Creating an SPU context with the spu_create(2) syscall allocates a
struct spu_lscsa in spu_alloc_lscsa() to hold the context's save area.
struct spu_lscsa embeds the 256 KiB local store and aligns it to a 64 KiB
boundary, so sizeof(struct spu_lscsa) is 320 KiB and each context pins a
320 KiB vmalloc allocation. The allocation uses plain vzalloc()
(GFP_KERNEL | __GFP_ZERO), so it carries no __GFP_ACCOUNT and is not
charged to any memory cgroup.
The default spu_create() path (flags == 0) performs no capability check
-- it is gated only by ordinary directory write permission on the spufs
mount -- and spufs imposes no limit of its own on how many contexts a
caller may hold open (nr_spu_contexts is only a statistic, never
compared against a limit). An unprivileged user with spufs access can
therefore hold many contexts open, pinning kernel memory that is not
attributed to, and so cannot be limited by, their memory cgroup.
Charge the save area to the allocating task's memory cgroup by switching
to __vmalloc() with GFP_KERNEL_ACCOUNT. __GFP_ZERO preserves the zeroing
that vzalloc() provided; the local store pages are mapped into user space
via the context's "mem" file, so they must not expose stale memory. This
mirrors commit ec403e2ae0df ("memcg: enable accounting for ldt_struct
objects"), which accounts the x86 LDT the same way.
Reported-by: Yuhao Jiang <[email protected]>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Zhenhao Wan <[email protected]>
---
arch/powerpc/platforms/cell/spufs/lscsa_alloc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/platforms/cell/spufs/lscsa_alloc.c
b/arch/powerpc/platforms/cell/spufs/lscsa_alloc.c
index 43b9dde7fd0d..df93e65bc7c1 100644
--- a/arch/powerpc/platforms/cell/spufs/lscsa_alloc.c
+++ b/arch/powerpc/platforms/cell/spufs/lscsa_alloc.c
@@ -23,7 +23,7 @@ int spu_alloc_lscsa(struct spu_state *csa)
struct spu_lscsa *lscsa;
unsigned char *p;
- lscsa = vzalloc(sizeof(*lscsa));
+ lscsa = __vmalloc(sizeof(*lscsa), GFP_KERNEL_ACCOUNT | __GFP_ZERO);
if (!lscsa)
return -ENOMEM;
csa->lscsa = lscsa;
---
base-commit: f80f8c5c68a5e4d68a829ca1d8717b943a26b334
change-id: 20260815-spufs-lscsa-unaccounted-7ba5f6e78f4d
Best regards,
--
Zhenhao Wan <[email protected]>
