• Kirill A. Shutemov's avatar
    mm: fix mlock accouting · 7162a1e8
    Kirill A. Shutemov authored
    Tetsuo Handa reported underflow of NR_MLOCK on munlock.
        #include <stdio.h>
        #include <stdlib.h>
        #include <sys/mman.h>
        #define BASE ((void *)0x400000000000)
        #define SIZE (1UL << 21)
        int main(int argc, char *argv[])
            void *addr;
            system("grep Mlocked /proc/meminfo");
            addr = mmap(BASE, SIZE, PROT_READ | PROT_WRITE,
                    -1, 0);
            if (addr == MAP_FAILED)
                printf("mmap() failed\n"), exit(1);
            munmap(addr, SIZE);
            system("grep Mlocked /proc/meminfo");
            return 0;
    It happens on munlock_vma_page() due to unfortunate choice of nr_pages
    data type:
        __mod_zone_page_state(zone, NR_MLOCK, -nr_pages);
    For unsigned int nr_pages, implicitly casted to long in
    __mod_zone_page_state(), it becomes something around UINT_MAX.
    munlock_vma_page() usually called for THP as small pages go though
    Let's make nr_pages signed int.
    Similar fixes in 6cdb18ad ("mm/vmstat: fix overflow in
    mod_zone_page_state()") used `long' type, but `int' here is OK for a
    count of the number of sub-pages in a huge page.
    Fixes: ff6a6da6 ("mm: accelerate munlock() treatment of THP pages")
    Signed-off-by: 's avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
    Reported-by: 's avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Tested-by: 's avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Cc: Michel Lespinasse <walken@google.com>
    Acked-by: 's avatarMichal Hocko <mhocko@suse.com>
    Cc: <stable@vger.kernel.org>  [4.4+]
    Signed-off-by: 's avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: 's avatarLinus Torvalds <torvalds@linux-foundation.org>
mlock.c 21 KB