From patchwork Mon Aug 19 00:35:00 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kartavya Vashishtha X-Patchwork-Id: 13767686 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 47840C52D7C for ; Mon, 19 Aug 2024 00:35:07 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 7A2706B0083; Sun, 18 Aug 2024 20:35:06 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 752456B0085; Sun, 18 Aug 2024 20:35:06 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 6194B6B0088; Sun, 18 Aug 2024 20:35:06 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 4216F6B0083 for ; Sun, 18 Aug 2024 20:35:06 -0400 (EDT) Received: from smtpin16.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id C2B3180E6A for ; Mon, 19 Aug 2024 00:35:05 +0000 (UTC) X-FDA: 82467125370.16.113516C Received: from mail-yw1-f175.google.com (mail-yw1-f175.google.com [209.85.128.175]) by imf07.hostedemail.com (Postfix) with ESMTP id 0D03240004 for ; Mon, 19 Aug 2024 00:35:03 +0000 (UTC) Authentication-Results: imf07.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=jVAGJ5FM; spf=pass (imf07.hostedemail.com: domain of sendtokartavya@gmail.com designates 209.85.128.175 as permitted sender) smtp.mailfrom=sendtokartavya@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1724027601; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding:in-reply-to: references:dkim-signature; bh=9EJXHJ9qi8Cgg7oPsKi97eGulu9T3h7dGj3U8WokiHY=; b=T/RRATj4l0w5u8I13jQygwKaUGTU5bj6UKJHNl0lbOLaMhB8pLOnomaT5PAtk+YRPmQja2 QtEpUSJhrUxoBr/rGZVU4rspoI5y5H8QRAUlo0LTA+aeM8sf1jtalURP4ogX83qwOeJLtL u9EHzAyKaU/FwOIO9raoOM6Cz99DxHs= ARC-Authentication-Results: i=1; imf07.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=jVAGJ5FM; spf=pass (imf07.hostedemail.com: domain of sendtokartavya@gmail.com designates 209.85.128.175 as permitted sender) smtp.mailfrom=sendtokartavya@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1724027601; a=rsa-sha256; cv=none; b=uU9S+6+RNW0flydPRZ4MrMmQS8ky5o6AQ9ynEjWw7pjKBPAwhVVgJbb3cOIRlvGg7xi1s9 YFKRt89cigScG4A8arH0Q33pMm2gen6lJN0HEHOkd4GC3T3txiOF2TLrhE0vw3d+dC69GR jMQN7vfzPkzL3PFDEfwSPfKdM+M2gHc= Received: by mail-yw1-f175.google.com with SMTP id 00721157ae682-6b5c37a3138so10120397b3.1 for ; Sun, 18 Aug 2024 17:35:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1724027703; x=1724632503; darn=kvack.org; h=content-disposition:mime-version:subject:cc:to:from:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=9EJXHJ9qi8Cgg7oPsKi97eGulu9T3h7dGj3U8WokiHY=; b=jVAGJ5FMFcjCAe1WMzalpUGHrjqG6u4FaAx7W3KlRwQPzhAWm6ENsS6en2ddcRZvC7 MKgAatG13HnmZvPFo0wgwiejhVg8q+XqZ/bABjvbmkyAl8hRW+nAhoQBNWKd5YfIZC0Y Lx3S7yVKspVqEdNXg+/OptUrVNdZOJbDej/xlcZLN3dPFOGis1tQsCrR7/lfOvsRxFmF p2KTTKNdToIvjcNXISLuOAa08NwFLEMk8Mv4nPZCdIQ1Kz1RMFQ6aKq2qq/XZQJt/WfS uRwQDAJPMalgo9GisopNOccDbR2ymqr/EnSRfqpykCDEw9gzZq/AbsuR/2tRCAee6XAH woLw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1724027703; x=1724632503; h=content-disposition:mime-version:subject:cc:to:from:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=9EJXHJ9qi8Cgg7oPsKi97eGulu9T3h7dGj3U8WokiHY=; b=YvA5Bwm2c/4DQps6o01RKXK/R2rMeKdwpZYjuHEFqm9R9ScHG3Dt8IjDjBgETGVyGr TgxLRI2E10DaW1URq7hn2vPA2BLvKnTrkmTShgfegp8mMUYLqEDrbKMdZr+3URL+7ifS pmz0pDMkICxkoXHDWcu5MFgiG8Ot2rntByPfxDqIwwomxQsowDfOTZwUSid2V890/xN0 lOf0BNwrv+OEdMSdWZYPGAQmlNEW3j8WgSiiSgXsYKHf4a9/qsg95Yz6nXCg6Fk/5YkA aw3Qv6Q2kC106NfejnNTLYk/aPuLAHOpb6yffUbhl87fq6XLPi1IFsP8pheVXPRbBR6H /pCw== X-Gm-Message-State: AOJu0YwmIk6VdKGST9IDSzIyzWsNJ0oe8MKzNrrq4SGqqDTm+/mGmznS t2+MCKk1yjjgSKEU5CZ9zw1AKAVuawuYIvk4HAcc5flQuSzi4iAy X-Google-Smtp-Source: AGHT+IH2jDe0PIU/ANl5ECJ4Q+vEkfFxusFVS7yJ6nTdRRZE9HPxiquIr/hK7csOGyLNQscG3XUgbQ== X-Received: by 2002:a05:690c:4341:b0:6b0:e93b:7179 with SMTP id 00721157ae682-6b1bbb4bd94mr81170847b3.26.1724027702917; Sun, 18 Aug 2024 17:35:02 -0700 (PDT) Received: from LAPTOP-SJNQNCTH. ([195.252.220.166]) by smtp.gmail.com with ESMTPSA id 00721157ae682-6af9ce76a44sm14244347b3.98.2024.08.18.17.35.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 18 Aug 2024 17:35:02 -0700 (PDT) Message-ID: <66c29336.050a0220.395e9a.76bf@mx.google.com> X-Google-Original-Message-ID: Date: Sun, 18 Aug 2024 20:35:00 -0400 From: Kartavya Vashishtha To: akpm@linux-foundation.org, Liam.Howlett@oracle.com, vbabka@suse.cz, lorenzo.stoakes@oracle.com Cc: linux-mm@kvack.org Subject: [PATCH] mm/mmap.c: make brk() check RLIMIT_AS before page-aligning requested amount MIME-Version: 1.0 Content-Disposition: inline X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: 0D03240004 X-Stat-Signature: 1ycqmgyzm8wxwfoobhmitjsnxwtrgzdz X-Rspam-User: X-HE-Tag: 1724027703-119762 X-HE-Meta: U2FsdGVkX1+9UEDGHsN++11vDt80hDH92yu/NjRIcuAiagNGNJ+hCd+uEogXrmflSS5IagQzigifLVinIb3jL/Ti2+e01JEbozxJ1ObnsHTYNAvt/Y8+Xviv0g/F3poilr2CopbpxH2nGDyDB6u//h7sG+dgQjaHJixIx2y1IFjQppqnghu40Urv7NIqdsB+zh4CPmjYC0elUZNNFQuE4Rx2APET+A0Bm+P63IA2yk47ECRD31iPuYkKGgZdIpm3isEIu8qOrwtMhexxq/SbIP3ot1UPTmVn6BjGoVTBqM8WazXmOAuoS7H92eEX7DUTiUm2c3nMxBYKxjEhOuFZkTCdlkVQr3igDLUOLYZ1vQ7B1zM3C7n6u4alopSxfv0yDKWK0GmHNCHixAM+louzaPWx7HrW4p0joWj8zDFfCIe5GKCjtO2sfRY97z/Qmayd/51GXWX29kGL1Tov9Gx4UbzphWqarXs5WpNgnzLmamVg/ozRSyvtdLvmNbiOZg18TMHwJ41iptOYTDntAJdhi3UQMxmavC/fCsH3eJy7xTy1d+i5zYARcJaJCcI+KglMXL0hK/eHF6k5EF2DSo0tCyTBmfU5WHrm8Cc4H60LAcX8ZWWkvgL6T8XoAet8kLzx+kvIzaO+WxwPpiemqQkJp0QifZ6jWTT3Q2btLCiRnnQFORNJY7QYKuPKS8uU/Wn1KL1m/oPz+YF7/lTcFOU8yQBzn1ckDk3F0b8LMxvC+14rj47Du3hOtxBAZ3oBwrvOQkl7GpRyhv14WUOhTI1MmqGF7vG2qeEFmoFs4XDFdl5Xp5VNCwnK76vBkMpcUBXuYLtmnuFPXUIPtUKBwbTHuAmajFQc0X7ug2mjejMSiirj9mqW4YBruSddZr45vkWy2J+42OdJK+69HCqCFG5p2JqxJ8549sJmLZAY5e7oXLGaRxQ4GitUxeCgyGI8QtHAX/ifbQ6SgPYYYB6ypNQ GGVkJt6s +JLgQsRu/0Ow4xVM9/lGOkwq/mMUNZOZKhrWQs8HPdHWxzaSHmEWOT5enGasvD1YLiXfNZMLz5GAs5rWXbMjXbnA22M/hs6W2aJkeIGYCXYfDt8ShpTpwN7MRJCOtD+M3YlTUEJ9LXimCR2setJk+FyjJojZ+Ob/c23dXubX2oBZkXVFOwtHy5/e1rCLmy1PvR/GsQA0cGhNVACe7h4HWmlLJtZLryVKm+9tpNTbiAHeQW96PnDD/upt9p6PxmBn9TSNtAmrgCMhFnqDifdgLu56jdwBCXohXICVVjpHkaMQxjP8mkhukWxLsfZOudvYRrRTgYy4K5OThNAYzBL59cenQuU5dC4w6KmEzdsCGGZN/7rPvv4xHsLgWajWZW9mzVKx0cf2NIdg7qzL6V5On0ld4nA== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000006, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Currently, brk() only checks against RLIMIT_DATA when validating whether the requested amount of memory is valid with respect to rlimit. RLIMIT_AS is checked later in the `may_expand_vm` call in `do_brk_flags`, but that call occurs after aligning the new brk to a page boundary, making the following possible: 1. Allocate a non-page-sized amount of memory with brk() 2. brk() will internally page-align the requested amount, and allocate the necessary amount of pages. 3. Set RLIMIT_AS to 1 byte using setrlimit. 4. Calling brk() again with a small increment (such that it does not overflow to the next page) will succeed. This violates setrlimit RLIMIT_AS, since the call succeeds despite a 1 byte limit. The following code snippet reproduces this behavior: ``` int main() { void * mem = malloc(4096); sbrk(32); // set RLIMIT_AS for the processe's address space to 1 byte // This causes all future calls to sbrk to fail struct rlimit lim; getrlimit(RLIMIT_AS, &lim); lim.rlim_cur = 1; printf("lim.rlim_max: %ld\n", lim.rlim_max); setrlimit(RLIMIT_AS, &lim); printf("Mallocing an additional 8 bytes, which requires more "memory from sbrk, but sbrk SHOULD fail\n"); void * ptr = sbrk(8); printf("sbrk result: %p\n", ptr); if (ptr != -1) { printf("sbrk unexpectedly passed\n"); } else { printf("sbrk expectedly failed\n"); } free(mem); } ``` Signed-off-by: Kartavya Vashishtha --- mm/mmap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mm/mmap.c b/mm/mmap.c index d0dfc85b209b..5f7fc6591323 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -253,8 +253,8 @@ SYSCALL_DEFINE1(brk, unsigned long, brk) * segment grow beyond its set limit the in case where the limit is * not page aligned -Ram Gupta */ - if (check_data_rlimit(rlimit(RLIMIT_DATA), brk, mm->start_brk, - mm->end_data, mm->start_data)) + if (check_data_rlimit(min(rlimit(RLIMIT_AS), rlimit(RLIMIT_DATA)), + brk, mm->start_brk, mm->end_data, mm->start_data)) goto out; newbrk = PAGE_ALIGN(brk);