From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Sachin Sant <sachinp@linux.vnet.ibm.com>,
PUVICHAKRAVARTHY RAMACHANDRAN <puvichakravarthy@in.ibm.com>,
Vlastimil Babka <vbabka@suse.cz>,
Andrew Morton <akpm@linux-foundation.org>,
Bharata B Rao <bharata@linux.ibm.com>,
Srikar Dronamraju <srikar@linux.vnet.ibm.com>,
Mel Gorman <mgorman@techsingularity.net>,
Michael Ellerman <mpe@ellerman.id.au>,
Michal Hocko <mhocko@kernel.org>,
Christopher Lameter <cl@linux.com>,
linuxppc-dev@lists.ozlabs.org,
Joonsoo Kim <iamjoonsoo.kim@lge.com>,
Pekka Enberg <penberg@kernel.org>,
David Rientjes <rientjes@google.com>,
Kirill Tkhai <ktkhai@virtuozzo.com>,
Nathan Lynch <nathanl@linux.ibm.com>,
Linus Torvalds <torvalds@linux-foundation.org>
Subject: [PATCH 4.19 49/65] mm, slub: prevent kmalloc_node crashes and memory leaks
Date: Tue, 24 Mar 2020 14:11:10 +0100 [thread overview]
Message-ID: <20200324130803.098515051@linuxfoundation.org> (raw)
In-Reply-To: <20200324130756.679112147@linuxfoundation.org>
From: Vlastimil Babka <vbabka@suse.cz>
commit 0715e6c516f106ed553828a671d30ad9a3431536 upstream.
Sachin reports [1] a crash in SLUB __slab_alloc():
BUG: Kernel NULL pointer dereference on read at 0x000073b0
Faulting instruction address: 0xc0000000003d55f4
Oops: Kernel access of bad area, sig: 11 [#1]
LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
Modules linked in:
CPU: 19 PID: 1 Comm: systemd Not tainted 5.6.0-rc2-next-20200218-autotest #1
NIP: c0000000003d55f4 LR: c0000000003d5b94 CTR: 0000000000000000
REGS: c0000008b37836d0 TRAP: 0300 Not tainted (5.6.0-rc2-next-20200218-autotest)
MSR: 8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 24004844 XER: 00000000
CFAR: c00000000000dec4 DAR: 00000000000073b0 DSISR: 40000000 IRQMASK: 1
GPR00: c0000000003d5b94 c0000008b3783960 c00000000155d400 c0000008b301f500
GPR04: 0000000000000dc0 0000000000000002 c0000000003443d8 c0000008bb398620
GPR08: 00000008ba2f0000 0000000000000001 0000000000000000 0000000000000000
GPR12: 0000000024004844 c00000001ec52a00 0000000000000000 0000000000000000
GPR16: c0000008a1b20048 c000000001595898 c000000001750c18 0000000000000002
GPR20: c000000001750c28 c000000001624470 0000000fffffffe0 5deadbeef0000122
GPR24: 0000000000000001 0000000000000dc0 0000000000000002 c0000000003443d8
GPR28: c0000008b301f500 c0000008bb398620 0000000000000000 c00c000002287180
NIP ___slab_alloc+0x1f4/0x760
LR __slab_alloc+0x34/0x60
Call Trace:
___slab_alloc+0x334/0x760 (unreliable)
__slab_alloc+0x34/0x60
__kmalloc_node+0x110/0x490
kvmalloc_node+0x58/0x110
mem_cgroup_css_online+0x108/0x270
online_css+0x48/0xd0
cgroup_apply_control_enable+0x2ec/0x4d0
cgroup_mkdir+0x228/0x5f0
kernfs_iop_mkdir+0x90/0xf0
vfs_mkdir+0x110/0x230
do_mkdirat+0xb0/0x1a0
system_call+0x5c/0x68
This is a PowerPC platform with following NUMA topology:
available: 2 nodes (0-1)
node 0 cpus:
node 0 size: 0 MB
node 0 free: 0 MB
node 1 cpus: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
node 1 size: 35247 MB
node 1 free: 30907 MB
node distances:
node 0 1
0: 10 40
1: 40 10
possible numa nodes: 0-31
This only happens with a mmotm patch "mm/memcontrol.c: allocate
shrinker_map on appropriate NUMA node" [2] which effectively calls
kmalloc_node for each possible node. SLUB however only allocates
kmem_cache_node on online N_NORMAL_MEMORY nodes, and relies on
node_to_mem_node to return such valid node for other nodes since commit
a561ce00b09e ("slub: fall back to node_to_mem_node() node if allocating
on memoryless node"). This is however not true in this configuration
where the _node_numa_mem_ array is not initialized for nodes 0 and 2-31,
thus it contains zeroes and get_partial() ends up accessing
non-allocated kmem_cache_node.
A related issue was reported by Bharata (originally by Ramachandran) [3]
where a similar PowerPC configuration, but with mainline kernel without
patch [2] ends up allocating large amounts of pages by kmalloc-1k
kmalloc-512. This seems to have the same underlying issue with
node_to_mem_node() not behaving as expected, and might probably also
lead to an infinite loop with CONFIG_SLUB_CPU_PARTIAL [4].
This patch should fix both issues by not relying on node_to_mem_node()
anymore and instead simply falling back to NUMA_NO_NODE, when
kmalloc_node(node) is attempted for a node that's not online, or has no
usable memory. The "usable memory" condition is also changed from
node_present_pages() to N_NORMAL_MEMORY node state, as that is exactly
the condition that SLUB uses to allocate kmem_cache_node structures.
The check in get_partial() is removed completely, as the checks in
___slab_alloc() are now sufficient to prevent get_partial() being
reached with an invalid node.
[1] https://lore.kernel.org/linux-next/3381CD91-AB3D-4773-BA04-E7A072A63968@linux.vnet.ibm.com/
[2] https://lore.kernel.org/linux-mm/fff0e636-4c36-ed10-281c-8cdb0687c839@virtuozzo.com/
[3] https://lore.kernel.org/linux-mm/20200317092624.GB22538@in.ibm.com/
[4] https://lore.kernel.org/linux-mm/088b5996-faae-8a56-ef9c-5b567125ae54@suse.cz/
Fixes: a561ce00b09e ("slub: fall back to node_to_mem_node() node if allocating on memoryless node")
Reported-by: Sachin Sant <sachinp@linux.vnet.ibm.com>
Reported-by: PUVICHAKRAVARTHY RAMACHANDRAN <puvichakravarthy@in.ibm.com>
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Sachin Sant <sachinp@linux.vnet.ibm.com>
Tested-by: Bharata B Rao <bharata@linux.ibm.com>
Reviewed-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Christopher Lameter <cl@linux.com>
Cc: linuxppc-dev@lists.ozlabs.org
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Kirill Tkhai <ktkhai@virtuozzo.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Nathan Lynch <nathanl@linux.ibm.com>
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/r/20200320115533.9604-1-vbabka@suse.cz
Debugged-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/slub.c | 26 +++++++++++++++++---------
1 file changed, 17 insertions(+), 9 deletions(-)
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1906,8 +1906,6 @@ static void *get_partial(struct kmem_cac
if (node == NUMA_NO_NODE)
searchnode = numa_mem_id();
- else if (!node_present_pages(node))
- searchnode = node_to_mem_node(node);
object = get_partial_node(s, get_node(s, searchnode), c, flags);
if (object || node != NUMA_NO_NODE)
@@ -2504,17 +2502,27 @@ static void *___slab_alloc(struct kmem_c
struct page *page;
page = c->page;
- if (!page)
+ if (!page) {
+ /*
+ * if the node is not online or has no normal memory, just
+ * ignore the node constraint
+ */
+ if (unlikely(node != NUMA_NO_NODE &&
+ !node_state(node, N_NORMAL_MEMORY)))
+ node = NUMA_NO_NODE;
goto new_slab;
+ }
redo:
if (unlikely(!node_match(page, node))) {
- int searchnode = node;
-
- if (node != NUMA_NO_NODE && !node_present_pages(node))
- searchnode = node_to_mem_node(node);
-
- if (unlikely(!node_match(page, searchnode))) {
+ /*
+ * same as above but node_match() being false already
+ * implies node != NUMA_NO_NODE
+ */
+ if (!node_state(node, N_NORMAL_MEMORY)) {
+ node = NUMA_NO_NODE;
+ goto redo;
+ } else {
stat(s, ALLOC_NODE_MISMATCH);
deactivate_slab(s, page, c->freelist, c);
goto new_slab;
next prev parent reply other threads:[~2020-03-24 13:33 UTC|newest]
Thread overview: 70+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-24 13:10 [PATCH 4.19 00/65] 4.19.113-rc1 review Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 01/65] drm/mediatek: Find the cursor plane instead of hard coding it Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 02/65] spi: qup: call spi_qup_pm_resume_runtime before suspending Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 03/65] powerpc: Include .BTF section Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 04/65] ARM: dts: dra7: Add "dma-ranges" property to PCIe RC DT nodes Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 05/65] spi: pxa2xx: Add CS control clock quirk Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 06/65] spi/zynqmp: remove entry that causes a cs glitch Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 07/65] drm/exynos: dsi: propagate error value and silence meaningless warning Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 08/65] drm/exynos: dsi: fix workaround for the legacy clock name Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 09/65] drivers/perf: arm_pmu_acpi: Fix incorrect checking of gicc pointer Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 10/65] altera-stapl: altera_get_note: prevent write beyond end of key Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 11/65] dm bio record: save/restore bi_end_io and bi_integrity Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 12/65] dm integrity: use dm_bio_record and dm_bio_restore Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 13/65] riscv: avoid the PIC offset of static percpu data in module beyond 2G limits Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 14/65] drm/amd/display: Clear link settings on MST disable connector Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 15/65] drm/amd/display: fix dcc swath size calculations on dcn1 Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 16/65] xenbus: req->body should be updated before req->state Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 17/65] xenbus: req->err " Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 18/65] block, bfq: fix overwrite of bfq_group pointer in bfq_find_set_group() Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 19/65] parse-maintainers: Mark as executable Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 20/65] USB: Disable LPM on WD19s Realtek Hub Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 21/65] usb: quirks: add NO_LPM quirk for RTL8153 based ethernet adapters Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 22/65] USB: serial: option: add ME910G1 ECM composition 0x110b Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 23/65] usb: host: xhci-plat: add a shutdown Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 24/65] USB: serial: pl2303: add device-id for HP LD381 Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 25/65] usb: xhci: apply XHCI_SUSPEND_DELAY to AMD XHCI controller 1022:145c Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 26/65] ALSA: line6: Fix endless MIDI read loop Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 27/65] ALSA: seq: virmidi: Fix running status after receiving sysex Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 28/65] ALSA: seq: oss: " Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 29/65] ALSA: pcm: oss: Avoid plugin buffer overflow Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 30/65] ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 31/65] iio: st_sensors: remap SMO8840 to LIS2DH12 Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 32/65] iio: trigger: stm32-timer: disable master mode when stopping Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 33/65] iio: magnetometer: ak8974: Fix negative raw values in sysfs Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 34/65] iio: adc: at91-sama5d2_adc: fix differential channels in triggered mode Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 35/65] mmc: rtsx_pci: Fix support for speed-modes that relies on tuning Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 36/65] mmc: sdhci-of-at91: fix cd-gpios for SAMA5D2 Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 37/65] staging: rtl8188eu: Add device id for MERCUSYS MW150US v2 Greg Kroah-Hartman
2020-03-24 13:10 ` [PATCH 4.19 38/65] staging: greybus: loopback_test: fix poll-mask build breakage Greg Kroah-Hartman
2020-03-24 13:11 ` [PATCH 4.19 39/65] staging/speakup: fix get_word non-space look-ahead Greg Kroah-Hartman
2020-03-24 13:11 ` [PATCH 4.19 40/65] intel_th: Fix user-visible error codes Greg Kroah-Hartman
2020-03-24 13:11 ` [PATCH 4.19 41/65] intel_th: pci: Add Elkhart Lake CPU support Greg Kroah-Hartman
2020-03-24 13:11 ` [PATCH 4.19 42/65] rtc: max8907: add missing select REGMAP_IRQ Greg Kroah-Hartman
2020-03-24 13:11 ` [PATCH 4.19 43/65] xhci: Do not open code __print_symbolic() in xhci trace events Greg Kroah-Hartman
2020-03-24 13:11 ` [PATCH 4.19 44/65] btrfs: fix log context list corruption after rename whiteout error Greg Kroah-Hartman
2020-03-24 13:11 ` [PATCH 4.19 45/65] drm/amd/amdgpu: Fix GPR read from debugfs (v2) Greg Kroah-Hartman
2020-03-24 13:11 ` [PATCH 4.19 46/65] drm/lease: fix WARNING in idr_destroy Greg Kroah-Hartman
2020-03-24 13:11 ` [PATCH 4.19 47/65] memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event Greg Kroah-Hartman
2020-03-24 13:11 ` [PATCH 4.19 48/65] mm: slub: be more careful about the double cmpxchg of freelist Greg Kroah-Hartman
2020-03-24 13:11 ` Greg Kroah-Hartman [this message]
2020-03-24 13:11 ` [PATCH 4.19 50/65] page-flags: fix a crash at SetPageError(THP_SWAP) Greg Kroah-Hartman
2020-03-24 13:11 ` [PATCH 4.19 51/65] x86/mm: split vmalloc_sync_all() Greg Kroah-Hartman
2020-03-24 13:11 ` [PATCH 4.19 52/65] USB: cdc-acm: fix close_delay and closing_wait units in TIOCSSERIAL Greg Kroah-Hartman
2020-03-24 13:11 ` [PATCH 4.19 53/65] USB: cdc-acm: fix rounding error " Greg Kroah-Hartman
2020-03-24 13:11 ` [PATCH 4.19 54/65] iio: light: vcnl4000: update sampling periods for vcnl4200 Greg Kroah-Hartman
2020-03-24 13:11 ` [PATCH 4.19 55/65] kbuild: Disable -Wpointer-to-enum-cast Greg Kroah-Hartman
2020-03-24 13:11 ` [PATCH 4.19 56/65] futex: Fix inode life-time issue Greg Kroah-Hartman
2020-03-24 13:11 ` [PATCH 4.19 57/65] futex: Unbreak futex hashing Greg Kroah-Hartman
2020-03-24 13:11 ` [PATCH 4.19 58/65] Revert "vrf: mark skb for multicast or link-local as enslaved to VRF" Greg Kroah-Hartman
2020-03-24 13:11 ` [PATCH 4.19 59/65] Revert "ipv6: Fix handling of LLA with VRF and sockets bound " Greg Kroah-Hartman
2020-03-24 13:11 ` [PATCH 4.19 60/65] ALSA: hda/realtek: Fix pop noise on ALC225 Greg Kroah-Hartman
2020-03-24 13:11 ` [PATCH 4.19 61/65] arm64: smp: fix smp_send_stop() behaviour Greg Kroah-Hartman
2020-03-24 13:11 ` [PATCH 4.19 62/65] arm64: smp: fix crash_smp_send_stop() behaviour Greg Kroah-Hartman
2020-03-24 13:11 ` [PATCH 4.19 63/65] drm/bridge: dw-hdmi: fix AVI frame colorimetry Greg Kroah-Hartman
2020-03-24 13:11 ` [PATCH 4.19 64/65] staging: greybus: loopback_test: fix potential path truncation Greg Kroah-Hartman
2020-03-24 13:11 ` [PATCH 4.19 65/65] staging: greybus: loopback_test: fix potential path truncations Greg Kroah-Hartman
2020-03-24 15:53 ` [PATCH 4.19 00/65] 4.19.113-rc1 review Chris Paterson
2020-03-24 19:51 ` shuah
2020-03-24 20:55 ` Guenter Roeck
2020-03-25 4:50 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200324130803.098515051@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=akpm@linux-foundation.org \
--cc=bharata@linux.ibm.com \
--cc=cl@linux.com \
--cc=iamjoonsoo.kim@lge.com \
--cc=ktkhai@virtuozzo.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=mgorman@techsingularity.net \
--cc=mhocko@kernel.org \
--cc=mpe@ellerman.id.au \
--cc=nathanl@linux.ibm.com \
--cc=penberg@kernel.org \
--cc=puvichakravarthy@in.ibm.com \
--cc=rientjes@google.com \
--cc=sachinp@linux.vnet.ibm.com \
--cc=srikar@linux.vnet.ibm.com \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=vbabka@suse.cz \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).