Linux-mm Archive on
 help / color / Atom feed
From: Michal Hocko <>
To: Qian Cai <>
Subject: Re: [PATCH v2] mm/slub: fix a deadlock in show_slab_objects()
Date: Mon, 7 Oct 2019 10:16:21 +0200
Message-ID: <> (raw)
In-Reply-To: <>

On Fri 04-10-19 14:57:01, Michal Hocko wrote:
> On Fri 04-10-19 08:31:49, Qian Cai wrote:
> > Long time ago, there fixed a similar deadlock in show_slab_objects()
> > [1]. However, it is apparently due to the commits like 01fb58bcba63
> > ("slab: remove synchronous synchronize_sched() from memcg cache
> > deactivation path") and 03afc0e25f7f ("slab: get_online_mems for
> > kmem_cache_{create,destroy,shrink}"), this kind of deadlock is back by
> > just reading files in /sys/kernel/slab which will generate a lockdep
> > splat below.
> > 
> > Since the "mem_hotplug_lock" here is only to obtain a stable online node
> > mask while racing with NUMA node hotplug, in the worst case, the results
> > may me miscalculated while doing NUMA node hotplug, but they shall be
> > corrected by later reads of the same files.
> I think it is important to mention that this doesn't expose the
> show_slab_objects to use-after-free. There is only a single path that
> might really race here and that is the slab hotplug notifier callback
> __kmem_cache_shrink (via slab_mem_going_offline_callback) but that path
> doesn't really destroy kmem_cache_node data structures.

Andrew, please add this to the changelog so that we do not have to
scratch heads again when looking into that code.

Michal Hocko

  reply index

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-10-04 12:31 Qian Cai
2019-10-04 12:57 ` Michal Hocko
2019-10-07  8:16   ` Michal Hocko [this message]
2019-10-07 21:59     ` Andrew Morton
2019-10-08  8:47       ` Michal Hocko

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-mm Archive on

Archives are clonable:
	git clone --mirror linux-mm/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-mm linux-mm/ \
	public-inbox-index linux-mm

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone