Messages in this thread | | | Date | Wed, 30 Sep 2015 19:49:40 +0300 | From | Vladimir Davydov <> | Subject | Re: [PATCH 2/5] fs: charge pipe buffers to memcg |
| |
On Tue, Sep 29, 2015 at 03:57:11PM -0700, Andrew Morton wrote: > On Sat, 26 Sep 2015 13:45:54 +0300 Vladimir Davydov <vdavydov@parallels.com> wrote: > > > Pipe buffers can be generated unrestrictedly by an unprivileged > > userspace process, so they shouldn't go unaccounted. > > > > ... > > > > --- a/fs/pipe.c > > +++ b/fs/pipe.c > > @@ -400,7 +400,7 @@ pipe_write(struct kiocb *iocb, struct iov_iter *from) > > int copied; > > > > if (!page) { > > - page = alloc_page(GFP_HIGHUSER); > > + page = alloc_kmem_pages(GFP_HIGHUSER, 0); > > if (unlikely(!page)) { > > ret = ret ? : -ENOMEM; > > break; > > This seems broken. We have a page buffer page which has a weird > ->mapcount. Now it gets stolen (generic_pipe_buf_steal()) and spliced > into pagecache. Then the page gets mmapped and MM starts playing with > its ->_mapcount?
Right you are! I completely forgot of vmsplice case. Surely, we need to uncharge the page in the ->steal method and clear its PageKmem. Will fix that.
Thanks, Vladimir
| |