* [PATCH v2 1/1] mm: Fix the uninitialized use in overcommit_policy_handler
@ 2021-09-22 1:41 Chen Jun
2021-09-22 8:35 ` Michal Hocko
2021-09-22 15:34 ` Feng Tang
0 siblings, 2 replies; 4+ messages in thread
From: Chen Jun @ 2021-09-22 1:41 UTC (permalink / raw)
To: linux-kernel, linux-mm; +Cc: akpm, feng.tang, mhocko, rui.xiang
An unexpected value of /proc/sys/vm/panic_on_oom we will get,
after running the following program.
int main()
{
int fd = open("/proc/sys/vm/panic_on_oom", O_RDWR)
write(fd, "1", 1);
write(fd, "2", 1);
close(fd);
}
write(fd, "2", 1) will pass *ppos = 1 to proc_dointvec_minmax.
proc_dointvec_minmax will return 0 without setting new_policy.
t.data = &new_policy;
ret = proc_dointvec_minmax(&t, write, buffer, lenp, ppos)
-->do_proc_dointvec
-->__do_proc_dointvec
if (write) {
if (proc_first_pos_non_zero_ignore(ppos, table))
goto out;
sysctl_overcommit_memory = new_policy;
so sysctl_overcommit_memory will be set to an uninitialized value.
Check whether new_policy has been changed by proc_dointvec_minmax.
Fixes: 56f3547bfa4d ("mm: adjust vm_committed_as_batch according to vm overcommit policy"
Signed-off-by: Chen Jun <chenjun102@huawei.com>
---
v2:
* Check whether new_policy has been changed by proc_dointvec_minmax.
mm/util.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/mm/util.c b/mm/util.c
index 4ddb6e186dd5..d5be67771850 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -756,7 +756,7 @@ int overcommit_policy_handler(struct ctl_table *table, int write, void *buffer,
size_t *lenp, loff_t *ppos)
{
struct ctl_table t;
- int new_policy;
+ int new_policy = -1;
int ret;
/*
@@ -774,7 +774,7 @@ int overcommit_policy_handler(struct ctl_table *table, int write, void *buffer,
t = *table;
t.data = &new_policy;
ret = proc_dointvec_minmax(&t, write, buffer, lenp, ppos);
- if (ret)
+ if (ret || new_policy == -1)
return ret;
mm_compute_batch(new_policy);
--
2.17.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH v2 1/1] mm: Fix the uninitialized use in overcommit_policy_handler
2021-09-22 1:41 [PATCH v2 1/1] mm: Fix the uninitialized use in overcommit_policy_handler Chen Jun
@ 2021-09-22 8:35 ` Michal Hocko
2021-09-22 15:34 ` Feng Tang
1 sibling, 0 replies; 4+ messages in thread
From: Michal Hocko @ 2021-09-22 8:35 UTC (permalink / raw)
To: Chen Jun; +Cc: linux-kernel, linux-mm, akpm, feng.tang, rui.xiang
On Wed 22-09-21 01:41:22, Chen Jun wrote:
> An unexpected value of /proc/sys/vm/panic_on_oom we will get,
> after running the following program.
>
> int main()
> {
> int fd = open("/proc/sys/vm/panic_on_oom", O_RDWR)
> write(fd, "1", 1);
> write(fd, "2", 1);
> close(fd);
> }
>
> write(fd, "2", 1) will pass *ppos = 1 to proc_dointvec_minmax.
> proc_dointvec_minmax will return 0 without setting new_policy.
>
> t.data = &new_policy;
> ret = proc_dointvec_minmax(&t, write, buffer, lenp, ppos)
> -->do_proc_dointvec
> -->__do_proc_dointvec
> if (write) {
> if (proc_first_pos_non_zero_ignore(ppos, table))
> goto out;
>
> sysctl_overcommit_memory = new_policy;
>
> so sysctl_overcommit_memory will be set to an uninitialized value.
>
> Check whether new_policy has been changed by proc_dointvec_minmax.
>
> Fixes: 56f3547bfa4d ("mm: adjust vm_committed_as_batch according to vm overcommit policy"
> Signed-off-by: Chen Jun <chenjun102@huawei.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Btw. you could also check for new_policy == sysctl_overcommit_memory so
that the sync of pcp counters is not fired without the policy change.
Something for a separate patch I guess.
> ---
>
> v2:
> * Check whether new_policy has been changed by proc_dointvec_minmax.
>
> mm/util.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/mm/util.c b/mm/util.c
> index 4ddb6e186dd5..d5be67771850 100644
> --- a/mm/util.c
> +++ b/mm/util.c
> @@ -756,7 +756,7 @@ int overcommit_policy_handler(struct ctl_table *table, int write, void *buffer,
> size_t *lenp, loff_t *ppos)
> {
> struct ctl_table t;
> - int new_policy;
> + int new_policy = -1;
> int ret;
>
> /*
> @@ -774,7 +774,7 @@ int overcommit_policy_handler(struct ctl_table *table, int write, void *buffer,
> t = *table;
> t.data = &new_policy;
> ret = proc_dointvec_minmax(&t, write, buffer, lenp, ppos);
> - if (ret)
> + if (ret || new_policy == -1)
> return ret;
>
> mm_compute_batch(new_policy);
> --
> 2.17.1
--
Michal Hocko
SUSE Labs
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH v2 1/1] mm: Fix the uninitialized use in overcommit_policy_handler
2021-09-22 1:41 [PATCH v2 1/1] mm: Fix the uninitialized use in overcommit_policy_handler Chen Jun
2021-09-22 8:35 ` Michal Hocko
@ 2021-09-22 15:34 ` Feng Tang
2021-09-23 1:56 ` chenjun (AM)
1 sibling, 1 reply; 4+ messages in thread
From: Feng Tang @ 2021-09-22 15:34 UTC (permalink / raw)
To: Chen Jun; +Cc: linux-kernel, linux-mm, akpm, mhocko, rui.xiang
Hi Jun,
On Wed, Sep 22, 2021 at 01:41:22AM +0000, Chen Jun wrote:
> An unexpected value of /proc/sys/vm/panic_on_oom we will get,
> after running the following program.
>
> int main()
> {
> int fd = open("/proc/sys/vm/panic_on_oom", O_RDWR)
should this be "/proc/sys/vm/overcommit_memory"
> write(fd, "1", 1);
> write(fd, "2", 1);
> close(fd);
> }
>
> write(fd, "2", 1) will pass *ppos = 1 to proc_dointvec_minmax.
> proc_dointvec_minmax will return 0 without setting new_policy.
>
> t.data = &new_policy;
> ret = proc_dointvec_minmax(&t, write, buffer, lenp, ppos)
> -->do_proc_dointvec
> -->__do_proc_dointvec
> if (write) {
> if (proc_first_pos_non_zero_ignore(ppos, table))
> goto out;
>
> sysctl_overcommit_memory = new_policy;
>
> so sysctl_overcommit_memory will be set to an uninitialized value.
>
> Check whether new_policy has been changed by proc_dointvec_minmax.
Other than the nit above, it looks good to me, thanks!
Reviewed-by: Feng Tang <feng.tang@intel.com>
> Fixes: 56f3547bfa4d ("mm: adjust vm_committed_as_batch according to vm overcommit policy"
> Signed-off-by: Chen Jun <chenjun102@huawei.com>
> ---
>
> v2:
> * Check whether new_policy has been changed by proc_dointvec_minmax.
>
> mm/util.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/mm/util.c b/mm/util.c
> index 4ddb6e186dd5..d5be67771850 100644
> --- a/mm/util.c
> +++ b/mm/util.c
> @@ -756,7 +756,7 @@ int overcommit_policy_handler(struct ctl_table *table, int write, void *buffer,
> size_t *lenp, loff_t *ppos)
> {
> struct ctl_table t;
> - int new_policy;
> + int new_policy = -1;
> int ret;
>
> /*
> @@ -774,7 +774,7 @@ int overcommit_policy_handler(struct ctl_table *table, int write, void *buffer,
> t = *table;
> t.data = &new_policy;
> ret = proc_dointvec_minmax(&t, write, buffer, lenp, ppos);
> - if (ret)
> + if (ret || new_policy == -1)
> return ret;
>
> mm_compute_batch(new_policy);
> --
> 2.17.1
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH v2 1/1] mm: Fix the uninitialized use in overcommit_policy_handler
2021-09-22 15:34 ` Feng Tang
@ 2021-09-23 1:56 ` chenjun (AM)
0 siblings, 0 replies; 4+ messages in thread
From: chenjun (AM) @ 2021-09-23 1:56 UTC (permalink / raw)
To: Feng Tang; +Cc: linux-kernel, linux-mm, akpm, mhocko, Xiangrui (Euler)
Hi Tang,
在 2021/9/22 23:34, Feng Tang 写道:
> Hi Jun,
>
> On Wed, Sep 22, 2021 at 01:41:22AM +0000, Chen Jun wrote:
>> An unexpected value of /proc/sys/vm/panic_on_oom we will get,
>> after running the following program.
>>
>> int main()
>> {
>> int fd = open("/proc/sys/vm/panic_on_oom", O_RDWR)
>
> should this be "/proc/sys/vm/overcommit_memory"
>
Sorry, that is my mistake, I will correct it in v3. Thanks.
>> write(fd, "1", 1);
>> write(fd, "2", 1);
>> close(fd);
>> }
>>
>> write(fd, "2", 1) will pass *ppos = 1 to proc_dointvec_minmax.
>> proc_dointvec_minmax will return 0 without setting new_policy.
>>
>> t.data = &new_policy;
>> ret = proc_dointvec_minmax(&t, write, buffer, lenp, ppos)
>> -->do_proc_dointvec
>> -->__do_proc_dointvec
>> if (write) {
>> if (proc_first_pos_non_zero_ignore(ppos, table))
>> goto out;
>>
>> sysctl_overcommit_memory = new_policy;
>>
>> so sysctl_overcommit_memory will be set to an uninitialized value.
>>
>> Check whether new_policy has been changed by proc_dointvec_minmax.
>
> Other than the nit above, it looks good to me, thanks!
>
> Reviewed-by: Feng Tang <feng.tang@intel.com>
>
>> Fixes: 56f3547bfa4d ("mm: adjust vm_committed_as_batch according to vm overcommit policy"
>> Signed-off-by: Chen Jun <chenjun102@huawei.com>
>> ---
>>
>> v2:
>> * Check whether new_policy has been changed by proc_dointvec_minmax.
>>
>> mm/util.c | 4 ++--
>> 1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/mm/util.c b/mm/util.c
>> index 4ddb6e186dd5..d5be67771850 100644
>> --- a/mm/util.c
>> +++ b/mm/util.c
>> @@ -756,7 +756,7 @@ int overcommit_policy_handler(struct ctl_table *table, int write, void *buffer,
>> size_t *lenp, loff_t *ppos)
>> {
>> struct ctl_table t;
>> - int new_policy;
>> + int new_policy = -1;
>> int ret;
>>
>> /*
>> @@ -774,7 +774,7 @@ int overcommit_policy_handler(struct ctl_table *table, int write, void *buffer,
>> t = *table;
>> t.data = &new_policy;
>> ret = proc_dointvec_minmax(&t, write, buffer, lenp, ppos);
>> - if (ret)
>> + if (ret || new_policy == -1)
>> return ret;
>>
>> mm_compute_batch(new_policy);
>> --
>> 2.17.1
>>
>
--
Regards
Chen Jun
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-09-23 1:56 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-22 1:41 [PATCH v2 1/1] mm: Fix the uninitialized use in overcommit_policy_handler Chen Jun
2021-09-22 8:35 ` Michal Hocko
2021-09-22 15:34 ` Feng Tang
2021-09-23 1:56 ` chenjun (AM)
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.