linux-kernel - [PATCH] memcg: avoid "free" overflow in memcg_hierarchical_free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1289292853-7022-1-git-send-email-gthelen@google.com>
Date:	Tue,  9 Nov 2010 00:54:13 -0800
From:	Greg Thelen <gthelen@...gle.com>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	Balbir Singh <balbir@...ux.vnet.ibm.com>,
	KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com>,
	Daisuke Nishimura <nishimura@....nes.nec.co.jp>,
	Johannes Weiner <hannes@...xchg.org>,
	Wu Fengguang <fengguang.wu@...el.com>,
	Minchan Kim <minchan.kim@...il.com>, linux-mm@...ck.org,
	linux-kernel@...r.kernel.org, Greg Thelen <gthelen@...gle.com>
Subject: [PATCH] memcg: avoid "free" overflow in memcg_hierarchical_free_pages()

memcg limit and usage values are stored in res_counter, as 64-bit
numbers, even on 32-bit machines.  The "free" variable in
memcg_hierarchical_free_pages() stores the difference between two
64-bit numbers (limit - current_usage), and thus should be stored
in a 64-bit local rather than a machine defined unsigned long.

Reported-by: Daisuke Nishimura <nishimura@....nes.nec.co.jp>
Signed-off-by: Greg Thelen <gthelen@...gle.com>
---
 mm/memcontrol.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 35870f9..d8a06d6 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1343,7 +1343,8 @@ static long mem_cgroup_local_page_stat(struct mem_cgroup *mem,
 static unsigned long
 memcg_hierarchical_free_pages(struct mem_cgroup *mem)
 {
-	unsigned long free, min_free;
+	u64 free;
+	unsigned long min_free;
 
 	min_free = global_page_state(NR_FREE_PAGES);
 
@@ -1351,7 +1352,7 @@ memcg_hierarchical_free_pages(struct mem_cgroup *mem)
 		free = (res_counter_read_u64(&mem->res, RES_LIMIT) -
 			res_counter_read_u64(&mem->res, RES_USAGE)) >>
 			PAGE_SHIFT;
-		min_free = min(min_free, free);
+		min_free = min((u64)min_free, free);
 		mem = parent_mem_cgroup(mem);
 	}
 
-- 
1.7.3.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/