From: Vlastimil Babka <vbabka@suse.cz> To: Waiman Long <longman@redhat.com>, Johannes Weiner <hannes@cmpxchg.org>, Michal Hocko <mhocko@kernel.org>, Vladimir Davydov <vdavydov.dev@gmail.com>, Andrew Morton <akpm@linux-foundation.org>, Christoph Lameter <cl@linux.com>, Pekka Enberg <penberg@kernel.org>, David Rientjes <rientjes@google.com>, Joonsoo Kim <iamjoonsoo.kim@lge.com>, Roman Gushchin <guro@fb.com>, Shakeel Butt <shakeelb@google.com> Cc: linux-kernel@vger.kernel.org, cgroups@vger.kernel.org, linux-mm@kvack.org Subject: Re: [PATCH v2 2/2] mm: memcg/slab: Create a new set of kmalloc-cg-<n> caches Date: Tue, 4 May 2021 18:01:49 +0200 [thread overview] Message-ID: <3c952b24-94e4-3c54-b668-cac778ff5a77@suse.cz> (raw) In-Reply-To: <20210504132350.4693-3-longman@redhat.com> On 5/4/21 3:23 PM, Waiman Long wrote: > There are currently two problems in the way the objcg pointer array > (memcg_data) in the page structure is being allocated and freed. > > On its allocation, it is possible that the allocated objcg pointer > array comes from the same slab that requires memory accounting. If this > happens, the slab will never become empty again as there is at least > one object left (the obj_cgroup array) in the slab. > > When it is freed, the objcg pointer array object may be the last one > in its slab and hence causes kfree() to be called again. With the > right workload, the slab cache may be set up in a way that allows the > recursive kfree() calling loop to nest deep enough to cause a kernel > stack overflow and panic the system. > > One way to solve this problem is to split the kmalloc-<n> caches > (KMALLOC_NORMAL) into two separate sets - a new set of kmalloc-<n> > (KMALLOC_NORMAL) caches for non-accounted objects only and a new set of > kmalloc-cg-<n> (KMALLOC_CGROUP) caches for accounted objects only. All > the other caches can allow a mix of accounted and non-accounted objects. > > With this change, all the objcg pointer array objects will come from > KMALLOC_NORMAL caches which won't have their objcg pointer arrays. So > both the recursive kfree() problem and non-freeable slab problem > are gone. > > The new KMALLOC_CGROUP is added between KMALLOC_NORMAL and > KMALLOC_RECLAIM so that the first for loop in create_kmalloc_caches() > will include the newly added caches without change. Great, thanks I hope there would be also benefits to objcg arrays not created for all the normal caches anymore (possibly poorly used due to mix of accounted and non-accounted objects in the same cache) and perhaps it's possible for you to quantify the reduction of those? > Suggested-by: Vlastimil Babka <vbabka@suse.cz> > Signed-off-by: Waiman Long <longman@redhat.com> ... > @@ -321,6 +328,14 @@ kmalloc_caches[NR_KMALLOC_TYPES][KMALLOC_SHIFT_HIGH + 1]; > > static __always_inline enum kmalloc_cache_type kmalloc_type(gfp_t flags) > { > +#ifdef CONFIG_MEMCG_KMEM > + /* > + * KMALLOC_CGROUP for non-reclaimable and non-DMA object with > + * accounting enabled. > + */ > + if ((flags & (__GFP_DMA | __GFP_RECLAIMABLE | __GFP_ACCOUNT)) == __GFP_ACCOUNT) > + return KMALLOC_CGROUP; > +#endif This function was designed so that KMALLOC_NORMAL would be the first tested and returned possibility, as it's expected to be the most common. What about the following on top? ----8<---- diff --git a/include/linux/slab.h b/include/linux/slab.h index fca03c22ea7c..418c5df0305b 100644 --- a/include/linux/slab.h +++ b/include/linux/slab.h @@ -328,30 +328,40 @@ kmalloc_caches[NR_KMALLOC_TYPES][KMALLOC_SHIFT_HIGH + 1]; static __always_inline enum kmalloc_cache_type kmalloc_type(gfp_t flags) { -#ifdef CONFIG_MEMCG_KMEM /* - * KMALLOC_CGROUP for non-reclaimable and non-DMA object with - * accounting enabled. + * The most common case is KMALLOC_NORMAL, so test for it + * with a single branch for all flags that might affect it */ - if ((flags & (__GFP_DMA | __GFP_RECLAIMABLE | __GFP_ACCOUNT)) == __GFP_ACCOUNT) - return KMALLOC_CGROUP; + if (likely((flags & (__GFP_RECLAIMABLE +#ifdef CONFIG_MEMCG_KMEM + | __GFP_ACCOUNT #endif #ifdef CONFIG_ZONE_DMA - /* - * The most common case is KMALLOC_NORMAL, so test for it - * with a single branch for both flags. - */ - if (likely((flags & (__GFP_DMA | __GFP_RECLAIMABLE)) == 0)) + | __GFP_DMA +#endif + )) == 0)) return KMALLOC_NORMAL; +#ifdef CONFIG_MEMCG_KMEM /* - * At least one of the flags has to be set. If both are, __GFP_DMA - * is more important. + * KMALLOC_CGROUP for non-reclaimable and non-DMA object with + * accounting enabled. */ - return flags & __GFP_DMA ? KMALLOC_DMA : KMALLOC_RECLAIM; -#else - return flags & __GFP_RECLAIMABLE ? KMALLOC_RECLAIM : KMALLOC_NORMAL; + if ((flags & (__GFP_ACCOUNT | __GFP_RECLAIMABLE +#ifdef CONFIG_ZONE_DMA + | __GFP_DMA +#endif + )) == __GFP_ACCOUNT) + return KMALLOC_CGROUP; #endif + +#ifdef CONFIG_ZONE_DMA + if (flags & __GFP_DMA) + return KMALLOC_DMA; +#endif + + /* if we got here, it has to be __GFP_RECLAIMABLE */ + return KMALLOC_RECLAIM; } /*
WARNING: multiple messages have this Message-ID (diff)
From: Vlastimil Babka <vbabka-AlSwsSmVLrQ@public.gmane.org> To: Waiman Long <longman-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>, Johannes Weiner <hannes-druUgvl0LCNAfugRpC6u6w@public.gmane.org>, Michal Hocko <mhocko-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>, Vladimir Davydov <vdavydov.dev-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>, Andrew Morton <akpm-de/tnXTf+JLsfHDXvbKv3WD2FQJk+8+b@public.gmane.org>, Christoph Lameter <cl-vYTEC60ixJUAvxtiuMwx3w@public.gmane.org>, Pekka Enberg <penberg-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>, David Rientjes <rientjes-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org>, Joonsoo Kim <iamjoonsoo.kim-Hm3cg6mZ9cc@public.gmane.org>, Roman Gushchin <guro-b10kYP2dOMg@public.gmane.org>, Shakeel Butt <shakeelb-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org> Cc: linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, cgroups-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-mm-Bw31MaZKKs3YtjvyW6yDsg@public.gmane.org Subject: Re: [PATCH v2 2/2] mm: memcg/slab: Create a new set of kmalloc-cg-<n> caches Date: Tue, 4 May 2021 18:01:49 +0200 [thread overview] Message-ID: <3c952b24-94e4-3c54-b668-cac778ff5a77@suse.cz> (raw) In-Reply-To: <20210504132350.4693-3-longman-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> On 5/4/21 3:23 PM, Waiman Long wrote: > There are currently two problems in the way the objcg pointer array > (memcg_data) in the page structure is being allocated and freed. > > On its allocation, it is possible that the allocated objcg pointer > array comes from the same slab that requires memory accounting. If this > happens, the slab will never become empty again as there is at least > one object left (the obj_cgroup array) in the slab. > > When it is freed, the objcg pointer array object may be the last one > in its slab and hence causes kfree() to be called again. With the > right workload, the slab cache may be set up in a way that allows the > recursive kfree() calling loop to nest deep enough to cause a kernel > stack overflow and panic the system. > > One way to solve this problem is to split the kmalloc-<n> caches > (KMALLOC_NORMAL) into two separate sets - a new set of kmalloc-<n> > (KMALLOC_NORMAL) caches for non-accounted objects only and a new set of > kmalloc-cg-<n> (KMALLOC_CGROUP) caches for accounted objects only. All > the other caches can allow a mix of accounted and non-accounted objects. > > With this change, all the objcg pointer array objects will come from > KMALLOC_NORMAL caches which won't have their objcg pointer arrays. So > both the recursive kfree() problem and non-freeable slab problem > are gone. > > The new KMALLOC_CGROUP is added between KMALLOC_NORMAL and > KMALLOC_RECLAIM so that the first for loop in create_kmalloc_caches() > will include the newly added caches without change. Great, thanks I hope there would be also benefits to objcg arrays not created for all the normal caches anymore (possibly poorly used due to mix of accounted and non-accounted objects in the same cache) and perhaps it's possible for you to quantify the reduction of those? > Suggested-by: Vlastimil Babka <vbabka-AlSwsSmVLrQ@public.gmane.org> > Signed-off-by: Waiman Long <longman-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> ... > @@ -321,6 +328,14 @@ kmalloc_caches[NR_KMALLOC_TYPES][KMALLOC_SHIFT_HIGH + 1]; > > static __always_inline enum kmalloc_cache_type kmalloc_type(gfp_t flags) > { > +#ifdef CONFIG_MEMCG_KMEM > + /* > + * KMALLOC_CGROUP for non-reclaimable and non-DMA object with > + * accounting enabled. > + */ > + if ((flags & (__GFP_DMA | __GFP_RECLAIMABLE | __GFP_ACCOUNT)) == __GFP_ACCOUNT) > + return KMALLOC_CGROUP; > +#endif This function was designed so that KMALLOC_NORMAL would be the first tested and returned possibility, as it's expected to be the most common. What about the following on top? ----8<---- diff --git a/include/linux/slab.h b/include/linux/slab.h index fca03c22ea7c..418c5df0305b 100644 --- a/include/linux/slab.h +++ b/include/linux/slab.h @@ -328,30 +328,40 @@ kmalloc_caches[NR_KMALLOC_TYPES][KMALLOC_SHIFT_HIGH + 1]; static __always_inline enum kmalloc_cache_type kmalloc_type(gfp_t flags) { -#ifdef CONFIG_MEMCG_KMEM /* - * KMALLOC_CGROUP for non-reclaimable and non-DMA object with - * accounting enabled. + * The most common case is KMALLOC_NORMAL, so test for it + * with a single branch for all flags that might affect it */ - if ((flags & (__GFP_DMA | __GFP_RECLAIMABLE | __GFP_ACCOUNT)) == __GFP_ACCOUNT) - return KMALLOC_CGROUP; + if (likely((flags & (__GFP_RECLAIMABLE +#ifdef CONFIG_MEMCG_KMEM + | __GFP_ACCOUNT #endif #ifdef CONFIG_ZONE_DMA - /* - * The most common case is KMALLOC_NORMAL, so test for it - * with a single branch for both flags. - */ - if (likely((flags & (__GFP_DMA | __GFP_RECLAIMABLE)) == 0)) + | __GFP_DMA +#endif + )) == 0)) return KMALLOC_NORMAL; +#ifdef CONFIG_MEMCG_KMEM /* - * At least one of the flags has to be set. If both are, __GFP_DMA - * is more important. + * KMALLOC_CGROUP for non-reclaimable and non-DMA object with + * accounting enabled. */ - return flags & __GFP_DMA ? KMALLOC_DMA : KMALLOC_RECLAIM; -#else - return flags & __GFP_RECLAIMABLE ? KMALLOC_RECLAIM : KMALLOC_NORMAL; + if ((flags & (__GFP_ACCOUNT | __GFP_RECLAIMABLE +#ifdef CONFIG_ZONE_DMA + | __GFP_DMA +#endif + )) == __GFP_ACCOUNT) + return KMALLOC_CGROUP; #endif + +#ifdef CONFIG_ZONE_DMA + if (flags & __GFP_DMA) + return KMALLOC_DMA; +#endif + + /* if we got here, it has to be __GFP_RECLAIMABLE */ + return KMALLOC_RECLAIM; } /*
next prev parent reply other threads:[~2021-05-04 16:01 UTC|newest] Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-05-04 13:23 [PATCH v2 0/2] mm: memcg/slab: Fix objcg pointer array handling problem Waiman Long 2021-05-04 13:23 ` Waiman Long 2021-05-04 13:23 ` [PATCH v2 1/2] mm: memcg/slab: Properly set up gfp flags for objcg pointer array Waiman Long 2021-05-04 13:23 ` Waiman Long 2021-05-04 19:37 ` Shakeel Butt 2021-05-04 19:37 ` Shakeel Butt 2021-05-04 19:37 ` Shakeel Butt 2021-05-04 20:02 ` Waiman Long 2021-05-04 20:02 ` Waiman Long 2021-05-04 20:06 ` Shakeel Butt 2021-05-04 20:06 ` Shakeel Butt 2021-05-04 20:06 ` Shakeel Butt 2021-05-05 11:32 ` Vlastimil Babka 2021-05-05 11:32 ` Vlastimil Babka 2021-05-04 13:23 ` [PATCH v2 2/2] mm: memcg/slab: Create a new set of kmalloc-cg-<n> caches Waiman Long 2021-05-04 13:23 ` Waiman Long 2021-05-04 16:01 ` Vlastimil Babka [this message] 2021-05-04 16:01 ` Vlastimil Babka 2021-05-05 1:55 ` Waiman Long 2021-05-05 1:55 ` Waiman Long
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=3c952b24-94e4-3c54-b668-cac778ff5a77@suse.cz \ --to=vbabka@suse.cz \ --cc=akpm@linux-foundation.org \ --cc=cgroups@vger.kernel.org \ --cc=cl@linux.com \ --cc=guro@fb.com \ --cc=hannes@cmpxchg.org \ --cc=iamjoonsoo.kim@lge.com \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=longman@redhat.com \ --cc=mhocko@kernel.org \ --cc=penberg@kernel.org \ --cc=rientjes@google.com \ --cc=shakeelb@google.com \ --cc=vdavydov.dev@gmail.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.