[PATCH] mm/memcg: fix NULL pointer dereference at workingset_eviction

[Muchun Song]

We found a case of kernel panic. The stack trace is as follows
(omit some irrelevant information):

    BUG: kernel NULL pointer dereference, address: 00000000000000c8
    RIP: 0010:workingset_eviction+0x26b/0x450
    Call Trace:
     __remove_mapping+0x224/0x2b0
     shrink_page_list+0x8c2/0x14e0
     shrink_inactive_list+0x1bf/0x3f0
     ? do_raw_spin_unlock+0x49/0xc0
     ? _raw_spin_unlock+0xa/0x20
     shrink_lruvec+0x401/0x640

This was caused by commit 76761ffa9ea1 ("mm/memcg: bail out early when
!memcg in mem_cgroup_lruvec"). When the parameter of memcg is NULL, we
should not use the &pgdat->__lruvec. So this just reverts commit
76761ffa9ea1 to fix it.

Fixes: 76761ffa9ea1 ("mm/memcg: bail out early when !memcg in 
mem_cgroup_lruvec")
Signed-off-by: Muchun Song <songmuc...@bytedance.com>
---
 include/linux/memcontrol.h | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index f9a496c4eac7..a1416205507c 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -610,17 +610,20 @@ mem_cgroup_nodeinfo(struct mem_cgroup *memcg, int nid)
 static inline struct lruvec *mem_cgroup_lruvec(struct mem_cgroup *memcg,
                                               struct pglist_data *pgdat)
 {
+       struct mem_cgroup_per_node *mz;
        struct lruvec *lruvec;
 
-       if (mem_cgroup_disabled() || !memcg) {
+       if (mem_cgroup_disabled()) {
                lruvec = &pgdat->__lruvec;
-       } else {
-               struct mem_cgroup_per_node *mz;
-
-               mz = mem_cgroup_nodeinfo(memcg, pgdat->node_id);
-               lruvec = &mz->lruvec;
+               goto out;
        }
 
+       if (!memcg)
+               memcg = root_mem_cgroup;
+
+       mz = mem_cgroup_nodeinfo(memcg, pgdat->node_id);
+       lruvec = &mz->lruvec;
+out:
        /*
         * Since a node can be onlined after the mem_cgroup was created,
         * we have to be prepared to initialize lruvec->pgdat here;
-- 
2.11.0