linux-kernel - negative anon

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <455A5F97.1070509@draigBrady.com>
Date:	Wed, 15 Nov 2006 00:30:15 +0000
From:	Pádraig Brady <P@...igBrady.com>
To:	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
CC:	Lauri Lubi <lauri@...i.se>
Subject: negative anon_rss?

Sorry for not sending this to linux-mm,
but I can't subscribe at present? Anyway...

I wrote the following script to try and accurately determine
how much RAM a particular program uses:
http://www.pixelbeat.org/scripts/ps_mem.py

A user reported an issue on debian with kernel 2.6.8-2-386
where many processes were being reported as using
a negative amount of memory.

I asked him to run the following:

  (
    echo total rss shared trs - drs -
    for pid in `pidof apache2`; do
        cat /proc/$pid/statm
    done
  ) | column -t

the output of which was:

  total  rss   shared  trs  -  drs   -
  6580   2306  5273    95   0  6485  0
  6580   2313  5273    95   0  6485  0
  6119   1717  5269    95   0  6024  0
  6630   2371  5273    95   0  6535  0
  6735   2503  5273    95   0  6640  0
  6773   2546  5273    95   0  6678  0
  5845   1146  5198    95   0  5750  0

Notice the large values for the shared column.
Also notice that the shared column is larger than rss!?
I had assumed that shared was a subset of rss from
the following (pseudo) code from fs/proc/task_mmu.c::task_statm()

  *total  = mm->total_em
  *shared = get_mm_counter(mm, file_rss)
  *rss    = *shared + get_mm_counter(mm, anon_rss)
  *trs    = mm->end_code - mm->start_code
  *drs    = mm->total_vm - mm->shared_vm

Therefore anon_rss must be negative in the kernel?
So there is a mismatch between pages being marked
as anonymous and anon_rss being updated appropriately?

cheers,
Pádraig.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/