[PATCH] mm/memcg: fix NULL pointer dereference at workingset_eviction

[Muchun Song]

We found a case of kernel panic. The stack trace is as follows
(omit some irrelevant information):

    BUG: kernel NULL pointer dereference, address: 00000000000000c8
    RIP: 0010:workingset_eviction+0x26b/0x450
    Call Trace:
     __remove_mapping+0x224/0x2b0
     shrink_page_list+0x8c2/0x14e0
     shrink_inactive_list+0x1bf/0x3f0
     ? do_raw_spin_unlock+0x49/0xc0
     ? _raw_spin_unlock+0xa/0x20
     shrink_lruvec+0x401/0x640

This was caused by commit 76761ffa9ea1 ("mm/memcg: bail out early when
!memcg in mem_cgroup_lruvec"). When the parameter of memcg is NULL, we
should not use the &pgdat->__lruvec. So this just reverts commit
76761ffa9ea1 to fix it.

Fixes: 76761ffa9ea1 ("mm/memcg: bail out early when !memcg in mem_cgroup_lruvec")
Signed-off-by: Muchun Song <songmuchun@xxxxxxxxxxxxx>
---
 include/linux/memcontrol.h | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index f9a496c4eac7..a1416205507c 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -610,17 +610,20 @@ mem_cgroup_nodeinfo(struct mem_cgroup *memcg, int nid)
 static inline struct lruvec *mem_cgroup_lruvec(struct mem_cgroup *memcg,
 					       struct pglist_data *pgdat)
 {
+	struct mem_cgroup_per_node *mz;
 	struct lruvec *lruvec;
 
-	if (mem_cgroup_disabled() || !memcg) {
+	if (mem_cgroup_disabled()) {
 		lruvec = &pgdat->__lruvec;
-	} else {
-		struct mem_cgroup_per_node *mz;
-
-		mz = mem_cgroup_nodeinfo(memcg, pgdat->node_id);
-		lruvec = &mz->lruvec;
+		goto out;
 	}
 
+	if (!memcg)
+		memcg = root_mem_cgroup;
+
+	mz = mem_cgroup_nodeinfo(memcg, pgdat->node_id);
+	lruvec = &mz->lruvec;
+out:
 	/*
 	 * Since a node can be onlined after the mem_cgroup was created,
 	 * we have to be prepared to initialize lruvec->pgdat here;
-- 
2.11.0