The commit is pushed to "branch-rh8-4.18.0-240.1.1.vz8.5.x-ovz" and will appear 
at https://src.openvz.org/scm/ovz/vzkernel.git
after rh8-4.18.0-240.1.1.vz8.5.33
------>
commit 3e4f17448b43a589df2aa2d8cdba757a545ed55f
Author: Kirill Tkhai <[email protected]>
Date:   Tue May 25 12:16:41 2021 +0300

    mm: Fix int overflow in callers of do_shrink_slab()
    
    do_shrink_slab() returns unsigned long value, and
    the placing into int variable cuts high bytes off.
    Then we compare ret and 0xfffffffe (since SHRINK_EMPTY
    is converted to ret type).
    
    Thus, big number of objects returned by do_shrink_slab()
    may be interpreted as SHRINK_EMPTY, if low bytes of
    their value are equal to 0xfffffffe. Fix that
    by declaration ret as unsigned long in these functions.
    
    Reported-by: Cyrill Gorcunov <[email protected]>
    Signed-off-by: Kirill Tkhai <[email protected]>
    Acked-by: Cyrill Gorcunov <[email protected]>
    
    (cherry-picked from vz7 commit b55ead794a0f ("mm: Fix int overflow in 
callers of
    do_shrink_slab()"))
    
    ms commit: b8e57efa2c98 ("mm/vmscan.c: fix int overflow in callers of
    do_shrink_slab()")
    
    Signed-off-by: Andrey Zhadchenko <[email protected]>
---
 mm/vmscan.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/mm/vmscan.c b/mm/vmscan.c
index 7dbc3de34115..863d1c258bdd 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -539,8 +539,8 @@ static unsigned long shrink_slab_memcg(gfp_t gfp_mask, int 
nid,
                        struct mem_cgroup *memcg, int priority)
 {
        struct memcg_shrinker_map *map;
-       unsigned long freed = 0;
-       int ret, i;
+       unsigned long ret, freed = 0;
+       int i;
 
        if (!memcg_kmem_enabled() || !mem_cgroup_online(memcg))
                return 0;
@@ -636,9 +636,8 @@ static unsigned long shrink_slab(gfp_t gfp_mask, int nid,
                                 struct mem_cgroup *memcg,
                                 int priority, bool for_drop_caches)
 {
+       unsigned long ret, freed = 0;
        struct shrinker *shrinker;
-       unsigned long freed = 0;
-       int ret;
 
        /*
         * The root memcg might be allocated even though memcg is disabled
_______________________________________________
Devel mailing list
[email protected]
https://lists.openvz.org/mailman/listinfo/devel

Reply via email to