From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758803AbcBYBDI (ORCPT ); Wed, 24 Feb 2016 20:03:08 -0500 Received: from youngberry.canonical.com ([91.189.89.112]:58821 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754253AbcBYBDG (ORCPT ); Wed, 24 Feb 2016 20:03:06 -0500 Date: Thu, 25 Feb 2016 01:02:59 +0000 From: Luis Henriques To: Greg Kroah-Hartman Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org, "Kirill A. Shutemov" , Tetsuo Handa , Michel Lespinasse , Michal Hocko , Andrew Morton , Linus Torvalds Subject: Re: [PATCH 3.14 52/70] mm: fix mlock accouting Message-ID: <20160225010259.GA1757@charon.olymp> References: <20160224033354.061464831@linuxfoundation.org> <20160224033355.772872055@linuxfoundation.org> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20160224033355.772872055@linuxfoundation.org> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Feb 23, 2016 at 07:34:01PM -0800, Greg Kroah-Hartman wrote: > 3.14-stable review patch. If anyone has any objections, please let me know. > I'm not sure this should be queued for the 3.14 kernel. It is tagged for 4.4+ and since in this kernel version __mod_zone_page_state() doesn't actually cast nr_pages to long, this patch doesn't seem to be required. Cheers, -- Luís > ------------------ > > From: Kirill A. Shutemov > > commit 7162a1e87b3e380133dadc7909081bb70d0a7041 upstream. > > Tetsuo Handa reported underflow of NR_MLOCK on munlock. > > Testcase: > > #include > #include > #include > > #define BASE ((void *)0x400000000000) > #define SIZE (1UL << 21) > > int main(int argc, char *argv[]) > { > void *addr; > > system("grep Mlocked /proc/meminfo"); > addr = mmap(BASE, SIZE, PROT_READ | PROT_WRITE, > MAP_ANONYMOUS | MAP_PRIVATE | MAP_LOCKED | MAP_FIXED, > -1, 0); > if (addr == MAP_FAILED) > printf("mmap() failed\n"), exit(1); > munmap(addr, SIZE); > system("grep Mlocked /proc/meminfo"); > return 0; > } > > It happens on munlock_vma_page() due to unfortunate choice of nr_pages > data type: > > __mod_zone_page_state(zone, NR_MLOCK, -nr_pages); > > For unsigned int nr_pages, implicitly casted to long in > __mod_zone_page_state(), it becomes something around UINT_MAX. > > munlock_vma_page() usually called for THP as small pages go though > pagevec. > > Let's make nr_pages signed int. > > Similar fixes in 6cdb18ad98a4 ("mm/vmstat: fix overflow in > mod_zone_page_state()") used `long' type, but `int' here is OK for a > count of the number of sub-pages in a huge page. > > Fixes: ff6a6da60b89 ("mm: accelerate munlock() treatment of THP pages") > Signed-off-by: Kirill A. Shutemov > Reported-by: Tetsuo Handa > Tested-by: Tetsuo Handa > Cc: Michel Lespinasse > Acked-by: Michal Hocko > Signed-off-by: Andrew Morton > Signed-off-by: Linus Torvalds > Signed-off-by: Greg Kroah-Hartman > > --- > mm/mlock.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > --- a/mm/mlock.c > +++ b/mm/mlock.c > @@ -172,7 +172,7 @@ static void __munlock_isolation_failed(s > */ > unsigned int munlock_vma_page(struct page *page) > { > - unsigned int nr_pages; > + int nr_pages; > struct zone *zone = page_zone(page); > > /* For try_to_munlock() and to serialize with page migration */ > > > -- > To unsubscribe from this list: send the line "unsubscribe stable" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html