From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E699CC433DB for ; Wed, 6 Jan 2021 17:40:52 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 7B2AE20657 for ; Wed, 6 Jan 2021 17:40:52 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 7B2AE20657 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=suse.cz Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id E0F4B6B02B8; Wed, 6 Jan 2021 12:40:46 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 94DD26B02BB; Wed, 6 Jan 2021 12:40:46 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 753856B02B5; Wed, 6 Jan 2021 12:40:46 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0142.hostedemail.com [216.40.44.142]) by kanga.kvack.org (Postfix) with ESMTP id 4C8DF6B02B3 for ; Wed, 6 Jan 2021 12:40:46 -0500 (EST) Received: from smtpin26.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 14359181AEF21 for ; Wed, 6 Jan 2021 17:40:46 +0000 (UTC) X-FDA: 77676065292.26.gun62_5b077bf274e3 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin26.hostedemail.com (Postfix) with ESMTP id AA2661804B660 for ; Wed, 6 Jan 2021 17:40:45 +0000 (UTC) X-HE-Tag: gun62_5b077bf274e3 X-Filterd-Recvd-Size: 4750 Received: from mx2.suse.de (mx2.suse.de [195.135.220.15]) by imf05.hostedemail.com (Postfix) with ESMTP for ; Wed, 6 Jan 2021 17:40:45 +0000 (UTC) X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id 9A436ADD6; Wed, 6 Jan 2021 17:40:43 +0000 (UTC) From: Vlastimil Babka To: linux-mm@kvack.org Cc: linux-kernel@vger.kernel.org, Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Vladimir Davydov , Qian Cai , David Hildenbrand , Michal Hocko , Vlastimil Babka Subject: [RFC 3/3] mm, slub: stop freeing kmem_cache_node structures on node offline Date: Wed, 6 Jan 2021 18:40:29 +0100 Message-Id: <20210106174029.12654-4-vbabka@suse.cz> X-Mailer: git-send-email 2.29.2 In-Reply-To: <20210106174029.12654-1-vbabka@suse.cz> References: <20210106174029.12654-1-vbabka@suse.cz> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Commit e4f8e513c3d3 ("mm/slub: fix a deadlock in show_slab_objects()") ha= s fixed a problematic locking order by removing the memory hotplug lock get/put_online_mems() from show_slab_objects(). During the discussion, it= was argued [1] that this is OK, because existing slabs on the node would prev= ent a hotremove to proceed. That's true, but per-node kmem_cache_node structures are not necessarily allocated on the same node and may exist even without actual slab pages on the same node. Any path that uses get_node() directly or via for_each_kmem_cache_node() (such as show_slab_objects()) can race with freeing of kmem_cache_node even with the !NULL check, resulting in use-after-free. To that end, commit e4f8e513c3d3 argues in a comment that: * We don't really need mem_hotplug_lock (to hold off * slab_mem_going_offline_callback) here because slab's memory hot * unplug code doesn't destroy the kmem_cache->node[] data. While it's true that slab_mem_going_offline_callback() doesn't free the kmem_cache_node, the later callback slab_mem_offline_callback() actua= lly does, so the race and use-after-free exists. Not just for show_slab_objec= ts() after commit e4f8e513c3d3, but also many other places that are not under slab_mutex. And adding slab_mutex locking or other synchronization to SLU= B paths such as get_any_partial() would be bad for performance and error-pr= one. The easiest solution is therefore to make the abovementioned comment true= and stop freeing the kmem_cache_node structures, accepting some wasted memory= in the full memory node removal scenario. Analogically we also don't free hotremoved pgdat as mentioned in [1], nor the similar per-node structures= in SLAB. Importantly this approach will not block the hotremove, as generall= y such nodes should be movable in order to succeed hotremove in the first place,= and thus the GFP_KERNEL allocated kmem_cache_node will come from elsewhere. [1] https://lore.kernel.org/linux-mm/20190924151147.GB23050@dhcp22.suse.c= z/ Signed-off-by: Vlastimil Babka --- mm/slub.c | 26 +++++++++++--------------- 1 file changed, 11 insertions(+), 15 deletions(-) diff --git a/mm/slub.c b/mm/slub.c index 2e2edd5c9cfc..d7c4f08dcf39 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -4268,21 +4268,11 @@ static void slab_mem_offline_callback(void *arg) =20 mutex_lock(&slab_mutex); node_clear(offline_node, slab_nodes); - list_for_each_entry(s, &slab_caches, list) { - n =3D get_node(s, offline_node); - if (n) { - /* - * if n->nr_slabs > 0, slabs still exist on the node - * that is going down. We were unable to free them, - * and offline_pages() function shouldn't call this - * callback. So, we must fail. - */ - BUG_ON(slabs_node(s, offline_node)); - - s->node[offline_node] =3D NULL; - kmem_cache_free(kmem_cache_node, n); - } - } + /* + * We no longer free kmem_cache_node structures here, as it would be + * racy with all get_node() users, and infeasible to protect them with + * slab_mutex. + */ mutex_unlock(&slab_mutex); } =20 @@ -4308,6 +4298,12 @@ static int slab_mem_going_online_callback(void *ar= g) */ mutex_lock(&slab_mutex); list_for_each_entry(s, &slab_caches, list) { + /* + * The structure may already exist if the node was previously + * onlined and offlined. + */ + if (get_node(s, nid)) + continue; /* * XXX: kmem_cache_alloc_node will fallback to other nodes * since memory is not yet available from the node that --=20 2.29.2