Willy's memory-management to-do list

Posted May 4, 2018 13:33 UTC (Fri) by excors (subscriber, #95769)
Parent article: Willy's memory-management to-do list

> it simply kills any process that has tried to map the same page more than 5,000 times

Does that potentially interact with KSM, or VMs that merge identical pages in other ways? It seems plausible for a process to have 5000 identical pages (e.g. 20MB of zeroes), and something might want to merge them into a single physical page to save RAM.

Willy's memory-management to-do list

Posted May 6, 2018 12:54 UTC (Sun) by willy (subscriber, #9762) [Link]

The writeup for this part wasn't exactly what I intended to say ;-)

What the patch does is keep a list of processes with more than 5000 mappings. That's no process on my laptop, but some workloads will have a process or two end up on this list. I understand ElectricFence creates a lot of mappings and so does UML.

Once any individual page goes over 2 billion mappings, we check the list. Anyone on the list with this page mapped more than 1000 times is deemed to be part of the attack and is killed.

https://lwn.net/Articles/748524/

Thanks for mentioning the KSM possibility. I hadn't thought of that. I'll take a look at the KSM code to see if it tries to avoid mapcount overflow. I think the zero page is treated specially, but it's not unreasonable to check for other special patterns.