On Wed, Mar 29, 2017 at 11:17 PM, Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> wrote: > On Wed, 29 Mar 2017 14:08:02 -0700 Mike Kravetz <mike.kravetz@xxxxxxxxxx> wrote: > >> Resending because of typo in Andrew's e-mail when first sent >> >> Changes to hugetlbfs reservation maps is a two step process. The first >> step is a call to region_chg to determine what needs to be changed, and >> prepare that change. This should be followed by a call to call to >> region_add to commit the change, or region_abort to abort the change. >> >> The error path in hugetlb_reserve_pages called region_abort after a >> failed call to region_chg. As a result, the adds_in_progress counter >> in the reservation map is off by 1. This is caught by a VM_BUG_ON >> in resv_map_release when the reservation map is freed. >> >> syzkaller fuzzer found this bug, that resulted in the following: > > I'll change the above to > > : syzkaller fuzzer (when using an injected kmalloc failure) found this bug, > : that resulted in the following: > > it's important, because this bug won't be triggered (at all easily, at > least) in real-world workloads. I wonder if memory-constrained cgroups make such bugs much easier to trigger. -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>
