From: Michal Hocko <mhocko@kernel.org>
To: Johannes Weiner <hannes@cmpxchg.org>
Cc: Andrew Morton <akpm@linux-foundation.org>,
Tejun Heo <tj@kernel.org>,
"David S. Miller" <davem@davemloft.net>,
linux-mm@kvack.org, cgroups@vger.kernel.org,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
kernel-team@fb.com, Vladimir Davydov <vdavydov.dev@gmail.com>
Subject: Re: [PATCH 2/3] cgroup: duplicate cgroup reference when cloning sockets
Date: Mon, 19 Sep 2016 14:03:03 +0200 [thread overview]
Message-ID: <20160919120302.GN10785@dhcp22.suse.cz> (raw)
In-Reply-To: <20160914194846.11153-2-hannes@cmpxchg.org>
[Fixup Vladimir's email]
I am not familiar with this code path to give my ack, unfortunatelly.
On Wed 14-09-16 15:48:45, Johannes Weiner wrote:
> From: Johannes Weiner <jweiner@fb.com>
>
> When a socket is cloned, the associated sock_cgroup_data is duplicated
> but not its reference on the cgroup. As a result, the cgroup reference
> count will underflow when both sockets are destroyed later on.
>
> Fixes: bd1060a1d671 ("sock, cgroup: add sock->sk_cgroup")
> Cc: <stable@vger.kernel.org> # 4.5+
> Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
> ---
> kernel/cgroup.c | 6 ++++++
> net/core/sock.c | 5 ++++-
> 2 files changed, 10 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/cgroup.c b/kernel/cgroup.c
> index 0c4db7908264..b0d727d26fc7 100644
> --- a/kernel/cgroup.c
> +++ b/kernel/cgroup.c
> @@ -6297,6 +6297,12 @@ void cgroup_sk_alloc(struct sock_cgroup_data *skcd)
> if (cgroup_sk_alloc_disabled)
> return;
>
> + /* Socket clone path */
> + if (skcd->val) {
> + cgroup_get(sock_cgroup_ptr(skcd));
> + return;
> + }
> +
> rcu_read_lock();
>
> while (true) {
> diff --git a/net/core/sock.c b/net/core/sock.c
> index 51a730485649..038e660ef844 100644
> --- a/net/core/sock.c
> +++ b/net/core/sock.c
> @@ -1340,7 +1340,6 @@ static struct sock *sk_prot_alloc(struct proto *prot, gfp_t priority,
> if (!try_module_get(prot->owner))
> goto out_free_sec;
> sk_tx_queue_clear(sk);
> - cgroup_sk_alloc(&sk->sk_cgrp_data);
> }
>
> return sk;
> @@ -1400,6 +1399,7 @@ struct sock *sk_alloc(struct net *net, int family, gfp_t priority,
> sock_net_set(sk, net);
> atomic_set(&sk->sk_wmem_alloc, 1);
>
> + cgroup_sk_alloc(&sk->sk_cgrp_data);
> sock_update_classid(&sk->sk_cgrp_data);
> sock_update_netprioidx(&sk->sk_cgrp_data);
> }
> @@ -1544,6 +1544,9 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
> newsk->sk_priority = 0;
> newsk->sk_incoming_cpu = raw_smp_processor_id();
> atomic64_set(&newsk->sk_cookie, 0);
> +
> + cgroup_sk_alloc(&newsk->sk_cgrp_data);
> +
> /*
> * Before updating sk_refcnt, we must commit prior changes to memory
> * (Documentation/RCU/rculist_nulls.txt for details)
> --
> 2.9.3
--
Michal Hocko
SUSE Labs
WARNING: multiple messages have this Message-ID (diff)
From: Michal Hocko <mhocko@kernel.org>
To: Johannes Weiner <hannes@cmpxchg.org>
Cc: Andrew Morton <akpm@linux-foundation.org>,
Tejun Heo <tj@kernel.org>,
"David S. Miller" <davem@davemloft.net>,
linux-mm@kvack.org, cgroups@vger.kernel.org,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
kernel-team@fb.com, Vladimir Davydov <vdavydov.dev@gmail.com>
Subject: Re: [PATCH 2/3] cgroup: duplicate cgroup reference when cloning sockets
Date: Mon, 19 Sep 2016 14:03:03 +0200 [thread overview]
Message-ID: <20160919120302.GN10785@dhcp22.suse.cz> (raw)
In-Reply-To: <20160914194846.11153-2-hannes@cmpxchg.org>
[Fixup Vladimir's email]
I am not familiar with this code path to give my ack, unfortunatelly.
On Wed 14-09-16 15:48:45, Johannes Weiner wrote:
> From: Johannes Weiner <jweiner@fb.com>
>
> When a socket is cloned, the associated sock_cgroup_data is duplicated
> but not its reference on the cgroup. As a result, the cgroup reference
> count will underflow when both sockets are destroyed later on.
>
> Fixes: bd1060a1d671 ("sock, cgroup: add sock->sk_cgroup")
> Cc: <stable@vger.kernel.org> # 4.5+
> Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
> ---
> kernel/cgroup.c | 6 ++++++
> net/core/sock.c | 5 ++++-
> 2 files changed, 10 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/cgroup.c b/kernel/cgroup.c
> index 0c4db7908264..b0d727d26fc7 100644
> --- a/kernel/cgroup.c
> +++ b/kernel/cgroup.c
> @@ -6297,6 +6297,12 @@ void cgroup_sk_alloc(struct sock_cgroup_data *skcd)
> if (cgroup_sk_alloc_disabled)
> return;
>
> + /* Socket clone path */
> + if (skcd->val) {
> + cgroup_get(sock_cgroup_ptr(skcd));
> + return;
> + }
> +
> rcu_read_lock();
>
> while (true) {
> diff --git a/net/core/sock.c b/net/core/sock.c
> index 51a730485649..038e660ef844 100644
> --- a/net/core/sock.c
> +++ b/net/core/sock.c
> @@ -1340,7 +1340,6 @@ static struct sock *sk_prot_alloc(struct proto *prot, gfp_t priority,
> if (!try_module_get(prot->owner))
> goto out_free_sec;
> sk_tx_queue_clear(sk);
> - cgroup_sk_alloc(&sk->sk_cgrp_data);
> }
>
> return sk;
> @@ -1400,6 +1399,7 @@ struct sock *sk_alloc(struct net *net, int family, gfp_t priority,
> sock_net_set(sk, net);
> atomic_set(&sk->sk_wmem_alloc, 1);
>
> + cgroup_sk_alloc(&sk->sk_cgrp_data);
> sock_update_classid(&sk->sk_cgrp_data);
> sock_update_netprioidx(&sk->sk_cgrp_data);
> }
> @@ -1544,6 +1544,9 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
> newsk->sk_priority = 0;
> newsk->sk_incoming_cpu = raw_smp_processor_id();
> atomic64_set(&newsk->sk_cookie, 0);
> +
> + cgroup_sk_alloc(&newsk->sk_cgrp_data);
> +
> /*
> * Before updating sk_refcnt, we must commit prior changes to memory
> * (Documentation/RCU/rculist_nulls.txt for details)
> --
> 2.9.3
--
Michal Hocko
SUSE Labs
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next prev parent reply other threads:[~2016-09-19 12:03 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-09-14 19:48 [PATCH 1/3] mm: memcontrol: make per-cpu charge cache IRQ-safe for socket accounting Johannes Weiner
2016-09-14 19:48 ` Johannes Weiner
2016-09-14 19:48 ` [PATCH 2/3] cgroup: duplicate cgroup reference when cloning sockets Johannes Weiner
2016-09-14 19:48 ` Johannes Weiner
2016-09-19 12:03 ` Michal Hocko [this message]
2016-09-19 12:03 ` Michal Hocko
2016-09-19 15:43 ` Vladimir Davydov
2016-09-19 15:43 ` Vladimir Davydov
2016-09-14 19:48 ` [PATCH 3/3] mm: memcontrol: consolidate cgroup socket tracking Johannes Weiner
2016-09-14 19:48 ` Johannes Weiner
2016-09-14 20:45 ` Tejun Heo
2016-09-14 20:45 ` Tejun Heo
2016-09-14 21:12 ` kbuild test robot
2016-09-14 21:12 ` kbuild test robot
2016-09-15 5:34 ` kbuild test robot
2016-09-14 22:17 ` Andrew Morton
2016-09-14 22:17 ` Andrew Morton
2016-09-15 14:27 ` Johannes Weiner
2016-09-15 14:27 ` Johannes Weiner
2016-09-19 12:04 ` Michal Hocko
2016-09-19 12:04 ` Michal Hocko
2016-09-19 12:01 ` [PATCH 1/3] mm: memcontrol: make per-cpu charge cache IRQ-safe for socket accounting Michal Hocko
2016-09-19 12:01 ` Michal Hocko
2016-09-19 15:35 ` Vladimir Davydov
2016-09-19 15:35 ` Vladimir Davydov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160919120302.GN10785@dhcp22.suse.cz \
--to=mhocko@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=cgroups@vger.kernel.org \
--cc=davem@davemloft.net \
--cc=hannes@cmpxchg.org \
--cc=kernel-team@fb.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=netdev@vger.kernel.org \
--cc=tj@kernel.org \
--cc=vdavydov.dev@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.