mm/vmstat: fix overflow in mod_zone_page_state()

heicarst · torvalds · commit 6cdb18ad98a4 · 2015-12-29T17:45:49.000-08:00
mod_zone_page_state() takes a "delta" integer argument.  delta contains
the number of pages that should be added or subtracted from a struct
zone's vm_stat field.

If a zone is larger than 8TB this will cause overflows.  E.g.  for a
zone with a size slightly larger than 8TB the line

    mod_zone_page_state(zone, NR_ALLOC_BATCH, zone-&gt;managed_pages);

in mm/page_alloc.c:free_area_init_core() will result in a negative
result for the NR_ALLOC_BATCH entry within the zone's vm_stat, since 8TB
contain 0x8xxxxxxx pages which will be sign extended to a negative
value.

Fix this by changing the delta argument to long type.

This could fix an early boot problem seen on s390, where we have a 9TB
system with only one node.  ZONE_DMA contains 2GB and ZONE_NORMAL the
rest.  The system is trying to allocate a GFP_DMA page but ZONE_DMA is
completely empty, so it tries to reclaim pages in an endless loop.

This was seen on a heavily patched 3.10 kernel.  One possible
explaination seem to be the overflows caused by mod_zone_page_state().
Unfortunately I did not have the chance to verify that this patch
actually fixes the problem, since I don't have access to the system
right now.  However the overflow problem does exist anyway.

Given the description that a system with slightly less than 8TB does
work, this seems to be a candidate for the observed problem.

Signed-off-by: Heiko Carstens &lt;heiko.carstens@de.ibm.com&gt;
Cc: Christoph Lameter &lt;cl@linux.com&gt;
Signed-off-by: Andrew Morton &lt;akpm@linux-foundation.org&gt;
Signed-off-by: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
@@ -176,11 +176,11 @@ extern void zone_statistics(struct zone *, struct zone *, gfp_t gfp);
 #define sub_zone_page_state(__z, __i, __d) mod_zone_page_state(__z, __i, -(__d))
 
 #ifdef CONFIG_SMP
-void __mod_zone_page_state(struct zone *, enum zone_stat_item item, int);
+void __mod_zone_page_state(struct zone *, enum zone_stat_item item, long);
 void __inc_zone_page_state(struct page *, enum zone_stat_item);
 void __dec_zone_page_state(struct page *, enum zone_stat_item);
 
-void mod_zone_page_state(struct zone *, enum zone_stat_item, int);
+void mod_zone_page_state(struct zone *, enum zone_stat_item, long);
 void inc_zone_page_state(struct page *, enum zone_stat_item);
 void dec_zone_page_state(struct page *, enum zone_stat_item);
 
@@ -205,7 +205,7 @@ void set_pgdat_percpu_threshold(pg_data_t *pgdat,
  * The functions directly modify the zone and global counters.
  */
 static inline void __mod_zone_page_state(struct zone *zone,
-			enum zone_stat_item item, int delta)
+			enum zone_stat_item item, long delta)
 {
 	zone_page_state_add(delta, zone, item);
 }
diff --git a/mm/vmstat.c b/mm/vmstat.c
@@ -219,7 +219,7 @@ void set_pgdat_percpu_threshold(pg_data_t *pgdat,
  * particular counter cannot be updated from interrupt context.
  */
 void __mod_zone_page_state(struct zone *zone, enum zone_stat_item item,
-				int delta)
+			   long delta)
 {
 	struct per_cpu_pageset __percpu *pcp = zone->pageset;
 	s8 __percpu *p = pcp->vm_stat_diff + item;
@@ -318,8 +318,8 @@ EXPORT_SYMBOL(__dec_zone_page_state);
  *     1       Overstepping half of threshold
  *     -1      Overstepping minus half of threshold
 */
-static inline void mod_state(struct zone *zone,
-       enum zone_stat_item item, int delta, int overstep_mode)
+static inline void mod_state(struct zone *zone, enum zone_stat_item item,
+			     long delta, int overstep_mode)
 {
 	struct per_cpu_pageset __percpu *pcp = zone->pageset;
 	s8 __percpu *p = pcp->vm_stat_diff + item;
@@ -357,7 +357,7 @@ static inline void mod_state(struct zone *zone,
 }
 
 void mod_zone_page_state(struct zone *zone, enum zone_stat_item item,
-					int delta)
+			 long delta)
 {
 	mod_state(zone, item, delta, 0);
 }
@@ -384,7 +384,7 @@ EXPORT_SYMBOL(dec_zone_page_state);
  * Use interrupt disable to serialize counter updates
  */
 void mod_zone_page_state(struct zone *zone, enum zone_stat_item item,
-					int delta)
+			 long delta)
 {
 	unsigned long flags;
 

Original file line number	Diff line number	Diff line change
`@@ -219,7 +219,7 @@ void set_pgdat_percpu_threshold(pg_data_t *pgdat,`
`219`	`219`	`* particular counter cannot be updated from interrupt context.`
`220`	`220`	`*/`
`221`	`221`	`void __mod_zone_page_state(struct zone *zone, enum zone_stat_item item,`
`222`		`- int delta)`
	`222`	`+ long delta)`
`223`	`223`	`{`
`224`	`224`	`struct per_cpu_pageset __percpu *pcp = zone->pageset;`
`225`	`225`	`s8 __percpu *p = pcp->vm_stat_diff + item;`
`@@ -318,8 +318,8 @@ EXPORT_SYMBOL(__dec_zone_page_state);`
`318`	`318`	`* 1 Overstepping half of threshold`
`319`	`319`	`* -1 Overstepping minus half of threshold`
`320`	`320`	`*/`
`321`		`-static inline void mod_state(struct zone *zone,`
`322`		`- enum zone_stat_item item, int delta, int overstep_mode)`
	`321`	`+static inline void mod_state(struct zone *zone, enum zone_stat_item item,`
	`322`	`+ long delta, int overstep_mode)`
`323`	`323`	`{`
`324`	`324`	`struct per_cpu_pageset __percpu *pcp = zone->pageset;`
`325`	`325`	`s8 __percpu *p = pcp->vm_stat_diff + item;`
`@@ -357,7 +357,7 @@ static inline void mod_state(struct zone *zone,`
`357`	`357`	`}`
`358`	`358`
`359`	`359`	`void mod_zone_page_state(struct zone *zone, enum zone_stat_item item,`
`360`		`- int delta)`
	`360`	`+ long delta)`
`361`	`361`	`{`
`362`	`362`	`mod_state(zone, item, delta, 0);`
`363`	`363`	`}`
`@@ -384,7 +384,7 @@ EXPORT_SYMBOL(dec_zone_page_state);`
`384`	`384`	`* Use interrupt disable to serialize counter updates`
`385`	`385`	`*/`
`386`	`386`	`void mod_zone_page_state(struct zone *zone, enum zone_stat_item item,`
`387`		`- int delta)`
	`387`	`+ long delta)`
`388`	`388`	`{`
`389`	`389`	`unsigned long flags;`
`390`	`390`