Messages in this thread | | | Subject | Re: [PATCH] mm: larger stack guard gap, between vmas | From | Ben Hutchings <> | Date | Wed, 05 Jul 2017 16:25:00 +0100 |
| |
On Wed, 2017-07-05 at 16:23 +0200, Michal Hocko wrote: > On Wed 05-07-17 13:19:40, Ben Hutchings wrote: > > On Tue, 2017-07-04 at 16:31 -0700, Linus Torvalds wrote: > > > On Tue, Jul 4, 2017 at 4:01 PM, Ben Hutchings <ben@decadent.org.uk> > > > wrote: > > > > > > > > We have: > > > > > > > > bottom = 0xff803fff > > > > sp = 0xffffb178 > > > > > > > > The relevant mappings are: > > > > > > > > ff7fc000-ff7fd000 rwxp 00000000 00:00 0 > > > > fffdd000-ffffe000 rw-p 00000000 00:00 > > > > 0 [stack] > > > > > > Ugh. So that stack is actually 8MB in size, but the alloca() is about > > > to use up almost all of it, and there's only about 28kB left between > > > "bottom" and that 'rwx' mapping. > > > > > > Still, that rwx mapping is interesting: it is a single page, and it > > > really is almost exactly 8MB below the stack. > > > > > > In fact, the top of stack (at 0xffffe000) is *exactly* 8MB+4kB from > > > the top of that odd one-page allocation (0xff7fd000). > > > > > > Can you find out where that is allocated? Perhaps a breakpoint on > > > mmap, with a condition to catch that particular one? > > > > [...] > > > > Found it, and it's now clear why only i386 is affected: > > http://hg.openjdk.java.net/jdk8/jdk8/hotspot/file/tip/src/os/linux/vm/os_linux.cpp#l4852 > > http://hg.openjdk.java.net/jdk8/jdk8/hotspot/file/tip/src/os_cpu/linux_x86/vm/os_linux_x86.cpp#l881 > > This is really worrying. This doesn't look like a gap at all. It is a > mapping which actually contains a code and so we should absolutely not > allow to scribble over it. So I am afraid the only way forward is to > allow per process stack gap and run this particular program to have a > smaller gap. We basically have two ways. Either /proc/<pid>/$file or > a prctl inherited on exec. The later is a smaller code. What do you > think?
Distributions can do that, but what about all the other apps out there using JNI and private copies of the JRE?
Soemthing I noticed is that Java doesn't immediately use MAP_FIXED. Look at os::pd_attempt_reserve_memory_at(). If the first, hinted, mmap() doesn't return the hinted address it then attempts to allocate huge areas (I'm not sure how intentional this is) and unmaps the unwanted parts. Then os::workaround_expand_exec_shield_cs_limit() re- mmap()s the wanted part with MAP_FIXED. If this fails at any point it is not a fatal error.
So if we change vm_start_gap() to take the stack limit into account (when it's finite) that should neutralise os::workaround_expand_exec_shield_cs_limit(). I'll try this.
Ben.
-- Ben Hutchings Anthony's Law of Force: Don't force it, get a larger hammer. [unhandled content-type:application/pgp-signature] | |