From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pf0-f198.google.com (mail-pf0-f198.google.com [209.85.192.198]) by kanga.kvack.org (Postfix) with ESMTP id 386596B025E for ; Mon, 9 May 2016 03:34:04 -0400 (EDT) Received: by mail-pf0-f198.google.com with SMTP id 203so363760272pfy.2 for ; Mon, 09 May 2016 00:34:04 -0700 (PDT) Received: from mail-pa0-x242.google.com (mail-pa0-x242.google.com. [2607:f8b0:400e:c03::242]) by mx.google.com with ESMTPS id ef2si37199215pac.119.2016.05.09.00.34.03 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 09 May 2016 00:34:03 -0700 (PDT) Received: by mail-pa0-x242.google.com with SMTP id i5so15323272pag.3 for ; Mon, 09 May 2016 00:34:03 -0700 (PDT) From: Sergey Senozhatsky Subject: [PATCH] zsmalloc: fix zs_can_compact() integer overflow Date: Mon, 9 May 2016 16:35:33 +0900 Message-Id: <1462779333-7092-1-git-send-email-sergey.senozhatsky@gmail.com> Sender: owner-linux-mm@kvack.org List-ID: To: Minchan Kim Cc: Andrew Morton , linux-kernel@vger.kernel.org, linux-mm@kvack.org, Sergey Senozhatsky , Sergey Senozhatsky , "[4.3+]" zs_can_compact() has two race conditions in its core calculation: unsigned long obj_wasted = zs_stat_get(class, OBJ_ALLOCATED) - zs_stat_get(class, OBJ_USED); 1) classes are not locked, so the numbers of allocated and used objects can change by the concurrent ops happening on other CPUs 2) shrinker invokes it from preemptible context Depending on the circumstances, OBJ_ALLOCATED can become less than OBJ_USED, which can result in either very high or negative `total_scan' value calculated in do_shrink_slab(). Take a pool stat snapshot and use it instead of racy zs_stat_get() calls. Signed-off-by: Sergey Senozhatsky Cc: Minchan Kim Cc: [4.3+] --- mm/zsmalloc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c index 107ec06..1bc2a98 100644 --- a/mm/zsmalloc.c +++ b/mm/zsmalloc.c @@ -2262,10 +2262,13 @@ static void SetZsPageMovable(struct zs_pool *pool, struct zspage *zspage) static unsigned long zs_can_compact(struct size_class *class) { unsigned long obj_wasted; + unsigned long obj_allocated = zs_stat_get(class, OBJ_ALLOCATED); + unsigned long obj_used = zs_stat_get(class, OBJ_USED); - obj_wasted = zs_stat_get(class, OBJ_ALLOCATED) - - zs_stat_get(class, OBJ_USED); + if (obj_allocated <= obj_used) + return 0; + obj_wasted = obj_allocated - obj_used; obj_wasted /= get_maxobj_per_zspage(class->size, class->pages_per_zspage); -- 2.8.2 -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org