[PATCH 1/1] mm/page_alloc: enforce upper bound on min_free_kbytes sysctl write

[PATCH 1/1] mm/page_alloc: enforce upper bound on min_free_kbytes sysctl write

[Mohammed EL Kadiri]

syzbot reports a kernel panic ("System is deadlocked on memory")
after writing a large value (e.g. 3145728, 3GB) to
/proc/sys/vm/min_free_kbytes.

calculate_min_free_kbytes() already caps the auto-tuned default at
256MB, with a comment noting larger values don't make sense even on
big machines. But that cap only applies to the computed default --
min_free_kbytes_sysctl_handler() lets a user write any value, since
it only sets extra1 = SYSCTL_ZERO, with no extra2.

An unbounded min_free_kbytes drives watermarks past what the system
can provide, so every allocation triggers reclaim/OOM with no way to
make progress, and out_of_memory() eventually panics.

Fix this by applying the same 256MB cap to the sysctl write path.

Tested on top of upstream master (5dd1818b15d9):
  - Before: syzbot's reproducer reliably panics the kernel.
  - After: writing 3145728 fails with -EINVAL, normal values
    (e.g. 200000) still work, and the reproducer no longer panics
    the kernel across repeated runs.

Note: this covers the reported case (a value far above any real
machine's RAM). It doesn't prevent a smaller value that's still a
large fraction of a very small system's memory from causing the
same problem via lowmem_pages in __setup_per_zone_wmarks(). Open to
a follow-up there if maintainers think it's worth it.

Reported-by: syzbot+c61d6962d0b7e698439e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c61d6962d0b7e698439e
Signed-off-by: Mohammed EL Kadiri <med08elkadiri@gmail.com>
---
 mm/page_alloc.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 12fac9084c48..8cb62879bf41 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -6933,6 +6933,9 @@ static int percpu_pagelist_high_fraction_sysctl_handler(const struct ctl_table *
 	return ret;
 }
 
+/* Cap sysctl writes to the same bound calculate_min_free_kbytes() uses. */
+static const int max_user_min_free_kbytes = 262144;
+
 static const struct ctl_table page_alloc_sysctl_table[] = {
 	{
 		.procname	= "min_free_kbytes",
@@ -6941,6 +6944,7 @@ static const struct ctl_table page_alloc_sysctl_table[] = {
 		.mode		= 0644,
 		.proc_handler	= min_free_kbytes_sysctl_handler,
 		.extra1		= SYSCTL_ZERO,
+		.extra2		= (void *)&max_user_min_free_kbytes,
 	},
 	{
 		.procname	= "watermark_boost_factor",
-- 
2.53.0

Re: [PATCH 1/1] mm/page_alloc: enforce upper bound on min_free_kbytes sysctl write

[SJ Park]

On Fri, 18 Sep 2026 11:45:51 +0200 Mohammed EL Kadiri <med08elkadiri@gmail.com> wrote:

> syzbot reports a kernel panic ("System is deadlocked on memory")
> after writing a large value (e.g. 3145728, 3GB) to
> /proc/sys/vm/min_free_kbytes.
> 
> calculate_min_free_kbytes() already caps the auto-tuned default at
> 256MB, with a comment noting larger values don't make sense even on
> big machines. But that cap only applies to the computed default --
> min_free_kbytes_sysctl_handler() lets a user write any value, since
> it only sets extra1 = SYSCTL_ZERO, with no extra2.
> 
> An unbounded min_free_kbytes drives watermarks past what the system
> can provide, so every allocation triggers reclaim/OOM with no way to
> make progress, and out_of_memory() eventually panics.
> 
> Fix this by applying the same 256MB cap to the sysctl write path.
> 
> Tested on top of upstream master (5dd1818b15d9):
>   - Before: syzbot's reproducer reliably panics the kernel.
>   - After: writing 3145728 fails with -EINVAL, normal values
>     (e.g. 200000) still work, and the reproducer no longer panics
>     the kernel across repeated runs.
> 
> Note: this covers the reported case (a value far above any real
> machine's RAM). It doesn't prevent a smaller value that's still a
> large fraction of a very small system's memory from causing the
> same problem via lowmem_pages in __setup_per_zone_wmarks(). Open to
> a follow-up there if maintainers think it's worth it.

I think the idea makes sense.  But I'm not sure if this user-visible behavior
change is fine.  I'm curious what others think.

> 
> Reported-by: syzbot+c61d6962d0b7e698439e@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=c61d6962d0b7e698439e
> Signed-off-by: Mohammed EL Kadiri <med08elkadiri@gmail.com>
> ---
>  mm/page_alloc.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> index 12fac9084c48..8cb62879bf41 100644
> --- a/mm/page_alloc.c
> +++ b/mm/page_alloc.c
> @@ -6933,6 +6933,9 @@ static int percpu_pagelist_high_fraction_sysctl_handler(const struct ctl_table *
>  	return ret;
>  }
>  
> +/* Cap sysctl writes to the same bound calculate_min_free_kbytes() uses. */
> +static const int max_user_min_free_kbytes = 262144;

Would '_user' on the name unnecessary?

> +
>  static const struct ctl_table page_alloc_sysctl_table[] = {
>  	{
>  		.procname	= "min_free_kbytes",
> @@ -6941,6 +6944,7 @@ static const struct ctl_table page_alloc_sysctl_table[] = {
>  		.mode		= 0644,
>  		.proc_handler	= min_free_kbytes_sysctl_handler,
>  		.extra1		= SYSCTL_ZERO,
> +		.extra2		= (void *)&max_user_min_free_kbytes,
>  	},
>  	{
>  		.procname	= "watermark_boost_factor",
> -- 
> 2.53.0


Thanks,
SJ