Re: [PATCH] Bug in mm/thrash.c function grab_swap_token()

["ashwin chaugule" <ashwin.chaugule@gmail.com>]

> >>> @@ -48,9 +48,8 @@ void grab_swap_token(void)
> >>>             if (current_interval < current->mm->last_interval)
> >>>                     current->mm->token_priority++;
> >>>             else {
> >>> -                   current->mm->token_priority--;
> >>> -                   if (unlikely(current->mm->token_priority < 0))
> >>> -                           current->mm->token_priority = 0;
> >>> +                   if (likely(current->mm->token_priority > 0))
> >>> +                           current->mm->token_priority--;
> >>>             }
> >>>             /* Check if we deserve the token */
> >>>             if (current->mm->token_priority >
> >> argh.
> >>
> >> This has potential to cause large changes in system performance.
> >
> > I'm not sure how. Although, I think the logic still remains the same.
> > IOW, if the prio decrements to zero, it will remain zero until it
> > contends for token rapidly.
>
> The problem is that the original code would decrement an
> unsigned variable beyond zero, underflowing to a number
> just under 2^32...
>
> That would make the process basically a permanent owner
> of the swap token.


Hm. Although, the probability of token_prio going below zero in the
previous code was quite small. Nevertheless, I shall run the new fix
through some tests and post the results asap.

Cheers,
Ashwin

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>