[Devel] [PATCH RHEL7 COMMIT] mm/memcg, ub: fix overflow in mem_cgroup_apply_beancounter()

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-514.16.1.vz7.32.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-514.16.1.vz7.32.6
------>
commit 74bb8c32e1b5cba31872080c32575cee8b534c7a
Author: Andrey Ryabinin <aryabinin at virtuozzo.com>
Date:   Mon Jun 5 16:59:51 2017 +0400

    mm/memcg, ub: fix overflow in mem_cgroup_apply_beancounter()
    
    If UBC has unlimited UB_PHYSPAGES/UB_SWAPPAGES mem_cgroup_apply_beancounter()
    will set memcg limits to negative values due to overflow. This will
    lead to bogus -ENOMEM.
    
    Add proper check for overflow and also make sure that we don't mem and memsw
    bigger than PAGE_COUNTER_MAX as this is maximal possible value for page counters.
    
    Reported-by: Vladimir Meshkov <vmeshkov at cloudlinux.com>
    Signed-off-by: Andrey Ryabinin <aryabinin at virtuozzo.com>
---
 mm/memcontrol.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index fff4cb0..66d51b7 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4732,10 +4732,14 @@ int mem_cgroup_apply_beancounter(struct mem_cgroup *memcg,
 
 	mem = ub->ub_parms[UB_PHYSPAGES].limit;
 	memsw = ub->ub_parms[UB_SWAPPAGES].limit;
-	if (memsw < PAGE_COUNTER_MAX - mem)
-		memsw += mem;
-	else
+
+	if (mem > PAGE_COUNTER_MAX)
+		mem = PAGE_COUNTER_MAX;
+
+	if (memsw + mem < mem || memsw + mem > PAGE_COUNTER_MAX)
 		memsw = PAGE_COUNTER_MAX;
+	else
+		memsw += mem;
 
 	oomguar = ub->ub_parms[UB_OOMGUARPAGES].barrier;