From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7816BC433F5 for ; Wed, 30 Mar 2022 19:46:11 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id D12376B0072; Wed, 30 Mar 2022 15:46:10 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id CC1D96B0073; Wed, 30 Mar 2022 15:46:10 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id BAFD08D0001; Wed, 30 Mar 2022 15:46:10 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (relay.hostedemail.com [64.99.140.26]) by kanga.kvack.org (Postfix) with ESMTP id A84556B0072 for ; Wed, 30 Mar 2022 15:46:10 -0400 (EDT) Received: from smtpin14.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id 6F62E21BE6 for ; Wed, 30 Mar 2022 19:46:10 +0000 (UTC) X-FDA: 79302083700.14.F274D07 Received: from out0.migadu.com (out0.migadu.com [94.23.1.103]) by imf25.hostedemail.com (Postfix) with ESMTP id BBF0DA000B for ; Wed, 30 Mar 2022 19:46:09 +0000 (UTC) Date: Wed, 30 Mar 2022 12:46:03 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1648669567; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=hae66Cb8VIx5SH/Gz0qCBX+AdOg7deV3Pdd2/H0Qa6I=; b=k46LoI2EORebN/s8HlnPjBPRRuJ68pY8pb47D5eWAq5uknpgBthhos/yMWK2hKBemqOnYs vyj6rOAPs3KYtk2/+Zm32WkEdR/jQ7PgqLsfnL2Iq5qJeNyCql1pG/6L2RPUVBxoIH2Xnv UnR+jfplx/WzAbUmnLDTv9D511JRKp8= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Roman Gushchin To: Waiman Long Cc: Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Muchun Song Subject: Re: [PATCH v2] mm/list_lru: Fix possible race in memcg_reparent_list_lru_node() Message-ID: References: <20220330172646.2687555-1-longman@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20220330172646.2687555-1-longman@redhat.com> X-Migadu-Flow: FLOW_OUT X-Migadu-Auth-User: linux.dev X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: BBF0DA000B X-Rspam-User: Authentication-Results: imf25.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=k46LoI2E; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf25.hostedemail.com: domain of roman.gushchin@linux.dev designates 94.23.1.103 as permitted sender) smtp.mailfrom=roman.gushchin@linux.dev X-Stat-Signature: dc3dbbokpz8agszmhdcejdyekh3tiefz X-HE-Tag: 1648669569-872971 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, Mar 30, 2022 at 01:26:46PM -0400, Waiman Long wrote: > Muchun Song found out there could be a race between list_lru_add() > and memcg_reparent_list_lru_node() causing the later function to miss > reparenting of a lru entry as shown below: > > CPU0: CPU1: > list_lru_add() > spin_lock(&nlru->lock) > l = list_lru_from_kmem(memcg) > memcg_reparent_objcgs(memcg) > memcg_reparent_list_lrus(memcg) > memcg_reparent_list_lru() > memcg_reparent_list_lru_node() > if (!READ_ONCE(nlru->nr_items)) > // Miss reparenting > return > // Assume 0->1 > l->nr_items++ > // Assume 0->1 > nlru->nr_items++ > > Though it is not likely that a list_lru_node that has 0 item suddenly > has a newly added lru entry at the end of its life. The race is still > theoretically possible. > > With the lock/unlock pair used within the percpu_ref_kill() which is > the last function call of memcg_reparent_objcgs(), any read issued > in memcg_reparent_list_lru_node() will not be reordered before the > reparenting of objcgs. > > Adding a !spin_is_locked()/smp_rmb()/!READ_ONCE(nlru->nr_items) check > to ensure that either the reading of nr_items is valid or the racing > list_lru_add() will see the reparented objcg. > > Fixes: 405cc51fc104 ("mm/list_lru: optimize memcg_reparent_list_lru_node()") > Reported-by: Muchun Song > Signed-off-by: Waiman Long Acked-by: Roman Gushchin