On 11/19/2014 12:02 AM, Konstantin Khlebnikov wrote: > On Wed, Nov 19, 2014 at 1:15 AM, Konstantin Khlebnikov <koct9i@xxxxxxxxx> wrote: >> On Tue, Nov 18, 2014 at 11:19 PM, Andrew Morton >> <akpm@xxxxxxxxxxxxxxxxxxxx> wrote: >>> On Mon, 17 Nov 2014 21:41:57 -0500 Rik van Riel <riel@xxxxxxxxxx> wrote: >>> >>>> > Because of the serial forking there does indeed end up being an >>>> > infinite number of vmas. The initial vma can never be deleted >>>> > (even though the initial parent process has long since terminated) >>>> > because the initial vma is referenced by the children. >>>> >>>> There is a finite number of VMAs, but an infite number of >>>> anon_vmas. >>>> >>>> Subtle, yet deadly... >>> >>> Well, we clearly have the data structures screwed up. I've forgotten >>> enough about this code for me to be unable to work out what the fixed >>> up data structures would look like :( But surely there is some proper >>> solution here. Help? >> >> Not sure if it's right but probably we could reuse on fork an old anon_vma >> from the chain if it's already lost all vmas which points to it. >> For endlessly forking exploit this should work mostly like proposed patch >> which stops branching after some depth but without magic constant. > > Something like this. I leave proper comment for tomorrow. Hmm I'm not sure that will work as it is. If I understand it correctly, your patch can detect if the parent's anon_vma has no own references at the fork() time. But at the fork time, the parent is still alive, it only exits after the fork, right? So I guess it still has own references and the child will still allocate its new anon_vma, and the problem is not solved. So maybe we could detect that the own references dropped to zero when the parent does exit, and then change mapping of all relevant pages to the root anon_vma, destroy avc's of children and the anon_vma itself. But that sounds quite heavyweight :/ Vlastimil >> >>> -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>