| Message ID | 20220310132417.41189-1-linmiaohe@huawei.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | mm/mlock: fix potential imbalanced rlimit ucounts adjustment | expand |
On Thu, 10 Mar 2022, Miaohe Lin wrote: > user_shm_lock forgets to set allowed to 0 when get_ucounts fails. So > the later user_shm_unlock might do the extra dec_rlimit_ucounts. Fix > this by resetting allowed to 0. > > Fixes: 5ed44a401ddf ("do not limit locked memory when RLIMIT_MEMLOCK is RLIM_INFINITY") > Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> NAK. user_shm_lock() remembers to declare "int allowed = 0" on entry. > --- > mm/mlock.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/mm/mlock.c b/mm/mlock.c > index 29372c0eebe5..efd2dd2943de 100644 > --- a/mm/mlock.c > +++ b/mm/mlock.c > @@ -733,6 +733,7 @@ int user_shm_lock(size_t size, struct ucounts *ucounts) > } > if (!get_ucounts(ucounts)) { > dec_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_MEMLOCK, locked); > + allowed = 0; > goto out; > } > allowed = 1; > -- > 2.23.0 > > >
On 2022/3/14 10:40, Hugh Dickins wrote: > On Thu, 10 Mar 2022, Miaohe Lin wrote: > >> user_shm_lock forgets to set allowed to 0 when get_ucounts fails. So >> the later user_shm_unlock might do the extra dec_rlimit_ucounts. Fix >> this by resetting allowed to 0. >> >> Fixes: 5ed44a401ddf ("do not limit locked memory when RLIMIT_MEMLOCK is RLIM_INFINITY") >> Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> > > NAK. user_shm_lock() remembers to declare "int allowed = 0" on entry. > If lock_limit is RLIM_INFINITY, "allowed" will be set to 1. And if get_ucounts fails in some corner cases, "allowed" will remain to be 1 while the user_shm_lock ops indeed fails. Or am I miss something? Many thanks for comment. >> --- >> mm/mlock.c | 1 + >> 1 file changed, 1 insertion(+) >> >> diff --git a/mm/mlock.c b/mm/mlock.c >> index 29372c0eebe5..efd2dd2943de 100644 >> --- a/mm/mlock.c >> +++ b/mm/mlock.c >> @@ -733,6 +733,7 @@ int user_shm_lock(size_t size, struct ucounts *ucounts) >> } >> if (!get_ucounts(ucounts)) { >> dec_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_MEMLOCK, locked); >> + allowed = 0; >> goto out; >> } >> allowed = 1; >> -- >> 2.23.0 >> >> >> > . >
On Mon, 14 Mar 2022, Miaohe Lin wrote: > On 2022/3/14 10:40, Hugh Dickins wrote: > > On Thu, 10 Mar 2022, Miaohe Lin wrote: > > > >> user_shm_lock forgets to set allowed to 0 when get_ucounts fails. So > >> the later user_shm_unlock might do the extra dec_rlimit_ucounts. Fix > >> this by resetting allowed to 0. > >> > >> Fixes: 5ed44a401ddf ("do not limit locked memory when RLIMIT_MEMLOCK is RLIM_INFINITY") > >> Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> > > > > NAK. user_shm_lock() remembers to declare "int allowed = 0" on entry. > > > > If lock_limit is RLIM_INFINITY, "allowed" will be set to 1. And if get_ucounts fails > in some corner cases, "allowed" will remain to be 1 while the user_shm_lock ops indeed > fails. Or am I miss something? You are right, I am wrong: sorry. Thanks for pointing now to that RLIM_INFINITY case. But then the Fixes tag is wrong: it should be Fixes: d7c9e99aee48 ("Reimplement RLIMIT_MEMLOCK on top of ucounts") which introduced the possibility of error down there. With that, Acked-by: Hugh Dickins <hughd@google.com> > > Many thanks for comment. > > >> --- > >> mm/mlock.c | 1 + > >> 1 file changed, 1 insertion(+) > >> > >> diff --git a/mm/mlock.c b/mm/mlock.c > >> index 29372c0eebe5..efd2dd2943de 100644 > >> --- a/mm/mlock.c > >> +++ b/mm/mlock.c > >> @@ -733,6 +733,7 @@ int user_shm_lock(size_t size, struct ucounts *ucounts) > >> } > >> if (!get_ucounts(ucounts)) { > >> dec_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_MEMLOCK, locked); > >> + allowed = 0; > >> goto out; > >> } > >> allowed = 1; > >> -- > >> 2.23.0
On 2022/3/14 11:11, Hugh Dickins wrote: > On Mon, 14 Mar 2022, Miaohe Lin wrote: >> On 2022/3/14 10:40, Hugh Dickins wrote: >>> On Thu, 10 Mar 2022, Miaohe Lin wrote: >>> >>>> user_shm_lock forgets to set allowed to 0 when get_ucounts fails. So >>>> the later user_shm_unlock might do the extra dec_rlimit_ucounts. Fix >>>> this by resetting allowed to 0. >>>> >>>> Fixes: 5ed44a401ddf ("do not limit locked memory when RLIMIT_MEMLOCK is RLIM_INFINITY") >>>> Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> >>> >>> NAK. user_shm_lock() remembers to declare "int allowed = 0" on entry. >>> >> >> If lock_limit is RLIM_INFINITY, "allowed" will be set to 1. And if get_ucounts fails >> in some corner cases, "allowed" will remain to be 1 while the user_shm_lock ops indeed >> fails. Or am I miss something? > > You are right, I am wrong: sorry. > Thanks for pointing now to that RLIM_INFINITY case. > > But then the Fixes tag is wrong: it should be > Fixes: d7c9e99aee48 ("Reimplement RLIMIT_MEMLOCK on top of ucounts") > which introduced the possibility of error down there. > You're right. commit 5ed44a401ddf ("do not limit locked memory when RLIMIT_MEMLOCK is RLIM_INFINITY") introduced RLIM_INFINITY and set "allowed" to 1 but there is no possibility of error down there. Will change this in V2. > With that, > Acked-by: Hugh Dickins <hughd@google.com> Many thanks! > >> >> Many thanks for comment. >> >>>> --- >>>> mm/mlock.c | 1 + >>>> 1 file changed, 1 insertion(+) >>>> >>>> diff --git a/mm/mlock.c b/mm/mlock.c >>>> index 29372c0eebe5..efd2dd2943de 100644 >>>> --- a/mm/mlock.c >>>> +++ b/mm/mlock.c >>>> @@ -733,6 +733,7 @@ int user_shm_lock(size_t size, struct ucounts *ucounts) >>>> } >>>> if (!get_ucounts(ucounts)) { >>>> dec_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_MEMLOCK, locked); >>>> + allowed = 0; >>>> goto out; >>>> } >>>> allowed = 1; >>>> -- >>>> 2.23.0 > . >
diff --git a/mm/mlock.c b/mm/mlock.c index 29372c0eebe5..efd2dd2943de 100644 --- a/mm/mlock.c +++ b/mm/mlock.c @@ -733,6 +733,7 @@ int user_shm_lock(size_t size, struct ucounts *ucounts) } if (!get_ucounts(ucounts)) { dec_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_MEMLOCK, locked); + allowed = 0; goto out; } allowed = 1;
user_shm_lock forgets to set allowed to 0 when get_ucounts fails. So the later user_shm_unlock might do the extra dec_rlimit_ucounts. Fix this by resetting allowed to 0. Fixes: 5ed44a401ddf ("do not limit locked memory when RLIMIT_MEMLOCK is RLIM_INFINITY") Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> --- mm/mlock.c | 1 + 1 file changed, 1 insertion(+)