Re: [PATCH 3/3] mm: catch memory commitment underflow

Konstantin Khlebnikov
2015-01-18T18:36:46Z

On Sun, Jan 18, 2015 at 2:34 PM, Sasha Levin <sasha.levin@oracle.com> wrote:
> On 06/24/2014 04:16 PM, Konstantin Khlebnikov wrote:
>> This patch prints warning (if CONFIG_DEBUG_VM=y) when
>> memory commitment becomes too negative.
>>
>> Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com>
>
> Hi Konstantin,
>
> I seem to be hitting this warning when fuzzing on the latest -next kernel:

That might be unexpected change of shmem file which holds anon-vma data,
thanks to checkpoint-restore they are expoted via /proc/.../map_files

I've fixed truncate (https://lkml.org/lkml/2014/6/24/729) but there
are some other ways
to change i_size: write, fallocate and maybe something else.

We could seal this promblem (literally).

--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -3355,6 +3355,9 @@ static struct file *__shmem_file_setup(const
char *name, loff_t size,
if (!inode)
goto put_memory;

+ if (!(flags & VM_NORESERVE))
+ SHMEM_I(inode)->seals |= F_SEAL_SHRINK | F_SEAL_GROW;
+
inode->i_flags |= i_flags;
d_instantiate(path.dentry, inode);
inode->i_size = size;

>
> [ 683.674323] ------------[ cut here ]------------
> [ 683.675552] WARNING: CPU: 12 PID: 25654 at mm/mmap.c:157 __vm_enough_memory+0x1b7/0x1d0()
> [ 683.676972] memory commitment underflow
> [ 683.678212] Modules linked in:
> [ 683.678219] CPU: 12 PID: 25654 Comm: trinity-c373 Not tainted 3.19.0-rc4-next-20150116-sasha-00054-g4ad498c-dirty #1744
> [ 683.678227] ffffffff9c6f7e73 ffff8802c0883a58 ffffffff9b439fb2 0000000000000000
> [ 683.678231] ffff8802c0883aa8 ffff8802c0883a98 ffffffff98159e1a ffff8802c0883ae8
> [ 683.678236] 0000000000000001 0000000000000000 ffffffffffff76f1 ffff8802a9749000
> [ 683.678243] Call Trace:
> [ 683.678288] dump_stack (lib/dump_stack.c:52)
> [ 683.678297] warn_slowpath_common (kernel/panic.c:447)
> [ 683.678302] warn_slowpath_fmt (kernel/panic.c:461)
> [ 683.678307] __vm_enough_memory (mm/mmap.c:157 (discriminator 3))
> [ 683.678317] cap_vm_enough_memory (security/commoncap.c:958)
> [ 683.678323] security_vm_enough_memory_mm (security/security.c:212)
> [ 683.678331] shmem_getpage_gfp (mm/shmem.c:1161)
> [ 683.678337] shmem_write_begin (mm/shmem.c:1495)
> [ 683.678343] generic_perform_write (mm/filemap.c:2491)
> [ 683.678447] __generic_file_write_iter (mm/filemap.c:2632)
> [ 683.678452] generic_file_write_iter (mm/filemap.c:2659)
> [ 683.678458] do_iter_readv_writev (fs/read_write.c:680)
> [ 683.678461] do_readv_writev (fs/read_write.c:848)
> [ 683.678512] vfs_writev (fs/read_write.c:893)
> [ 683.678515] SyS_writev (fs/read_write.c:926 fs/read_write.c:917)
> [ 683.678520] tracesys_phase2 (arch/x86/kernel/entry_64.S:529)
>
>
> Thanks,
> Sasha