diff mbox series

powerpc/spufs: account SPU context save area to memcg

Message ID 20260815-spufs-lscsa-unaccounted-v1-1-3ee0949de787@gmail.com (mailing list archive)
State New
Headers show
Series powerpc/spufs: account SPU context save area to memcg | expand

Commit Message

Zhenhao Wan Aug. 15, 2026, 10:32 a.m. UTC 
Creating an SPU context with the spu_create(2) syscall allocates a
struct spu_lscsa in spu_alloc_lscsa() to hold the context's save area.
struct spu_lscsa embeds the 256 KiB local store and aligns it to a 64 KiB
boundary, so sizeof(struct spu_lscsa) is 320 KiB and each context pins a
320 KiB vmalloc allocation.  The allocation uses plain vzalloc()
(GFP_KERNEL | __GFP_ZERO), so it carries no __GFP_ACCOUNT and is not
charged to any memory cgroup.

The default spu_create() path (flags == 0) performs no capability check
-- it is gated only by ordinary directory write permission on the spufs
mount -- and spufs imposes no limit of its own on how many contexts a
caller may hold open (nr_spu_contexts is only a statistic, never
compared against a limit).  An unprivileged user with spufs access can
therefore hold many contexts open, pinning kernel memory that is not
attributed to, and so cannot be limited by, their memory cgroup.

Charge the save area to the allocating task's memory cgroup by switching
to __vmalloc() with GFP_KERNEL_ACCOUNT.  __GFP_ZERO preserves the zeroing
that vzalloc() provided; the local store pages are mapped into user space
via the context's "mem" file, so they must not expose stale memory.  This
mirrors commit ec403e2ae0df ("memcg: enable accounting for ldt_struct
objects"), which accounts the x86 LDT the same way.

Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Zhenhao Wan <whi4ed0g@gmail.com>
---
 arch/powerpc/platforms/cell/spufs/lscsa_alloc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


---
base-commit: f80f8c5c68a5e4d68a829ca1d8717b943a26b334
change-id: 20260815-spufs-lscsa-unaccounted-7ba5f6e78f4d

Best regards,
--  
Zhenhao Wan <whi4ed0g@gmail.com>
diff mbox series

Patch

diff --git a/arch/powerpc/platforms/cell/spufs/lscsa_alloc.c b/arch/powerpc/platforms/cell/spufs/lscsa_alloc.c
index 43b9dde7fd0d..df93e65bc7c1 100644
--- a/arch/powerpc/platforms/cell/spufs/lscsa_alloc.c
+++ b/arch/powerpc/platforms/cell/spufs/lscsa_alloc.c
@@ -23,7 +23,7 @@  int spu_alloc_lscsa(struct spu_state *csa)
 	struct spu_lscsa *lscsa;
 	unsigned char *p;
 
-	lscsa = vzalloc(sizeof(*lscsa));
+	lscsa = __vmalloc(sizeof(*lscsa), GFP_KERNEL_ACCOUNT | __GFP_ZERO);
 	if (!lscsa)
 		return -ENOMEM;
 	csa->lscsa = lscsa;