linux-kernel - [PATCH] virtio_balloon: fix shrinker pages_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20191115225557.61847-1-khazhy@google.com>
Date:   Fri, 15 Nov 2019 14:55:57 -0800
From:   Khazhismel Kumykov <khazhy@...gle.com>
To:     mst@...hat.com, jasowang@...hat.com, wei.w.wang@...el.com
Cc:     virtualization@...ts.linux-foundation.org,
        linux-kernel@...r.kernel.org,
        Khazhismel Kumykov <khazhy@...gle.com>
Subject: [PATCH] virtio_balloon: fix shrinker pages_to_free calculation

To my reading, we're accumulating total freed pages in pages_freed, but
subtracting it every iteration from pages_to_free, meaning we'll count
earlier iterations multiple times, freeing fewer pages than expected.
Just accumulate in pages_freed, and compare to pages_to_free.

There's also a unit mismatch, where pages_to_free seems to be virtio
balloon pages, and pages_freed is system pages (We divide by
VIRTIO_BALLOON_PAGES_PER_PAGE), so sutracting pages_freed from
pages_to_free may result in freeing too much.

There also seems to be a mismatch between shrink_free_pages() and
shrink_balloon_pages(), where in both pages_to_free is given as # of
virtio pages to free, but free_pages() returns virtio pages, and
balloon_pages returns system pages.

(For 4K PAGE_SIZE, this mismatch wouldn't be noticed since
VIRTIO_BALLOON_PAGES_PER_PAGE would be 1)

Have both return virtio pages, and divide into system pages when
returning from shrinker_scan()

Fixes: 71994620bb25 ("virtio_balloon: replace oom notifier with shrinker")
Cc: Wei Wang <wei.w.wang@...el.com>
Signed-off-by: Khazhismel Kumykov <khazhy@...gle.com>
---

Tested this under memory pressure conditions and the shrinker seemed to
shrink.

 drivers/virtio/virtio_balloon.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 226fbb995fb0..7951ece3fe24 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -782,11 +782,8 @@ static unsigned long shrink_balloon_pages(struct virtio_balloon *vb,
 	 * VIRTIO_BALLOON_ARRAY_PFNS_MAX balloon pages, so we call it
 	 * multiple times to deflate pages till reaching pages_to_free.
 	 */
-	while (vb->num_pages && pages_to_free) {
-		pages_freed += leak_balloon(vb, pages_to_free) /
-					VIRTIO_BALLOON_PAGES_PER_PAGE;
-		pages_to_free -= pages_freed;
-	}
+	while (vb->num_pages && pages_to_free > pages_freed)
+		pages_freed += leak_balloon(vb, pages_to_free - pages_freed);
 	update_balloon_size(vb);
 
 	return pages_freed;
@@ -805,11 +802,11 @@ static unsigned long virtio_balloon_shrinker_scan(struct shrinker *shrinker,
 		pages_freed = shrink_free_pages(vb, pages_to_free);
 
 	if (pages_freed >= pages_to_free)
-		return pages_freed;
+		return pages_freed / VIRTIO_BALLOON_PAGES_PER_PAGE;
 
 	pages_freed += shrink_balloon_pages(vb, pages_to_free - pages_freed);
 
-	return pages_freed;
+	return pages_freed / VIRTIO_BALLOON_PAGES_PER_PAGE;
 }
 
 static unsigned long virtio_balloon_shrinker_count(struct shrinker *shrinker,
-- 
2.24.0.432.g9d3f5f5b63-goog