From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pl0-f71.google.com (mail-pl0-f71.google.com [209.85.160.71]) by kanga.kvack.org (Postfix) with ESMTP id 5A8DA6B0007 for ; Thu, 8 Feb 2018 15:21:03 -0500 (EST) Received: by mail-pl0-f71.google.com with SMTP id o2so369635pls.10 for ; Thu, 08 Feb 2018 12:21:03 -0800 (PST) Received: from bombadil.infradead.org (bombadil.infradead.org. [65.50.211.133]) by mx.google.com with ESMTPS id 13si497698pfk.28.2018.02.08.12.21.02 for (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Thu, 08 Feb 2018 12:21:02 -0800 (PST) Date: Thu, 8 Feb 2018 12:21:00 -0800 From: Matthew Wilcox Subject: Re: [RFC] Warn the user when they could overflow mapcount Message-ID: <20180208202100.GB3424@bombadil.infradead.org> References: <20180208021112.GB14918@bombadil.infradead.org> <20180208185648.GB9524@bombadil.infradead.org> <20180208194235.GA3424@bombadil.infradead.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Sender: owner-linux-mm@kvack.org List-ID: To: Daniel Micay Cc: Jann Horn , linux-mm@kvack.org, Kernel Hardening , kernel list , "Kirill A. Shutemov" On Thu, Feb 08, 2018 at 02:48:52PM -0500, Daniel Micay wrote: > I guess it could saturate and then switch to tracking the count via an > object pointer -> count mapping with a global lock? Whatever the > solution is should probably be a generic one since it's a recurring > issue. I was thinking of saturating _mapcount at 2 billion (allowing _refcount the extra space to go into the 2-3 billion range). Once saturated, disallow all attempts at mapping it until _mapcount has gone below 2 billion again. We can walk the page->mapping->i_mmap tree and find tasks with more than, say, 10 mappings each, and kill them. Now that I think about it, though, perhaps the simplest solution is not to worry about checking whether _mapcount has saturated, and instead when adding a new mmap, check whether this task already has it mapped 10 times. If so, refuse the mapping. Now we can argue that since pid_max is smaller than 400 million that _mapcount will never overflow, and so we don't need to check it. Convincing argument? -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org