From: Yu Zhao <yuzhao@google.com>
To: Christopher Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>,
David Rientjes <rientjes@google.com>,
Joonsoo Kim <iamjoonsoo.kim@lge.com>,
Andrew Morton <akpm@linux-foundation.org>,
"Kirill A . Shutemov" <kirill@shutemov.name>,
Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>,
linux-mm@kvack.org, linux-kernel@vger.kernel.org,
"Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>
Subject: Re: [PATCH v4 2/2] mm: avoid slub allocation while holding list_lock
Date: Sat, 9 Nov 2019 16:01:47 -0700 [thread overview]
Message-ID: <20191109230147.GA75074@google.com> (raw)
In-Reply-To: <alpine.DEB.2.21.1911092024560.9034@www.lameter.com>
On Sat, Nov 09, 2019 at 08:52:29PM +0000, Christopher Lameter wrote:
> On Fri, 8 Nov 2019, Yu Zhao wrote:
>
> > If we are already under list_lock, don't call kmalloc(). Otherwise we
> > will run into deadlock because kmalloc() also tries to grab the same
> > lock.
>
> How did this happen? The kmalloc needs to be always done before the
> list_lock is taken.
>
> > Fixing the problem by using a static bitmap instead.
> >
> > WARNING: possible recursive locking detected
> > --------------------------------------------
> > mount-encrypted/4921 is trying to acquire lock:
> > (&(&n->list_lock)->rlock){-.-.}, at: ___slab_alloc+0x104/0x437
> >
> > but task is already holding lock:
> > (&(&n->list_lock)->rlock){-.-.}, at: __kmem_cache_shutdown+0x81/0x3cb
> >
> > other info that might help us debug this:
> > Possible unsafe locking scenario:
> >
> > CPU0
> > ----
> > lock(&(&n->list_lock)->rlock);
> > lock(&(&n->list_lock)->rlock);
> >
> > *** DEADLOCK ***
>
>
> Ahh. list_slab_objects() in shutdown?
>
> There is a much easier fix for this:
>
>
>
> [FIX] slub: Remove kmalloc under list_lock from list_slab_objects()
>
> list_slab_objects() is called when a slab is destroyed and there are objects still left
> to list the objects in the syslog. This is a pretty rare event.
>
> And there it seems we take the list_lock and call kmalloc while holding that lock.
>
> Perform the allocation in free_partial() before the list_lock is taken.
>
> Fixes: bbd7d57bfe852d9788bae5fb171c7edb4021d8ac ("slub: Potential stack overflow")
> Signed-off-by: Christoph Lameter <cl@linux.com>
>
> Index: linux/mm/slub.c
> ===================================================================
> --- linux.orig/mm/slub.c 2019-10-15 13:54:57.032655296 +0000
> +++ linux/mm/slub.c 2019-11-09 20:43:52.374187381 +0000
> @@ -3690,14 +3690,11 @@ error:
> }
>
> static void list_slab_objects(struct kmem_cache *s, struct page *page,
> - const char *text)
> + const char *text, unsigned long *map)
> {
> #ifdef CONFIG_SLUB_DEBUG
> void *addr = page_address(page);
> void *p;
> - unsigned long *map = bitmap_zalloc(page->objects, GFP_ATOMIC);
> - if (!map)
> - return;
> slab_err(s, page, text, s->name);
> slab_lock(page);
>
> @@ -3723,6 +3720,10 @@ static void free_partial(struct kmem_cac
> {
> LIST_HEAD(discard);
> struct page *page, *h;
> + unsigned long *map = bitmap_alloc(oo_objects(s->max), GFP_KERNEL);
> +
> + if (!map)
> + return;
What would happen if we are trying to allocate from the slab that is
being shut down? And shouldn't the allocation be conditional (i.e.,
only when CONFIG_SLUB_DEBUG=y)?
next prev parent reply other threads:[~2019-11-09 23:01 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-09 6:10 [PATCH] mm: avoid slub allocation while holding list_lock Yu Zhao
2019-09-09 16:00 ` Kirill A. Shutemov
[not found] ` <e5e25aa3-651d-92b4-ac82-c5011c66a7cb@I-love.SAKURA.ne.jp>
2019-09-09 21:39 ` Yu Zhao
[not found] ` <201909100141.x8A1fVdu048305@www262.sakura.ne.jp>
2019-09-10 2:16 ` Yu Zhao
2019-09-10 9:16 ` Kirill A. Shutemov
2019-09-11 14:13 ` Andrew Morton
2019-09-12 0:29 ` [PATCH 1/3] mm: correct mask size for slub page->objects Yu Zhao
2019-09-12 0:29 ` [PATCH 2/3] mm: avoid slub allocation while holding list_lock Yu Zhao
2019-09-12 0:44 ` Kirill A. Shutemov
2019-09-12 1:31 ` Yu Zhao
2019-09-12 2:31 ` [PATCH v2 1/4] mm: correct mask size for slub page->objects Yu Zhao
2019-09-12 2:31 ` [PATCH v2 2/4] mm: clean up validate_slab() Yu Zhao
2019-09-12 9:46 ` Kirill A. Shutemov
2019-09-12 2:31 ` [PATCH v2 3/4] mm: avoid slub allocation while holding list_lock Yu Zhao
2019-09-12 10:04 ` Kirill A. Shutemov
2019-09-12 2:31 ` [PATCH v2 4/4] mm: lock slub page when listing objects Yu Zhao
2019-09-12 10:06 ` Kirill A. Shutemov
2019-09-12 21:12 ` Yu Zhao
2019-09-13 14:58 ` Christopher Lameter
2019-09-12 9:40 ` [PATCH v2 1/4] mm: correct mask size for slub page->objects Kirill A. Shutemov
2019-09-12 21:11 ` Yu Zhao
2019-09-12 22:03 ` Kirill A. Shutemov
2019-09-14 0:07 ` [PATCH v3 1/2] mm: clean up validate_slab() Yu Zhao
2019-09-14 0:07 ` [PATCH v3 2/2] mm: avoid slub allocation while holding list_lock Yu Zhao
2019-09-16 8:39 ` [PATCH v3 1/2] mm: clean up validate_slab() Kirill A. Shutemov
2019-11-08 19:39 ` [PATCH v4 " Yu Zhao
2019-11-08 19:39 ` [PATCH v4 2/2] mm: avoid slub allocation while holding list_lock Yu Zhao
2019-11-09 20:52 ` Christopher Lameter
2019-11-09 23:01 ` Yu Zhao [this message]
2019-11-09 23:16 ` Christopher Lameter
2019-11-10 18:47 ` Yu Zhao
2019-11-11 15:47 ` Christopher Lameter
2019-11-11 15:55 ` [FIX] slub: Remove kmalloc under list_lock from list_slab_objects() V2 Christopher Lameter
2019-11-30 23:09 ` Andrew Morton
2019-12-02 15:12 ` Christopher Lameter
2019-12-07 22:03 ` Yu Zhao
2020-01-10 14:11 ` Vlastimil Babka
[not found] ` <e0ed44ae-8dae-e8db-9d14-2b09b239af8e@i-love.sakura.ne.jp>
2020-01-13 1:34 ` Christopher Lameter
2019-11-11 18:15 ` [PATCH v4 2/2] mm: avoid slub allocation while holding list_lock Shakeel Butt
2019-09-12 0:29 ` [PATCH 3/3] mm: lock slub page when listing objects Yu Zhao
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191109230147.GA75074@google.com \
--to=yuzhao@google.com \
--cc=akpm@linux-foundation.org \
--cc=cl@linux.com \
--cc=iamjoonsoo.kim@lge.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=kirill@shutemov.name \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=penberg@kernel.org \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=rientjes@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).