+++ /dev/null
-From 7162a1e87b3e380133dadc7909081bb70d0a7041 Mon Sep 17 00:00:00 2001
-From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
-Date: Thu, 21 Jan 2016 16:40:27 -0800
-Subject: mm: fix mlock accouting
-
-From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
-
-commit 7162a1e87b3e380133dadc7909081bb70d0a7041 upstream.
-
-Tetsuo Handa reported underflow of NR_MLOCK on munlock.
-
-Testcase:
-
- #include <stdio.h>
- #include <stdlib.h>
- #include <sys/mman.h>
-
- #define BASE ((void *)0x400000000000)
- #define SIZE (1UL << 21)
-
- int main(int argc, char *argv[])
- {
- void *addr;
-
- system("grep Mlocked /proc/meminfo");
- addr = mmap(BASE, SIZE, PROT_READ | PROT_WRITE,
- MAP_ANONYMOUS | MAP_PRIVATE | MAP_LOCKED | MAP_FIXED,
- -1, 0);
- if (addr == MAP_FAILED)
- printf("mmap() failed\n"), exit(1);
- munmap(addr, SIZE);
- system("grep Mlocked /proc/meminfo");
- return 0;
- }
-
-It happens on munlock_vma_page() due to unfortunate choice of nr_pages
-data type:
-
- __mod_zone_page_state(zone, NR_MLOCK, -nr_pages);
-
-For unsigned int nr_pages, implicitly casted to long in
-__mod_zone_page_state(), it becomes something around UINT_MAX.
-
-munlock_vma_page() usually called for THP as small pages go though
-pagevec.
-
-Let's make nr_pages signed int.
-
-Similar fixes in 6cdb18ad98a4 ("mm/vmstat: fix overflow in
-mod_zone_page_state()") used `long' type, but `int' here is OK for a
-count of the number of sub-pages in a huge page.
-
-Fixes: ff6a6da60b89 ("mm: accelerate munlock() treatment of THP pages")
-Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
-Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
-Tested-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
-Cc: Michel Lespinasse <walken@google.com>
-Acked-by: Michal Hocko <mhocko@suse.com>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- mm/mlock.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/mm/mlock.c
-+++ b/mm/mlock.c
-@@ -172,7 +172,7 @@ static void __munlock_isolation_failed(s
- */
- unsigned int munlock_vma_page(struct page *page)
- {
-- unsigned int nr_pages;
-+ int nr_pages;
- struct zone *zone = page_zone(page);
-
- /* For try_to_munlock() and to serialize with page migration */