman/listinfo/devel
