From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.3 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A247DC4338F for ; Wed, 28 Jul 2021 14:44:53 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 164F060F91 for ; Wed, 28 Jul 2021 14:44:53 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 164F060F91 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvack.org Received: by kanga.kvack.org (Postfix) id 6E1508D0001; Wed, 28 Jul 2021 10:44:52 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 691D66B005D; Wed, 28 Jul 2021 10:44:52 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 582068D0001; Wed, 28 Jul 2021 10:44:52 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0115.hostedemail.com [216.40.44.115]) by kanga.kvack.org (Postfix) with ESMTP id 80A846B0036 for ; Wed, 28 Jul 2021 10:44:40 -0400 (EDT) Received: from forelay.prod.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by fograve03.hostedemail.com (Postfix) with ESMTP id A4F9418173970 for ; Wed, 28 Jul 2021 14:44:37 +0000 (UTC) Received: from smtpin05.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 6FA50180ABF50 for ; Wed, 28 Jul 2021 14:44:27 +0000 (UTC) X-FDA: 78412267374.05.5E7928E Received: from mail-lf1-f47.google.com (mail-lf1-f47.google.com [209.85.167.47]) by imf10.hostedemail.com (Postfix) with ESMTP id 342AE6005981 for ; Wed, 28 Jul 2021 14:44:27 +0000 (UTC) Received: by mail-lf1-f47.google.com with SMTP id a26so4382140lfr.11 for ; Wed, 28 Jul 2021 07:44:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=6hplgm1AOnVRZYwW0TRgRGo6eN4ywXDspCC0lWNzLAA=; b=joZBLJq5jAiJ/cDOdzO6CZncB4oI/y+eYnbZlIvesJXEovYwNIpq9d+tLLn2o0q2iV o1Ue6EWrFZk62q25X7VczcS5WI9e0a6NsPVD+5X0PQR1Ng1PG6jFW0edntDNYecclsbM VVW2g7lSZld4LT/xCK/Y8zWGQBXw03NEHmSvPW97nKe8eCgd3ZQXxluKVMcfKH3abkc4 mBON+BbMIbkxXIwEeuZZIAnSIZzFCr6dlAMtPaQrlsuWSjlqg0UIOJ2XioTfcS2IZ/5C gwlIVts3FvRRJ9AeYanctDC5+TcbEZ/LUpAX3cNOBCxHaa59jjeybOZHdlpUrsZIaOFl eNYA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=6hplgm1AOnVRZYwW0TRgRGo6eN4ywXDspCC0lWNzLAA=; b=pHTf2uy8CBhQ8tgPJreiILptAUSy/TM7p7W4lqnEFjL5k7p59GZr8GFXNwzKCT7P/k OpIQk/s8uz187hSVzivTHhywtsYAHF3MJNNBbHEt6gWCSHz6fPlXPTvSe+tCEHs43s3F hNLdOIGPpsgQH1JKguyXKr5LS2HVgHKwHatCg1nqn8tJbgOPtWhYRYsnbgVIvXJH1DiF 3kXIblj/Dz5EkK/oJQtuFbc8Wj4Izvu5pUboq4JpdkLHtTP+viqIGwlUlMWe0uo0w9NA decTyQaOQ5xJb94nXvJJ65rVQTFcka0jbkT+3gH67HfzM8l2asoB1aczpLrmlSmIWtlm PZyQ== X-Gm-Message-State: AOAM533H+3aRwXS0u9+XsNTVKujWnlq74xeF2boX6Lsmv4McM8v3vzlY sPFFuMs7pMeoT3H200GvX6uclH9Ts7SSCLwYQ+lmug== X-Google-Smtp-Source: ABdhPJxakU5Mag9Ula6SSPel7HLGxlJn+QfaO6fBnfMigRAo4toXEmVoyMpiAlUqegtZnK4/34LGq+aXnPy6aoxbY/A= X-Received: by 2002:ac2:4d86:: with SMTP id g6mr20701148lfe.549.1627483465480; Wed, 28 Jul 2021 07:44:25 -0700 (PDT) MIME-Version: 1.0 References: <20210728091348.272714-1-wanghai38@huawei.com> In-Reply-To: From: Shakeel Butt Date: Wed, 28 Jul 2021 07:44:14 -0700 Message-ID: Subject: Re: [PATCH] mm/memcg: fix NULL pointer dereference in memcg_slab_free_hook() To: "wanghai (M)" Cc: Kefeng Wang , Michal Hocko , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Vlastimil Babka , Johannes Weiner , Alexei Starovoitov , Linux MM , LKML Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspamd-Server: rspam04 X-Rspamd-Queue-Id: 342AE6005981 Authentication-Results: imf10.hostedemail.com; dkim=pass header.d=google.com header.s=20161025 header.b=joZBLJq5; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf10.hostedemail.com: domain of shakeelb@google.com designates 209.85.167.47 as permitted sender) smtp.mailfrom=shakeelb@google.com X-Stat-Signature: qi9tydqe1w36m9ujgieod74j7rdi4b8g X-HE-Tag: 1627483467-938735 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, Jul 28, 2021 at 7:34 AM wanghai (M) wrote: > > > =E5=9C=A8 2021/7/28 22:26, Shakeel Butt =E5=86=99=E9=81=93: > > On Wed, Jul 28, 2021 at 7:21 AM Kefeng Wang wrote: > >> > >> On 2021/7/28 21:23, Michal Hocko wrote: > >>> On Wed 28-07-21 17:13:48, Wang Hai wrote: > >>>> When I use kfree_rcu() to free a large memory allocated by > >>>> kmalloc_node(), the following dump occurs. > >>>> > >>>> BUG: kernel NULL pointer dereference, address: 0000000000000020 > >>>> [...] > >>>> Oops: 0000 [#1] SMP > >>>> [...] > >>>> Workqueue: events kfree_rcu_work > >>>> RIP: 0010:__obj_to_index include/linux/slub_def.h:182 [inline] > >>>> RIP: 0010:obj_to_index include/linux/slub_def.h:191 [inline] > >>>> RIP: 0010:memcg_slab_free_hook+0x120/0x260 mm/slab.h:363 > >>>> [...] > >>>> Call Trace: > >>>> kmem_cache_free_bulk+0x58/0x630 mm/slub.c:3293 > >>>> kfree_bulk include/linux/slab.h:413 [inline] > >>>> kfree_rcu_work+0x1ab/0x200 kernel/rcu/tree.c:3300 > >>>> process_one_work+0x207/0x530 kernel/workqueue.c:2276 > >>>> worker_thread+0x320/0x610 kernel/workqueue.c:2422 > >>>> kthread+0x13d/0x160 kernel/kthread.c:313 > >>>> ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 > >>>> > >>>> When kmalloc_node() a large memory, page is allocated, not slab, > >>>> so when freeing memory via kfree_rcu(), this large memory should not > >>>> be used by memcg_slab_free_hook(), because memcg_slab_free_hook() is > >>>> is used for slab. > >>>> > >>>> So in this case, there is no need to do anything with this large > >>>> page in memcg_slab_free_hook(), just skip it. > >>>> > >>>> Fixes: 270c6a71460e ("mm: memcontrol/slab: Use helpers to access sla= b page's memcg_data") > >>> Are you sure that this commit is really breaking the code. Unless I h= ave > >> Yes, we confirmed that this commit introduces the bug. > >>> missed something there shouldn't be any real change wrt. large > >>> allocations here. page_has_obj_cgroups is just a different name for w= hat > >>> what page_objcgs is giving us. > >> maybe we could simply use page_objcgs_check to fix the issue ? we will > >> check it again. > > You will see the same crash with page_objcgs_check as well. > > . > > I just test it. It won't crash. > > This is the test case: > > node =3D kmalloc_node(299999, GFP_ATOMIC | __GFP_NOWARN | __GFP_ACCOUNT, = -1); > kfree_rcu(node, rcu); > Indeed it is checking MEMCG_DATA_OBJCGS directly. Yeah, we can use page_objcgs_check(). Please send a new version of the patch and do CC Roman.