From: Andrew Morton <akpm@linux-foundation.org>
To: mm-commits@vger.kernel.org,shakeel.butt@linux.dev,roman.gushchin@linux.dev,muchun.song@linux.dev,mhocko@kernel.org,hannes@cmpxchg.org,cuitao@kylinos.cn,akpm@linux-foundation.org
Subject: [alternative-merged] mm-page_counter-reject-empty-string-in-page_counter_memparse.patch removed from -mm tree
Date: Sat, 29 Aug 2026 18:12:15 -0700 [thread overview]
Message-ID: <20260830011216.42B1A1F000E9@smtp.kernel.org> (raw)
The quilt patch titled
Subject: mm: page_counter: reject empty string in page_counter_memparse()
has been removed from the -mm tree. Its filename was
mm-page_counter-reject-empty-string-in-page_counter_memparse.patch
This patch was dropped because an alternative patch was or shall be merged
------------------------------------------------------
From: Tao Cui <cuitao@kylinos.cn>
Subject: mm: page_counter: reject empty string in page_counter_memparse()
Date: Mon, 17 Aug 2026 12:26:52 +0800
memparse() consumes no characters on an empty input and leaves the end
pointer at the terminating NUL. The only validation in
page_counter_memparse() checks for trailing characters, so an empty input
slips through and the limit becomes 0.
All limit write callbacks of the memory controller strstrip() the input
before calling this helper, so a script that writes an unset variable hits
this path:
LIMIT=
echo "$LIMIT" > $CG/memory.max
echo $?
0
cat $CG/memory.max
0
Nothing reports the mistake: the limit is now 0 and the OOM killer goes
after every task in the cgroup. The same happens for memory.min,
memory.low, memory.high, memory.swap.high, memory.swap.max and
memory.zswap.max, where 0 silently removes the protection or disables swap
and zswap.
Reject the input when no characters were consumed, which is the one case
the trailing-character check cannot catch.
Link: https://lore.kernel.org/20260817042652.74136-1-cui.tao@linux.dev
Fixes: 3e32cb2e0a12 ("mm: memcontrol: lockless page counters")
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
mm/page_counter.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/page_counter.c~mm-page_counter-reject-empty-string-in-page_counter_memparse
+++ a/mm/page_counter.c
@@ -281,7 +281,7 @@ int page_counter_memparse(const char *bu
}
bytes = memparse(buf, &end);
- if (*end != '\0')
+ if (*end != '\0' || end == buf)
return -EINVAL;
*nr_pages = min(bytes / PAGE_SIZE, (u64)PAGE_COUNTER_MAX);
_
Patches currently in -mm which might be from cuitao@kylinos.cn are
docs-cgroup-document-empty-write-behavior-of-memory-limit-knobs.patch
reply other threads:[~2026-08-30 1:12 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260830011216.42B1A1F000E9@smtp.kernel.org \
--to=akpm@linux-foundation.org \
--cc=cuitao@kylinos.cn \
--cc=hannes@cmpxchg.org \
--cc=mhocko@kernel.org \
--cc=mm-commits@vger.kernel.org \
--cc=muchun.song@linux.dev \
--cc=roman.gushchin@linux.dev \
--cc=shakeel.butt@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.