From: Dmitry Safonov <dsafonov@virtuozzo.com>
To: Vladimir Davydov <vdavydov@virtuozzo.com>
Cc: <akpm@linux-foundation.org>, <cl@linux.com>, <penberg@kernel.org>,
<rientjes@google.com>, <iamjoonsoo.kim@lge.com>,
<linux-mm@kvack.org>, <linux-kernel@vger.kernel.org>,
<0x7f454c46@gmail.com>
Subject: Re: [PATCHv3] mm/slab: fix race with dereferencing NULL ptr in alloc_calls_show
Date: Wed, 3 Feb 2016 14:30:59 +0300 [thread overview]
Message-ID: <56B1E4F3.5050806@virtuozzo.com> (raw)
In-Reply-To: <20160203094420.GH21016@esperanza>
On 02/03/2016 12:44 PM, Vladimir Davydov wrote:
> On Wed, Feb 03, 2016 at 10:52:13AM +0300, Dmitry Safonov wrote:
> ...
>> diff --git a/mm/slab_common.c b/mm/slab_common.c
>> index b50aef0..2bfc0b1 100644
>> --- a/mm/slab_common.c
>> +++ b/mm/slab_common.c
>> @@ -451,6 +451,8 @@ EXPORT_SYMBOL(kmem_cache_create);
>> static int shutdown_cache(struct kmem_cache *s,
>> struct list_head *release, bool *need_rcu_barrier)
>> {
>> + sysfs_slab_remove(s);
>> +
> shutdown_cache is called with slab_mutex held. slab_attr_store may take
> the mutex. So placing sysfs_slab_remove here introduces a potential
> deadlock.
>
>> if (__kmem_cache_shutdown(s) != 0)
>> return -EBUSY;
>>
>> @@ -468,13 +470,8 @@ static void release_caches(struct list_head *release, bool need_rcu_barrier)
>> if (need_rcu_barrier)
>> rcu_barrier();
>>
>> - list_for_each_entry_safe(s, s2, release, list) {
>> -#ifdef SLAB_SUPPORTS_SYSFS
>> - sysfs_slab_remove(s);
>> -#else
>> + list_for_each_entry_safe(s, s2, release, list)
>> slab_kmem_cache_release(s);
>> -#endif
>> - }
>> }
>>
>> #if defined(CONFIG_MEMCG) && !defined(CONFIG_SLOB)
>> @@ -614,6 +611,7 @@ void memcg_destroy_kmem_caches(struct mem_cgroup *memcg)
>> list_for_each_entry_safe(s, s2, &slab_caches, list) {
>> if (is_root_cache(s) || s->memcg_params.memcg != memcg)
>> continue;
>> +
> Please remove this hunk.
>
>> /*
>> * The cgroup is about to be freed and therefore has no charges
>> * left. Hence, all its caches must be empty by now.
>> diff --git a/mm/slub.c b/mm/slub.c
>> index 2e1355a..b6a68b7 100644
>> --- a/mm/slub.c
>> +++ b/mm/slub.c
>> @@ -5296,11 +5296,6 @@ static void memcg_propagate_slab_attrs(struct kmem_cache *s)
>> #endif
>> }
>>
>> -static void kmem_cache_release(struct kobject *k)
>> -{
>> - slab_kmem_cache_release(to_slab(k));
>> -}
>> -
>> static const struct sysfs_ops slab_sysfs_ops = {
>> .show = slab_attr_show,
>> .store = slab_attr_store,
>> @@ -5308,7 +5303,6 @@ static const struct sysfs_ops slab_sysfs_ops = {
>>
>> static struct kobj_type slab_ktype = {
>> .sysfs_ops = &slab_sysfs_ops,
>> - .release = kmem_cache_release,
> I surmise this will resurrect the bug that was fixed by 41a212859a4dd
> ("slub: use sysfs'es release mechanism for kmem_cache").
So, I move __kmem_cache_shutdown into slab_kmem_cache_release,
release list will still be collected under slab_mutex.
Seems like no other way to do this.
Will resend mended version.
>
> Thanks,
> Vladimir
--
Regards,
Dmitry Safonov
prev parent reply other threads:[~2016-02-03 11:31 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-03 7:52 [PATCHv3] mm/slab: fix race with dereferencing NULL ptr in alloc_calls_show Dmitry Safonov
2016-02-03 9:44 ` Vladimir Davydov
2016-02-03 11:30 ` Dmitry Safonov [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56B1E4F3.5050806@virtuozzo.com \
--to=dsafonov@virtuozzo.com \
--cc=0x7f454c46@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=cl@linux.com \
--cc=iamjoonsoo.kim@lge.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=penberg@kernel.org \
--cc=rientjes@google.com \
--cc=vdavydov@virtuozzo.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).