From: Andrew Morton <akpm@linux-foundation.org>
To: akpm@linux-foundation.org, cl@linux.com, guro@fb.com,
iamjoonsoo.kim@lge.com, linux-mm@kvack.org,
mm-commits@vger.kernel.org, penberg@kernel.org,
rientjes@google.com, shakeelb@google.com,
songmuchun@bytedance.com, stable@vger.kernel.org,
torvalds@linux-foundation.org, vbabka@suse.cz
Subject: [patch 07/15] mm: memcg/slab: fix memory leak at non-root kmem_cache destroy
Date: Thu, 23 Jul 2020 21:15:27 -0700 [thread overview]
Message-ID: <20200724041527.cGFVoVytc%akpm@linux-foundation.org> (raw)
In-Reply-To: <20200723211432.b31831a0df3bc2cbdae31b40@linux-foundation.org>
From: Muchun Song <songmuchun@bytedance.com>
Subject: mm: memcg/slab: fix memory leak at non-root kmem_cache destroy
If the kmem_cache refcount is greater than one, we should not mark the
root kmem_cache as dying. If we mark the root kmem_cache dying
incorrectly, the non-root kmem_cache can never be destroyed. It resulted
in memory leak when memcg was destroyed. We can use the following steps
to reproduce.
1) Use kmem_cache_create() to create a new kmem_cache named A.
2) Coincidentally, the kmem_cache A is an alias for kmem_cache B,
so the refcount of B is just increased.
3) Use kmem_cache_destroy() to destroy the kmem_cache A, just
decrease the B's refcount but mark the B as dying.
4) Create a new memory cgroup and alloc memory from the kmem_cache
B. It leads to create a non-root kmem_cache for allocating memory.
5) When destroy the memory cgroup created in the step 4), the
non-root kmem_cache can never be destroyed.
If we repeat steps 4) and 5), this will cause a lot of memory leak. So
only when refcount reach zero, we mark the root kmem_cache as dying.
Link: http://lkml.kernel.org/r/20200716165103.83462-1-songmuchun@bytedance.com
Fixes: 92ee383f6daa ("mm: fix race between kmem_cache destroy, create and deactivate")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Reviewed-by: Shakeel Butt <shakeelb@google.com>
Acked-by: Roman Gushchin <guro@fb.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
mm/slab_common.c | 35 ++++++++++++++++++++++++++++-------
1 file changed, 28 insertions(+), 7 deletions(-)
--- a/mm/slab_common.c~mm-memcg-slab-fix-memory-leak-at-non-root-kmem_cache-destroy
+++ a/mm/slab_common.c
@@ -326,6 +326,14 @@ int slab_unmergeable(struct kmem_cache *
if (s->refcount < 0)
return 1;
+#ifdef CONFIG_MEMCG_KMEM
+ /*
+ * Skip the dying kmem_cache.
+ */
+ if (s->memcg_params.dying)
+ return 1;
+#endif
+
return 0;
}
@@ -886,12 +894,15 @@ static int shutdown_memcg_caches(struct
return 0;
}
-static void flush_memcg_workqueue(struct kmem_cache *s)
+static void memcg_set_kmem_cache_dying(struct kmem_cache *s)
{
spin_lock_irq(&memcg_kmem_wq_lock);
s->memcg_params.dying = true;
spin_unlock_irq(&memcg_kmem_wq_lock);
+}
+static void flush_memcg_workqueue(struct kmem_cache *s)
+{
/*
* SLAB and SLUB deactivate the kmem_caches through call_rcu. Make
* sure all registered rcu callbacks have been invoked.
@@ -923,10 +934,6 @@ static inline int shutdown_memcg_caches(
{
return 0;
}
-
-static inline void flush_memcg_workqueue(struct kmem_cache *s)
-{
-}
#endif /* CONFIG_MEMCG_KMEM */
void slab_kmem_cache_release(struct kmem_cache *s)
@@ -944,8 +951,6 @@ void kmem_cache_destroy(struct kmem_cach
if (unlikely(!s))
return;
- flush_memcg_workqueue(s);
-
get_online_cpus();
get_online_mems();
@@ -955,6 +960,22 @@ void kmem_cache_destroy(struct kmem_cach
if (s->refcount)
goto out_unlock;
+#ifdef CONFIG_MEMCG_KMEM
+ memcg_set_kmem_cache_dying(s);
+
+ mutex_unlock(&slab_mutex);
+
+ put_online_mems();
+ put_online_cpus();
+
+ flush_memcg_workqueue(s);
+
+ get_online_cpus();
+ get_online_mems();
+
+ mutex_lock(&slab_mutex);
+#endif
+
err = shutdown_memcg_caches(s);
if (!err)
err = shutdown_cache(s);
_
next prev parent reply other threads:[~2020-07-24 4:15 UTC|newest]
Thread overview: 69+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-24 4:14 incoming Andrew Morton
2020-07-24 4:15 ` [patch 01/15] mm/memory.c: avoid access flag update TLB flush for retried page fault Andrew Morton
2020-07-24 4:38 ` Yang Shi
2020-07-24 4:56 ` Andrew Morton
2020-07-24 19:27 ` Linus Torvalds
2020-07-24 20:22 ` Linus Torvalds
2020-07-25 0:36 ` Yang Shi
2020-07-25 1:29 ` Linus Torvalds
2020-07-25 15:58 ` Catalin Marinas
2020-07-28 9:22 ` Will Deacon
2020-07-28 9:39 ` Catalin Marinas
2020-07-28 10:07 ` Yu Xu
2020-07-28 11:46 ` Catalin Marinas
2020-07-28 10:21 ` Will Deacon
2020-07-28 18:28 ` Linus Torvalds
2020-07-27 17:52 ` Yang Shi
2020-07-27 18:04 ` Linus Torvalds
2020-07-27 18:42 ` Catalin Marinas
2020-07-27 20:56 ` Linus Torvalds
2020-07-27 22:34 ` Yang Shi
2020-07-27 7:31 ` Yu Xu
2020-07-27 11:05 ` Catalin Marinas
2020-07-27 17:01 ` Linus Torvalds
2020-07-28 11:19 ` Catalin Marinas
2020-07-27 17:12 ` Yu Xu
2020-07-27 18:04 ` Yang Shi
2020-07-27 18:37 ` Linus Torvalds
2020-07-27 22:43 ` Yang Shi
2020-07-28 0:38 ` Linus Torvalds
2020-07-28 0:13 ` Yu Xu
2020-07-28 10:53 ` Nicholas Piggin
2020-07-28 19:02 ` Linus Torvalds
2020-07-28 22:53 ` Nicholas Piggin
2020-07-29 13:58 ` Michael Ellerman
2020-07-28 6:41 ` Yu Xu
2020-07-24 4:15 ` [patch 02/15] mm/mmap.c: close race between munmap() and expand_upwards()/downwards() Andrew Morton
2020-07-24 4:15 ` [patch 03/15] vfs/xattr: mm/shmem: kernfs: release simple xattr entry in a right way Andrew Morton
2020-07-24 4:15 ` [patch 04/15] mm: initialize return of vm_insert_pages Andrew Morton
2020-07-24 4:15 ` [patch 05/15] mm/memcontrol: fix OOPS inside mem_cgroup_get_nr_swap_pages() Andrew Morton
2020-07-24 4:15 ` [patch 06/15] mm/memcg: fix refcount error while moving and swapping Andrew Morton
2020-07-24 13:41 ` Alex Shi
2020-07-24 4:15 ` Andrew Morton [this message]
2020-07-24 4:15 ` [patch 08/15] mm/hugetlb: avoid hardcoding while checking if cma is enabled Andrew Morton
2020-07-24 4:15 ` [patch 09/15] khugepaged: fix null-pointer dereference due to race Andrew Morton
2020-07-24 4:15 ` [patch 10/15] mailmap: add entry for Mike Rapoport Andrew Morton
2020-07-24 4:15 ` [patch 11/15] squashfs: fix length field overlap check in metadata reading Andrew Morton
2020-07-24 4:15 ` [patch 12/15] scripts/decode_stacktrace: strip basepath from all paths Andrew Morton
2020-07-24 4:15 ` [patch 13/15] io-mapping: indicate mapping failure Andrew Morton
2020-07-24 4:15 ` [patch 14/15] MAINTAINERS: add KCOV section Andrew Morton
2020-07-24 4:15 ` [patch 15/15] scripts/gdb: fix lx-symbols 'gdb.error' while loading modules Andrew Morton
2020-07-28 1:19 ` mmotm 2020-07-27-18-18 uploaded Andrew Morton
2020-07-28 2:14 ` Stephen Rothwell
2020-07-28 3:22 ` mmotm 2020-07-27-18-18 uploaded (drivers/scsi/ufs/: SCSI_UFS_EXYNOS) Randy Dunlap
2020-07-28 8:23 ` Alim Akhtar
2020-07-28 12:33 ` mmotm 2020-07-27-18-18 uploaded (mm/page_alloc.c) Randy Dunlap
2020-07-28 21:55 ` Andrew Morton
2020-07-28 22:20 ` Stephen Rothwell
2020-07-28 22:31 ` Andrew Morton
2020-07-29 14:18 ` Michael S. Tsirkin
2020-07-29 14:38 ` David Hildenbrand
2020-07-29 16:14 ` David Hildenbrand
2020-07-29 17:29 ` Randy Dunlap
2020-07-28 22:39 ` Randy Dunlap
2020-07-29 1:43 ` Nathan Chancellor
2020-07-29 1:44 ` Andrew Morton
2020-07-29 2:04 ` Randy Dunlap
2020-07-29 14:09 ` make oldconfig (Re: mmotm 2020-07-27-18-18 uploaded (mm/page_alloc.c)) Alexey Dobriyan
2020-07-31 23:46 ` mmotm 2020-07-31-16-45 uploaded Andrew Morton
2020-08-01 5:24 ` mmotm 2020-07-31-16-45 uploaded (drivers/staging/vc04_services/) Randy Dunlap
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200724041527.cGFVoVytc%akpm@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=cl@linux.com \
--cc=guro@fb.com \
--cc=iamjoonsoo.kim@lge.com \
--cc=linux-mm@kvack.org \
--cc=mm-commits@vger.kernel.org \
--cc=penberg@kernel.org \
--cc=rientjes@google.com \
--cc=shakeelb@google.com \
--cc=songmuchun@bytedance.com \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=vbabka@suse.cz \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).