From: Andrew Morton <akpm@linux-foundation.org>
To: Vladimir Davydov <vdavydov@parallels.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>,
Michal Hocko <mhocko@kernel.org>, Tejun Heo <tj@kernel.org>,
linux-mm@kvack.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 2/5] fs: charge pipe buffers to memcg
Date: Tue, 29 Sep 2015 15:57:11 -0700 [thread overview]
Message-ID: <20150929155711.3b139dab622848a14af64ca4@linux-foundation.org> (raw)
In-Reply-To: <94f055dc719129a26149b0f8b22af7c61a3fb4e6.1443262808.git.vdavydov@parallels.com>
On Sat, 26 Sep 2015 13:45:54 +0300 Vladimir Davydov <vdavydov@parallels.com> wrote:
> Pipe buffers can be generated unrestrictedly by an unprivileged
> userspace process, so they shouldn't go unaccounted.
>
> ...
>
> --- a/fs/pipe.c
> +++ b/fs/pipe.c
> @@ -400,7 +400,7 @@ pipe_write(struct kiocb *iocb, struct iov_iter *from)
> int copied;
>
> if (!page) {
> - page = alloc_page(GFP_HIGHUSER);
> + page = alloc_kmem_pages(GFP_HIGHUSER, 0);
> if (unlikely(!page)) {
> ret = ret ? : -ENOMEM;
> break;
This seems broken. We have a page buffer page which has a weird
->mapcount. Now it gets stolen (generic_pipe_buf_steal()) and spliced
into pagecache. Then the page gets mmapped and MM starts playing with
its ->_mapcount?
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next prev parent reply other threads:[~2015-09-29 22:57 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-09-26 10:45 [PATCH 0/5] memcg: charge page tables (x86) and pipe buffers Vladimir Davydov
2015-09-26 10:45 ` [PATCH 1/5] mm: uncharge kmem pages from generic free_page path Vladimir Davydov
2015-09-29 22:43 ` Andrew Morton
2015-09-30 16:46 ` Vladimir Davydov
2015-09-30 19:51 ` Greg Thelen
2015-10-01 18:52 ` Vladimir Davydov
2015-09-26 10:45 ` [PATCH 2/5] fs: charge pipe buffers to memcg Vladimir Davydov
2015-09-29 22:57 ` Andrew Morton [this message]
2015-09-30 16:49 ` Vladimir Davydov
2015-09-26 10:45 ` [PATCH 3/5] memcg: teach uncharge_list to uncharge kmem pages Vladimir Davydov
2015-09-26 10:45 ` [PATCH 4/5] mm: add __get_free_kmem_pages helper Vladimir Davydov
2015-09-26 10:45 ` [PATCH 5/5] x86: charge page table pages to memcg Vladimir Davydov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150929155711.3b139dab622848a14af64ca4@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=hannes@cmpxchg.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mhocko@kernel.org \
--cc=tj@kernel.org \
--cc=vdavydov@parallels.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox