All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] mm/slab: fix race with dereferencing NULL ptr in alloc_calls_show
@ 2016-02-02 15:01 ` Dmitry Safonov
  0 siblings, 0 replies; 6+ messages in thread
From: Dmitry Safonov @ 2016-02-02 15:01 UTC (permalink / raw)
  To: akpm, cl, penberg, rientjes, iamjoonsoo.kim
  Cc: linux-mm, linux-kernel, Dmitry Safonov, Vladimir Davydov

memcg_destroy_kmem_caches shutdowns in the first place kmem_caches under
slab_mutex which involves freeing NUMA node structures for kmem_cache
and only then under release_caches removes corresponding sysfs files for
these caches. Which may lead to dereferencing NULL ptr on read.
Lets remove sysfs files right there.

Fixes the following panic:
[43963.463055] BUG: unable to handle kernel
[43963.463090] NULL pointer dereference at 0000000000000020
[43963.463146] IP: [<ffffffff811c6959>] list_locations+0x169/0x4e0
[43963.463185] PGD 257304067 PUD 438456067 PMD 0
[43963.463220] Oops: 0000 [#1] SMP
[43963.463850] CPU: 3 PID: 973074 Comm: cat ve: 0 Not tainted 3.10.0-229.7.2.ovz.9.30-00007-japdoll-dirty #2 9.30
[43963.463913] Hardware name: DEPO Computers To Be Filled By O.E.M./H67DE3, BIOS L1.60c 07/14/2011
[43963.463976] task: ffff88042a5dc5b0 ti: ffff88037f8d8000 task.ti: ffff88037f8d8000
[43963.464036] RIP: 0010:[<ffffffff811c6959>]  [<ffffffff811c6959>] list_locations+0x169/0x4e0
[43963.464725] Call Trace:
[43963.464756]  [<ffffffff811c6d1d>] alloc_calls_show+0x1d/0x30
[43963.464793]  [<ffffffff811c15ab>] slab_attr_show+0x1b/0x30
[43963.464829]  [<ffffffff8125d27a>] sysfs_read_file+0x9a/0x1a0
[43963.464865]  [<ffffffff811e3c6c>] vfs_read+0x9c/0x170
[43963.464900]  [<ffffffff811e4798>] SyS_read+0x58/0xb0
[43963.464936]  [<ffffffff81612d49>] system_call_fastpath+0x16/0x1b
[43963.464970] Code: 5e 07 12 00 b9 00 04 00 00 3d 00 04 00 00 0f 4f c1 3d 00 04 00 00 89 45 b0 0f 84 c3 00 00 00 48 63 45 b0 49 8b 9c c4 f8 00 00 00 <48> 8b 43 20 48 85 c0 74 b6 48 89 df e8 46 37 44 00 48 8b 53 10
[43963.465119] RIP  [<ffffffff811c6959>] list_locations+0x169/0x4e0
[43963.465155]  RSP <ffff88037f8dbe28>
[43963.465185] CR2: 0000000000000020

Cc: Vladimir Davydov <vdavydov@virtuozzo.com>
Signed-off-by: Dmitry Safonov <dsafonov@virtuozzo.com>
---
 mm/slab_common.c | 10 ++++------
 mm/slub.c        |  6 ------
 2 files changed, 4 insertions(+), 12 deletions(-)

diff --git a/mm/slab_common.c b/mm/slab_common.c
index b50aef0..6725eb3 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -468,13 +468,8 @@ static void release_caches(struct list_head *release, bool need_rcu_barrier)
 	if (need_rcu_barrier)
 		rcu_barrier();
 
-	list_for_each_entry_safe(s, s2, release, list) {
-#ifdef SLAB_SUPPORTS_SYSFS
-		sysfs_slab_remove(s);
-#else
+	list_for_each_entry_safe(s, s2, release, list)
 		slab_kmem_cache_release(s);
-#endif
-	}
 }
 
 #if defined(CONFIG_MEMCG) && !defined(CONFIG_SLOB)
@@ -614,6 +609,9 @@ void memcg_destroy_kmem_caches(struct mem_cgroup *memcg)
 	list_for_each_entry_safe(s, s2, &slab_caches, list) {
 		if (is_root_cache(s) || s->memcg_params.memcg != memcg)
 			continue;
+
+		sysfs_slab_remove(s);
+
 		/*
 		 * The cgroup is about to be freed and therefore has no charges
 		 * left. Hence, all its caches must be empty by now.
diff --git a/mm/slub.c b/mm/slub.c
index 2e1355a..b6a68b7 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -5296,11 +5296,6 @@ static void memcg_propagate_slab_attrs(struct kmem_cache *s)
 #endif
 }
 
-static void kmem_cache_release(struct kobject *k)
-{
-	slab_kmem_cache_release(to_slab(k));
-}
-
 static const struct sysfs_ops slab_sysfs_ops = {
 	.show = slab_attr_show,
 	.store = slab_attr_store,
@@ -5308,7 +5303,6 @@ static const struct sysfs_ops slab_sysfs_ops = {
 
 static struct kobj_type slab_ktype = {
 	.sysfs_ops = &slab_sysfs_ops,
-	.release = kmem_cache_release,
 };
 
 static int uevent_filter(struct kset *kset, struct kobject *kobj)
-- 
2.7.0

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [PATCH] mm/slab: fix race with dereferencing NULL ptr in alloc_calls_show
@ 2016-02-02 15:01 ` Dmitry Safonov
  0 siblings, 0 replies; 6+ messages in thread
From: Dmitry Safonov @ 2016-02-02 15:01 UTC (permalink / raw)
  To: akpm, cl, penberg, rientjes, iamjoonsoo.kim
  Cc: linux-mm, linux-kernel, Dmitry Safonov, Vladimir Davydov

memcg_destroy_kmem_caches shutdowns in the first place kmem_caches under
slab_mutex which involves freeing NUMA node structures for kmem_cache
and only then under release_caches removes corresponding sysfs files for
these caches. Which may lead to dereferencing NULL ptr on read.
Lets remove sysfs files right there.

Fixes the following panic:
[43963.463055] BUG: unable to handle kernel
[43963.463090] NULL pointer dereference at 0000000000000020
[43963.463146] IP: [<ffffffff811c6959>] list_locations+0x169/0x4e0
[43963.463185] PGD 257304067 PUD 438456067 PMD 0
[43963.463220] Oops: 0000 [#1] SMP
[43963.463850] CPU: 3 PID: 973074 Comm: cat ve: 0 Not tainted 3.10.0-229.7.2.ovz.9.30-00007-japdoll-dirty #2 9.30
[43963.463913] Hardware name: DEPO Computers To Be Filled By O.E.M./H67DE3, BIOS L1.60c 07/14/2011
[43963.463976] task: ffff88042a5dc5b0 ti: ffff88037f8d8000 task.ti: ffff88037f8d8000
[43963.464036] RIP: 0010:[<ffffffff811c6959>]  [<ffffffff811c6959>] list_locations+0x169/0x4e0
[43963.464725] Call Trace:
[43963.464756]  [<ffffffff811c6d1d>] alloc_calls_show+0x1d/0x30
[43963.464793]  [<ffffffff811c15ab>] slab_attr_show+0x1b/0x30
[43963.464829]  [<ffffffff8125d27a>] sysfs_read_file+0x9a/0x1a0
[43963.464865]  [<ffffffff811e3c6c>] vfs_read+0x9c/0x170
[43963.464900]  [<ffffffff811e4798>] SyS_read+0x58/0xb0
[43963.464936]  [<ffffffff81612d49>] system_call_fastpath+0x16/0x1b
[43963.464970] Code: 5e 07 12 00 b9 00 04 00 00 3d 00 04 00 00 0f 4f c1 3d 00 04 00 00 89 45 b0 0f 84 c3 00 00 00 48 63 45 b0 49 8b 9c c4 f8 00 00 00 <48> 8b 43 20 48 85 c0 74 b6 48 89 df e8 46 37 44 00 48 8b 53 10
[43963.465119] RIP  [<ffffffff811c6959>] list_locations+0x169/0x4e0
[43963.465155]  RSP <ffff88037f8dbe28>
[43963.465185] CR2: 0000000000000020

Cc: Vladimir Davydov <vdavydov@virtuozzo.com>
Signed-off-by: Dmitry Safonov <dsafonov@virtuozzo.com>
---
 mm/slab_common.c | 10 ++++------
 mm/slub.c        |  6 ------
 2 files changed, 4 insertions(+), 12 deletions(-)

diff --git a/mm/slab_common.c b/mm/slab_common.c
index b50aef0..6725eb3 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -468,13 +468,8 @@ static void release_caches(struct list_head *release, bool need_rcu_barrier)
 	if (need_rcu_barrier)
 		rcu_barrier();
 
-	list_for_each_entry_safe(s, s2, release, list) {
-#ifdef SLAB_SUPPORTS_SYSFS
-		sysfs_slab_remove(s);
-#else
+	list_for_each_entry_safe(s, s2, release, list)
 		slab_kmem_cache_release(s);
-#endif
-	}
 }
 
 #if defined(CONFIG_MEMCG) && !defined(CONFIG_SLOB)
@@ -614,6 +609,9 @@ void memcg_destroy_kmem_caches(struct mem_cgroup *memcg)
 	list_for_each_entry_safe(s, s2, &slab_caches, list) {
 		if (is_root_cache(s) || s->memcg_params.memcg != memcg)
 			continue;
+
+		sysfs_slab_remove(s);
+
 		/*
 		 * The cgroup is about to be freed and therefore has no charges
 		 * left. Hence, all its caches must be empty by now.
diff --git a/mm/slub.c b/mm/slub.c
index 2e1355a..b6a68b7 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -5296,11 +5296,6 @@ static void memcg_propagate_slab_attrs(struct kmem_cache *s)
 #endif
 }
 
-static void kmem_cache_release(struct kobject *k)
-{
-	slab_kmem_cache_release(to_slab(k));
-}
-
 static const struct sysfs_ops slab_sysfs_ops = {
 	.show = slab_attr_show,
 	.store = slab_attr_store,
@@ -5308,7 +5303,6 @@ static const struct sysfs_ops slab_sysfs_ops = {
 
 static struct kobj_type slab_ktype = {
 	.sysfs_ops = &slab_sysfs_ops,
-	.release = kmem_cache_release,
 };
 
 static int uevent_filter(struct kset *kset, struct kobject *kobj)
-- 
2.7.0

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* Re: [PATCH] mm/slab: fix race with dereferencing NULL ptr in alloc_calls_show
  2016-02-02 15:01 ` Dmitry Safonov
@ 2016-02-02 15:19   ` kbuild test robot
  -1 siblings, 0 replies; 6+ messages in thread
From: kbuild test robot @ 2016-02-02 15:19 UTC (permalink / raw)
  To: Dmitry Safonov
  Cc: kbuild-all, akpm, cl, penberg, rientjes, iamjoonsoo.kim,
	linux-mm, linux-kernel, Dmitry Safonov, Vladimir Davydov

[-- Attachment #1: Type: text/plain, Size: 1327 bytes --]

Hi Dmitry,

[auto build test ERROR on v4.5-rc2]
[also build test ERROR on next-20160201]
[if your patch is applied to the wrong git tree, please drop us a note to help improving the system]

url:    https://github.com/0day-ci/linux/commits/Dmitry-Safonov/mm-slab-fix-race-with-dereferencing-NULL-ptr-in-alloc_calls_show/20160202-230449
config: i386-randconfig-x005-02010231 (attached as .config)
reproduce:
        # save the attached .config to linux build tree
        make ARCH=i386 

All errors (new ones prefixed by >>):

   mm/slab_common.c: In function 'memcg_destroy_kmem_caches':
>> mm/slab_common.c:613:3: error: implicit declaration of function 'sysfs_slab_remove' [-Werror=implicit-function-declaration]
      sysfs_slab_remove(s);
      ^
   cc1: some warnings being treated as errors

vim +/sysfs_slab_remove +613 mm/slab_common.c

   607	
   608		mutex_lock(&slab_mutex);
   609		list_for_each_entry_safe(s, s2, &slab_caches, list) {
   610			if (is_root_cache(s) || s->memcg_params.memcg != memcg)
   611				continue;
   612	
 > 613			sysfs_slab_remove(s);
   614	
   615			/*
   616			 * The cgroup is about to be freed and therefore has no charges

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

[-- Attachment #2: .config.gz --]
[-- Type: application/octet-stream, Size: 25271 bytes --]

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH] mm/slab: fix race with dereferencing NULL ptr in alloc_calls_show
@ 2016-02-02 15:19   ` kbuild test robot
  0 siblings, 0 replies; 6+ messages in thread
From: kbuild test robot @ 2016-02-02 15:19 UTC (permalink / raw)
  To: Dmitry Safonov
  Cc: kbuild-all, akpm, cl, penberg, rientjes, iamjoonsoo.kim,
	linux-mm, linux-kernel, Vladimir Davydov

[-- Attachment #1: Type: text/plain, Size: 1327 bytes --]

Hi Dmitry,

[auto build test ERROR on v4.5-rc2]
[also build test ERROR on next-20160201]
[if your patch is applied to the wrong git tree, please drop us a note to help improving the system]

url:    https://github.com/0day-ci/linux/commits/Dmitry-Safonov/mm-slab-fix-race-with-dereferencing-NULL-ptr-in-alloc_calls_show/20160202-230449
config: i386-randconfig-x005-02010231 (attached as .config)
reproduce:
        # save the attached .config to linux build tree
        make ARCH=i386 

All errors (new ones prefixed by >>):

   mm/slab_common.c: In function 'memcg_destroy_kmem_caches':
>> mm/slab_common.c:613:3: error: implicit declaration of function 'sysfs_slab_remove' [-Werror=implicit-function-declaration]
      sysfs_slab_remove(s);
      ^
   cc1: some warnings being treated as errors

vim +/sysfs_slab_remove +613 mm/slab_common.c

   607	
   608		mutex_lock(&slab_mutex);
   609		list_for_each_entry_safe(s, s2, &slab_caches, list) {
   610			if (is_root_cache(s) || s->memcg_params.memcg != memcg)
   611				continue;
   612	
 > 613			sysfs_slab_remove(s);
   614	
   615			/*
   616			 * The cgroup is about to be freed and therefore has no charges

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

[-- Attachment #2: .config.gz --]
[-- Type: application/octet-stream, Size: 25271 bytes --]

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH] mm/slab: fix race with dereferencing NULL ptr in alloc_calls_show
  2016-02-02 15:19   ` kbuild test robot
@ 2016-02-02 15:55     ` Dmitry Safonov
  -1 siblings, 0 replies; 6+ messages in thread
From: Dmitry Safonov @ 2016-02-02 15:55 UTC (permalink / raw)
  To: kbuild test robot
  Cc: kbuild-all, akpm, cl, penberg, rientjes, iamjoonsoo.kim,
	linux-mm, linux-kernel, Vladimir Davydov

On 02/02/2016 06:19 PM, kbuild test robot wrote:
> Hi Dmitry,
>
> [auto build test ERROR on v4.5-rc2]
> [also build test ERROR on next-20160201]
> [if your patch is applied to the wrong git tree, please drop us a note to help improving the system]
>
> url:    https://github.com/0day-ci/linux/commits/Dmitry-Safonov/mm-slab-fix-race-with-dereferencing-NULL-ptr-in-alloc_calls_show/20160202-230449
> config: i386-randconfig-x005-02010231 (attached as .config)
> reproduce:
>          # save the attached .config to linux build tree
>          make ARCH=i386
Thanks little robot, will resend fixed v2 right soon.
>
> All errors (new ones prefixed by >>):
>
>     mm/slab_common.c: In function 'memcg_destroy_kmem_caches':
>>> mm/slab_common.c:613:3: error: implicit declaration of function 'sysfs_slab_remove' [-Werror=implicit-function-declaration]
>        sysfs_slab_remove(s);
>        ^
>     cc1: some warnings being treated as errors
>
> vim +/sysfs_slab_remove +613 mm/slab_common.c
>
>     607	
>     608		mutex_lock(&slab_mutex);
>     609		list_for_each_entry_safe(s, s2, &slab_caches, list) {
>     610			if (is_root_cache(s) || s->memcg_params.memcg != memcg)
>     611				continue;
>     612	
>   > 613			sysfs_slab_remove(s);
>     614	
>     615			/*
>     616			 * The cgroup is about to be freed and therefore has no charges
>
> ---
> 0-DAY kernel test infrastructure                Open Source Technology Center
> https://lists.01.org/pipermail/kbuild-all                   Intel Corporation


-- 
Regards,
Dmitry Safonov

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH] mm/slab: fix race with dereferencing NULL ptr in alloc_calls_show
@ 2016-02-02 15:55     ` Dmitry Safonov
  0 siblings, 0 replies; 6+ messages in thread
From: Dmitry Safonov @ 2016-02-02 15:55 UTC (permalink / raw)
  To: kbuild test robot
  Cc: kbuild-all, akpm, cl, penberg, rientjes, iamjoonsoo.kim,
	linux-mm, linux-kernel, Vladimir Davydov

On 02/02/2016 06:19 PM, kbuild test robot wrote:
> Hi Dmitry,
>
> [auto build test ERROR on v4.5-rc2]
> [also build test ERROR on next-20160201]
> [if your patch is applied to the wrong git tree, please drop us a note to help improving the system]
>
> url:    https://github.com/0day-ci/linux/commits/Dmitry-Safonov/mm-slab-fix-race-with-dereferencing-NULL-ptr-in-alloc_calls_show/20160202-230449
> config: i386-randconfig-x005-02010231 (attached as .config)
> reproduce:
>          # save the attached .config to linux build tree
>          make ARCH=i386
Thanks little robot, will resend fixed v2 right soon.
>
> All errors (new ones prefixed by >>):
>
>     mm/slab_common.c: In function 'memcg_destroy_kmem_caches':
>>> mm/slab_common.c:613:3: error: implicit declaration of function 'sysfs_slab_remove' [-Werror=implicit-function-declaration]
>        sysfs_slab_remove(s);
>        ^
>     cc1: some warnings being treated as errors
>
> vim +/sysfs_slab_remove +613 mm/slab_common.c
>
>     607	
>     608		mutex_lock(&slab_mutex);
>     609		list_for_each_entry_safe(s, s2, &slab_caches, list) {
>     610			if (is_root_cache(s) || s->memcg_params.memcg != memcg)
>     611				continue;
>     612	
>   > 613			sysfs_slab_remove(s);
>     614	
>     615			/*
>     616			 * The cgroup is about to be freed and therefore has no charges
>
> ---
> 0-DAY kernel test infrastructure                Open Source Technology Center
> https://lists.01.org/pipermail/kbuild-all                   Intel Corporation


-- 
Regards,
Dmitry Safonov

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-02-02 15:55 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-02-02 15:01 [PATCH] mm/slab: fix race with dereferencing NULL ptr in alloc_calls_show Dmitry Safonov
2016-02-02 15:01 ` Dmitry Safonov
2016-02-02 15:19 ` kbuild test robot
2016-02-02 15:19   ` kbuild test robot
2016-02-02 15:55   ` Dmitry Safonov
2016-02-02 15:55     ` Dmitry Safonov

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.