From: Feng Tang <feng.tang@intel.com>
To: Vlastimil Babka <vbabka@suse.cz>
Cc: Christoph Lameter <cl@linux.com>,
Pekka Enberg <penberg@kernel.org>,
"David Rientjes" <rientjes@google.com>,
Joonsoo Kim <iamjoonsoo.kim@lge.com>,
"Roman Gushchin" <roman.gushchin@linux.dev>,
Hyeonggon Yoo <42.hyeyoo@gmail.com>,
Andrew Morton <akpm@linux-foundation.org>,
Waiman Long <longman@redhat.com>,
"linux-mm@kvack.org" <linux-mm@kvack.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"kasan-dev@googlegroups.com" <kasan-dev@googlegroups.com>
Subject: Re: [PATCH] mm/slab_common: fix possiable double free of kmem_cache
Date: Mon, 19 Sep 2022 20:50:34 +0800 [thread overview]
Message-ID: <Yyhlmq8GA5FnNoxq@feng-clx> (raw)
In-Reply-To: <e38cc728-f5e5-86d1-d6a1-c3e99cc02239@suse.cz>
On Mon, Sep 19, 2022 at 05:12:38PM +0800, Vlastimil Babka wrote:
> On 9/19/22 05:12, Feng Tang wrote:
[...]
> > The cause is inside kmem_cache_destroy():
> >
> > kmem_cache_destroy
> > acquire lock/mutex
> > shutdown_cache
> > schedule_work(kmem_cache_release) (if RCU flag set)
> > release lock/mutex
> > kmem_cache_release (if RCU flag set)
>
> ^ not set
>
> I've fixed that up.
Oops.. Thanks for catching it!
> >
> > in some certain timing, the scheduled work could be run before
> > the next RCU flag checking which will get a wrong state.
> >
> > Fix it by caching the RCU flag inside protected area, just like 'refcnt'
> >
> > Signed-off-by: Feng Tang <feng.tang@intel.com>
>
> Thanks!
>
> > ---
> >
> > note:
> >
> > The error only happens on linux-next tree, and not in Linus' tree,
> > which already has Waiman's commit:
> > 0495e337b703 ("mm/slab_common: Deleting kobject in kmem_cache_destroy()
> > without holding slab_mutex/cpu_hotplug_lock")
>
> Actually that commit is already in Linus' rc5 too, so I will send your fix
> this week too. Added a Fixes: 0495e337b703 (...) too.
Got it, thanks
- Feng
next prev parent reply other threads:[~2022-09-19 12:51 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-19 3:12 [PATCH] mm/slab_common: fix possiable double free of kmem_cache Feng Tang
2022-09-19 9:12 ` Vlastimil Babka
2022-09-19 11:56 ` Hyeonggon Yoo
2022-09-19 12:03 ` Vlastimil Babka
2022-09-19 12:07 ` Hyeonggon Yoo
2022-09-19 12:50 ` Feng Tang [this message]
2022-09-19 13:34 ` Waiman Long
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Yyhlmq8GA5FnNoxq@feng-clx \
--to=feng.tang@intel.com \
--cc=42.hyeyoo@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=cl@linux.com \
--cc=iamjoonsoo.kim@lge.com \
--cc=kasan-dev@googlegroups.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=longman@redhat.com \
--cc=penberg@kernel.org \
--cc=rientjes@google.com \
--cc=roman.gushchin@linux.dev \
--cc=vbabka@suse.cz \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.