From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752708AbcEIHeH (ORCPT ); Mon, 9 May 2016 03:34:07 -0400 Received: from mail-pa0-f67.google.com ([209.85.220.67]:33841 "EHLO mail-pa0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752573AbcEIHeE (ORCPT ); Mon, 9 May 2016 03:34:04 -0400 From: Sergey Senozhatsky X-Google-Original-From: Sergey Senozhatsky To: Minchan Kim Cc: Andrew Morton , linux-kernel@vger.kernel.org, linux-mm@kvack.org, Sergey Senozhatsky , Sergey Senozhatsky , "[4.3+]" Subject: [PATCH] zsmalloc: fix zs_can_compact() integer overflow Date: Mon, 9 May 2016 16:35:33 +0900 Message-Id: <1462779333-7092-1-git-send-email-sergey.senozhatsky@gmail.com> X-Mailer: git-send-email 2.8.2 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org zs_can_compact() has two race conditions in its core calculation: unsigned long obj_wasted = zs_stat_get(class, OBJ_ALLOCATED) - zs_stat_get(class, OBJ_USED); 1) classes are not locked, so the numbers of allocated and used objects can change by the concurrent ops happening on other CPUs 2) shrinker invokes it from preemptible context Depending on the circumstances, OBJ_ALLOCATED can become less than OBJ_USED, which can result in either very high or negative `total_scan' value calculated in do_shrink_slab(). Take a pool stat snapshot and use it instead of racy zs_stat_get() calls. Signed-off-by: Sergey Senozhatsky Cc: Minchan Kim Cc: [4.3+] --- mm/zsmalloc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c index 107ec06..1bc2a98 100644 --- a/mm/zsmalloc.c +++ b/mm/zsmalloc.c @@ -2262,10 +2262,13 @@ static void SetZsPageMovable(struct zs_pool *pool, struct zspage *zspage) static unsigned long zs_can_compact(struct size_class *class) { unsigned long obj_wasted; + unsigned long obj_allocated = zs_stat_get(class, OBJ_ALLOCATED); + unsigned long obj_used = zs_stat_get(class, OBJ_USED); - obj_wasted = zs_stat_get(class, OBJ_ALLOCATED) - - zs_stat_get(class, OBJ_USED); + if (obj_allocated <= obj_used) + return 0; + obj_wasted = obj_allocated - obj_used; obj_wasted /= get_maxobj_per_zspage(class->size, class->pages_per_zspage); -- 2.8.2