All of lore.kernel.org
 help / color / mirror / Atom feed
* FAILED: patch "[PATCH] mm: treat indirectly reclaimable memory as free in overcommit" failed to apply to 4.16-stable tree
@ 2018-05-12 13:35 gregkh
  2018-05-14 10:46 ` Roman Gushchin
  0 siblings, 1 reply; 5+ messages in thread
From: gregkh @ 2018-05-12 13:35 UTC (permalink / raw)
  To: guro, akpm, hannes, mhocko, torvalds, viro; +Cc: stable


The patch below does not apply to the 4.16-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

>From d79f7aa496fc94d763f67b833a1f36f4c171176f Mon Sep 17 00:00:00 2001
From: Roman Gushchin <guro@fb.com>
Date: Tue, 10 Apr 2018 16:27:47 -0700
Subject: [PATCH] mm: treat indirectly reclaimable memory as free in overcommit
 logic

Indirectly reclaimable memory can consume a significant part of total
memory and it's actually reclaimable (it will be released under actual
memory pressure).

So, the overcommit logic should treat it as free.

Otherwise, it's possible to cause random system-wide memory allocation
failures by consuming a significant amount of memory by indirectly
reclaimable memory, e.g.  dentry external names.

If overcommit policy GUESS is used, it might be used for denial of
service attack under some conditions.

The following program illustrates the approach.  It causes the kernel to
allocate an unreclaimable kmalloc-256 chunk for each stat() call, so
that at some point the overcommit logic may start blocking large
allocation system-wide.

  int main()
  {
  	char buf[256];
  	unsigned long i;
  	struct stat statbuf;

  	buf[0] = '/';
  	for (i = 1; i < sizeof(buf); i++)
  		buf[i] = '_';

  	for (i = 0; 1; i++) {
  		sprintf(&buf[248], "%8lu", i);
  		stat(buf, &statbuf);
  	}

  	return 0;
  }

This patch in combination with related indirectly reclaimable memory
patches closes this issue.

Link: http://lkml.kernel.org/r/20180313130041.8078-1-guro@fb.com
Signed-off-by: Roman Gushchin <guro@fb.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/mm/util.c b/mm/util.c
index 029fc2f3b395..73676f0f1b43 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -667,6 +667,13 @@ int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
 		 */
 		free += global_node_page_state(NR_SLAB_RECLAIMABLE);
 
+		/*
+		 * Part of the kernel memory, which can be released
+		 * under memory pressure.
+		 */
+		free += global_node_page_state(
+			NR_INDIRECTLY_RECLAIMABLE_BYTES) >> PAGE_SHIFT;
+
 		/*
 		 * Leave reserved pages. The pages are not for anonymous pages.
 		 */

^ permalink raw reply related	[flat|nested] 5+ messages in thread

* Re: FAILED: patch "[PATCH] mm: treat indirectly reclaimable memory as free in overcommit" failed to apply to 4.16-stable tree
  2018-05-12 13:35 FAILED: patch "[PATCH] mm: treat indirectly reclaimable memory as free in overcommit" failed to apply to 4.16-stable tree gregkh
@ 2018-05-14 10:46 ` Roman Gushchin
  2018-10-11 14:27   ` Greg KH
  0 siblings, 1 reply; 5+ messages in thread
From: Roman Gushchin @ 2018-05-14 10:46 UTC (permalink / raw)
  To: gregkh; +Cc: akpm, hannes, mhocko, torvalds, viro, stable

On Sat, May 12, 2018 at 03:35:59PM +0200, gregkh@linuxfoundation.org wrote:
> 
> The patch below does not apply to the 4.16-stable tree.
> If someone wants it applied there, or to any other stable or longterm
> tree, then please email the backport, including the original git commit
> id to <stable@vger.kernel.org>.
> 
> thanks,
> 
> greg k-h

Hi, Greg!

This patch is a part of the following patchset:
7aaf77272358 mm: don't show nr_indirectly_reclaimable in /proc/vmstat
d79f7aa496fc mm: treat indirectly reclaimable memory as free in overcommit logic
f1782c9bc547 dcache: account external names as indirectly reclaimable memory
034ebf65c3c2 mm: treat indirectly reclaimable memory as available in MemAvailable
eb59254608bc mm: introduce NR_INDIRECTLY_RECLAIMABLE_BYTES

It should be backported as a whole. It applies cleanly on 4.16-stable,
and with a minor trivial adjustment to 4.14-stable.

Thank you!

Roman

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: FAILED: patch "[PATCH] mm: treat indirectly reclaimable memory as free in overcommit" failed to apply to 4.16-stable tree
  2018-05-14 10:46 ` Roman Gushchin
@ 2018-10-11 14:27   ` Greg KH
  2018-10-11 21:04     ` Roman Gushchin
  0 siblings, 1 reply; 5+ messages in thread
From: Greg KH @ 2018-10-11 14:27 UTC (permalink / raw)
  To: Roman Gushchin; +Cc: akpm, hannes, mhocko, torvalds, viro, stable

On Mon, May 14, 2018 at 11:46:00AM +0100, Roman Gushchin wrote:
> On Sat, May 12, 2018 at 03:35:59PM +0200, gregkh@linuxfoundation.org wrote:
> > 
> > The patch below does not apply to the 4.16-stable tree.
> > If someone wants it applied there, or to any other stable or longterm
> > tree, then please email the backport, including the original git commit
> > id to <stable@vger.kernel.org>.
> > 
> > thanks,
> > 
> > greg k-h
> 
> Hi, Greg!
> 
> This patch is a part of the following patchset:
> 7aaf77272358 mm: don't show nr_indirectly_reclaimable in /proc/vmstat
> d79f7aa496fc mm: treat indirectly reclaimable memory as free in overcommit logic
> f1782c9bc547 dcache: account external names as indirectly reclaimable memory
> 034ebf65c3c2 mm: treat indirectly reclaimable memory as available in MemAvailable
> eb59254608bc mm: introduce NR_INDIRECTLY_RECLAIMABLE_BYTES
> 
> It should be backported as a whole. It applies cleanly on 4.16-stable,
> and with a minor trivial adjustment to 4.14-stable.

Sorry for the long delay, digging out of my stable backlog...

Anyway, is this still needed for 4.14-stable?

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: FAILED: patch "[PATCH] mm: treat indirectly reclaimable memory as free in overcommit" failed to apply to 4.16-stable tree
  2018-10-11 14:27   ` Greg KH
@ 2018-10-11 21:04     ` Roman Gushchin
  2018-10-16 14:01       ` Greg KH
  0 siblings, 1 reply; 5+ messages in thread
From: Roman Gushchin @ 2018-10-11 21:04 UTC (permalink / raw)
  To: Greg KH; +Cc: akpm, hannes, mhocko, torvalds, viro, stable

On Thu, Oct 11, 2018 at 04:27:46PM +0200, Greg KH wrote:
> On Mon, May 14, 2018 at 11:46:00AM +0100, Roman Gushchin wrote:
> > On Sat, May 12, 2018 at 03:35:59PM +0200, gregkh@linuxfoundation.org wrote:
> > > 
> > > The patch below does not apply to the 4.16-stable tree.
> > > If someone wants it applied there, or to any other stable or longterm
> > > tree, then please email the backport, including the original git commit
> > > id to <stable@vger.kernel.org>.
> > > 
> > > thanks,
> > > 
> > > greg k-h
> > 
> > Hi, Greg!
> > 
> > This patch is a part of the following patchset:
> > 7aaf77272358 mm: don't show nr_indirectly_reclaimable in /proc/vmstat
> > d79f7aa496fc mm: treat indirectly reclaimable memory as free in overcommit logic
> > f1782c9bc547 dcache: account external names as indirectly reclaimable memory
> > 034ebf65c3c2 mm: treat indirectly reclaimable memory as available in MemAvailable
> > eb59254608bc mm: introduce NR_INDIRECTLY_RECLAIMABLE_BYTES
> > 
> > It should be backported as a whole. It applies cleanly on 4.16-stable,
> > and with a minor trivial adjustment to 4.14-stable.
> 
> Sorry for the long delay, digging out of my stable backlog...
> 
> Anyway, is this still needed for 4.14-stable?

There is a security issue, which these patches are closing. It allows to cause
a system-wide memory allocation failure, if overcommit logic is enabled and
it's possible to create negative dentries (e.g. asking httpd for non-existing
files). The issue is very old and exists in most stable branches, so Idk how
bad is to leave it open in 4.14.
Anyway, please, let me know if I can help somehow.

Thanks!

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: FAILED: patch "[PATCH] mm: treat indirectly reclaimable memory as free in overcommit" failed to apply to 4.16-stable tree
  2018-10-11 21:04     ` Roman Gushchin
@ 2018-10-16 14:01       ` Greg KH
  0 siblings, 0 replies; 5+ messages in thread
From: Greg KH @ 2018-10-16 14:01 UTC (permalink / raw)
  To: Roman Gushchin; +Cc: akpm, hannes, mhocko, torvalds, viro, stable

On Thu, Oct 11, 2018 at 09:04:17PM +0000, Roman Gushchin wrote:
> On Thu, Oct 11, 2018 at 04:27:46PM +0200, Greg KH wrote:
> > On Mon, May 14, 2018 at 11:46:00AM +0100, Roman Gushchin wrote:
> > > On Sat, May 12, 2018 at 03:35:59PM +0200, gregkh@linuxfoundation.org wrote:
> > > > 
> > > > The patch below does not apply to the 4.16-stable tree.
> > > > If someone wants it applied there, or to any other stable or longterm
> > > > tree, then please email the backport, including the original git commit
> > > > id to <stable@vger.kernel.org>.
> > > > 
> > > > thanks,
> > > > 
> > > > greg k-h
> > > 
> > > Hi, Greg!
> > > 
> > > This patch is a part of the following patchset:
> > > 7aaf77272358 mm: don't show nr_indirectly_reclaimable in /proc/vmstat
> > > d79f7aa496fc mm: treat indirectly reclaimable memory as free in overcommit logic
> > > f1782c9bc547 dcache: account external names as indirectly reclaimable memory
> > > 034ebf65c3c2 mm: treat indirectly reclaimable memory as available in MemAvailable
> > > eb59254608bc mm: introduce NR_INDIRECTLY_RECLAIMABLE_BYTES
> > > 
> > > It should be backported as a whole. It applies cleanly on 4.16-stable,
> > > and with a minor trivial adjustment to 4.14-stable.
> > 
> > Sorry for the long delay, digging out of my stable backlog...
> > 
> > Anyway, is this still needed for 4.14-stable?
> 
> There is a security issue, which these patches are closing. It allows to cause
> a system-wide memory allocation failure, if overcommit logic is enabled and
> it's possible to create negative dentries (e.g. asking httpd for non-existing
> files). The issue is very old and exists in most stable branches, so Idk how
> bad is to leave it open in 4.14.
> Anyway, please, let me know if I can help somehow.

Ok, all now queued up, let's see how it goes :)

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2018-10-16 21:51 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-05-12 13:35 FAILED: patch "[PATCH] mm: treat indirectly reclaimable memory as free in overcommit" failed to apply to 4.16-stable tree gregkh
2018-05-14 10:46 ` Roman Gushchin
2018-10-11 14:27   ` Greg KH
2018-10-11 21:04     ` Roman Gushchin
2018-10-16 14:01       ` Greg KH

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.