[X][X/linux-kvm][SRU][PATCH 0/1] mm: mlock: avoid increase mm->locked_vm on mlock() when already mlock2(, MLOCK_ONFAULT)

[Po-Hsu Lin]

BugLink: https://bugs.launchpad.net/bugs/1793451

== Justification ==
When one vma was with flag VM_LOCKED|VM_LOCKONFAULT (by invoking
mlock2(,MLOCK_ONFAULT)), it can again be populated with mlock() with
VM_LOCKED flag only.

There is a hole in mlock_fixup() which increase mm->locked_vm twice even
the two operations are on the same vma and both with VM_LOCKED flags.

The issue can be reproduced by following code:

  mlock2(p, 1024 * 64, MLOCK_ONFAULT); //VM_LOCKED|VM_LOCKONFAULT
  mlock(p, 1024 * 64); //VM_LOCKED

Then check the increase VmLck field in /proc/pid/status(to 128k).

When vma is set with different vm_flags, and the new vm_flags is with
VM_LOCKED, it is not necessarily be a "new locked" vma.

There is a dedicated reproducer, the "mlock203" test in ubuntu_ltp_syscalls, you can see the failure for all the Ubuntu 4.4 kernel:

 <<<test_start>>>
 tag=mlock203 stime=1537369891
 cmdline="mlock203"
 contacts=""
 analysis=exit
 <<<test_output>>>
 tst_test.c:1063: INFO: Timeout per run is 0h 05m 00s
 mlock203.c:63: FAIL: Locking one memory again increased VmLck

 Summary:
 passed 0
 failed 1
 skipped 0
 warnings 0

== Fix ==
b155b4fd (mm: mlock: avoid increase mm->locked_vm on mlock() when already mlock2(,MLOCK_ONFAULT))

A test kernel for Xenial / Xenial-KVM could be found here:
http://people.canonical.com/~phlin/kernel/lp-1793451-mlock203/

== Regression Potential ==
Low, this patch prevents mm->locked_vm from increment just by adding an extra check to see if the old vm_flags is already VM_LOCKED.

== Test Case ==
Run the mlock203 test in ubuntu_ltp_syscalls test suite. And it will pass with the patched kernel.

Simon Guo (1):
  mm: mlock: avoid increase mm->locked_vm on mlock() when already
    mlock2(,MLOCK_ONFAULT)

 mm/mlock.c | 3 +++
 1 file changed, 3 insertions(+)

-- 
2.7.4