[Devel,RHEL7,COMMIT] mm/memcg, ub: fix overflow in mem_cgroup_apply_beancounter()

Submitted by Konstantin Khorenko on June 5, 2017, 12:59 p.m.

Details

Message ID 201706051259.v55Cxpfl011878@finist_cl7.x64_64.work.ct
State New
Series "mm/memcg, ub: fix overflow in mem_cgroup_apply_beancounter()"
Headers show

Commit Message

Konstantin Khorenko June 5, 2017, 12:59 p.m. 
The commit is pushed to "branch-rh7-3.10.0-514.16.1.vz7.32.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-514.16.1.vz7.32.6
------>
commit 74bb8c32e1b5cba31872080c32575cee8b534c7a
Author: Andrey Ryabinin <aryabinin@virtuozzo.com>
Date:   Mon Jun 5 16:59:51 2017 +0400

    mm/memcg, ub: fix overflow in mem_cgroup_apply_beancounter()
    
    If UBC has unlimited UB_PHYSPAGES/UB_SWAPPAGES mem_cgroup_apply_beancounter()
    will set memcg limits to negative values due to overflow. This will
    lead to bogus -ENOMEM.
    
    Add proper check for overflow and also make sure that we don't mem and memsw
    bigger than PAGE_COUNTER_MAX as this is maximal possible value for page counters.
    
    Reported-by: Vladimir Meshkov <vmeshkov@cloudlinux.com>
    Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
---
 mm/memcontrol.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

Patch hide | download patch | download mbox 

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index fff4cb0..66d51b7 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4732,10 +4732,14 @@  int mem_cgroup_apply_beancounter(struct mem_cgroup *memcg,
 
 	mem = ub->ub_parms[UB_PHYSPAGES].limit;
 	memsw = ub->ub_parms[UB_SWAPPAGES].limit;
-	if (memsw < PAGE_COUNTER_MAX - mem)
-		memsw += mem;
-	else
+
+	if (mem > PAGE_COUNTER_MAX)
+		mem = PAGE_COUNTER_MAX;
+
+	if (memsw + mem < mem || memsw + mem > PAGE_COUNTER_MAX)
 		memsw = PAGE_COUNTER_MAX;
+	else
+		memsw += mem;
 
 	oomguar = ub->ub_parms[UB_OOMGUARPAGES].barrier;