From: Eric Dumazet <edumazet@google.com>
To: Florian Westphal <fw@strlen.de>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>,
"Theodore Ts'o" <tytso@mit.edu>,
jack@suse.com, linux-ext4@vger.kernel.org,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Pablo Neira Ayuso <pablo@netfilter.org>,
Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>,
David Miller <davem@davemloft.net>,
netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
netdev <netdev@vger.kernel.org>,
Gerrit Renker <gerrit@erg.abdn.ac.uk>,
dccp@vger.kernel.org, jani.nikula@linux.intel.com,
joonas.lahtinen@linux.intel.com, rodrigo.vivi@intel.com,
airlied@linux.ie, intel-gfx@lists.freedesktop.org,
dri-devel@lists.freedesktop.org,
Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>,
Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
Ursula Braun <ubraun@linux.ibm.com>,
linux-s390@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>,
Dmitry Vyukov <dvyukov@google.com>,
Christoph Lameter <cl@linux.com>,
Andrew Morton <akpm@linux-foundation.org>,
linux-mm <linux-mm@kvack.org>,
Andrey Konovalov <andreyknvl@google.com>,
Linus Torvalds <torvalds@linux-foundation.org>
Subject: Re: SLAB_TYPESAFE_BY_RCU without constructors (was Re: [PATCH v4 13/17] khwasan: add hooks implementation)
Date: Tue, 31 Jul 2018 10:32:39 -0700 [thread overview]
Message-ID: <CANn89iLKwJ5oDfXu8M9z9_Xh0FKHFo961c_ocdUmHQc3Onmykw@mail.gmail.com> (raw)
In-Reply-To: <20180731170957.o4vhopmzgedpo5sh@breakpoint.cc>
On Tue, Jul 31, 2018 at 10:10 AM Florian Westphal <fw@strlen.de> wrote:
>
> Andrey Ryabinin <aryabinin@virtuozzo.com> wrote:
> > Guys, it seems that we have a lot of code using SLAB_TYPESAFE_BY_RCU cache without constructor.
> > I think it's nearly impossible to use that combination without having bugs.
> > It's either you don't really need the SLAB_TYPESAFE_BY_RCU, or you need to have a constructor in kmem_cache.
> >
> > Could you guys, please, verify your code if it's really need SLAB_TYPSAFE or constructor?
> >
> > E.g. the netlink code look extremely suspicious:
> >
> > /*
> > * Do not use kmem_cache_zalloc(), as this cache uses
> > * SLAB_TYPESAFE_BY_RCU.
> > */
> > ct = kmem_cache_alloc(nf_conntrack_cachep, gfp);
> > if (ct == NULL)
> > goto out;
> >
> > spin_lock_init(&ct->lock);
> >
> > If nf_conntrack_cachep objects really used in rcu typesafe manner, than 'ct' returned by kmem_cache_alloc might still be
> > in use by another cpu. So we just reinitialize spin_lock used by someone else?
>
> That would be a bug, nf_conn objects are reference counted.
>
> spinlock can only be used after object had its refcount incremented.
>
> lookup operation on nf_conn object:
> 1. compare keys
> 2. attempt to obtain refcount (using _not_zero version)
> 3. compare keys again after refcount was obtained
>
> if any of that fails, nf_conn candidate is skipped.
Yes, the key here is the refcount, this is only what we need to clear
after kmem_cache_alloc()
By definition, if an object is being freed/reallocated, the refcount
should be already 0, and clearing it again is a NOP.
next prev parent reply other threads:[~2018-07-31 17:32 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-31 17:01 SLAB_TYPESAFE_BY_RCU without constructors (was Re: [PATCH v4 13/17] khwasan: add hooks implementation) Andrey Ryabinin
2018-07-31 17:09 ` Florian Westphal
2018-07-31 17:32 ` Eric Dumazet [this message]
2018-07-31 17:36 ` Christopher Lameter
2018-07-31 17:41 ` Eric Dumazet
2018-07-31 17:51 ` Dmitry Vyukov
2018-07-31 18:16 ` Eric Dumazet
2018-07-31 17:49 ` Linus Torvalds
2018-07-31 18:51 ` Linus Torvalds
2018-08-01 8:46 ` Dmitry Vyukov
2018-08-01 9:10 ` Dmitry Vyukov
2018-08-01 10:35 ` Florian Westphal
2018-08-01 10:41 ` Dmitry Vyukov
2018-08-01 11:40 ` Florian Westphal
2018-08-01 12:38 ` Dmitry Vyukov
2018-08-01 13:46 ` Florian Westphal
2018-08-01 13:52 ` Dmitry Vyukov
2018-08-06 20:20 ` Jan Kara
2018-08-01 9:03 ` Andrey Ryabinin
2018-08-01 10:23 ` Eric Dumazet
2018-08-01 10:34 ` Dmitry Vyukov
2018-08-01 11:28 ` Eric Dumazet
2018-08-01 11:35 ` Dmitry Vyukov
2018-08-01 15:15 ` Christopher Lameter
2018-08-01 15:37 ` Eric Dumazet
2018-08-01 15:51 ` Misuse of constructors Matthew Wilcox
2018-08-01 15:53 ` SLAB_TYPESAFE_BY_RCU without constructors (was Re: [PATCH v4 13/17] khwasan: add hooks implementation) Dmitry Vyukov
2018-08-01 16:22 ` Christopher Lameter
2018-08-01 16:25 ` Eric Dumazet
2018-08-01 16:47 ` Dmitry Vyukov
2018-08-01 17:18 ` Eric Dumazet
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CANn89iLKwJ5oDfXu8M9z9_Xh0FKHFo961c_ocdUmHQc3Onmykw@mail.gmail.com \
--to=edumazet@google.com \
--cc=airlied@linux.ie \
--cc=akpm@linux-foundation.org \
--cc=andreyknvl@google.com \
--cc=aryabinin@virtuozzo.com \
--cc=cl@linux.com \
--cc=coreteam@netfilter.org \
--cc=davem@davemloft.net \
--cc=dccp@vger.kernel.org \
--cc=dri-devel@lists.freedesktop.org \
--cc=dvyukov@google.com \
--cc=fw@strlen.de \
--cc=gerrit@erg.abdn.ac.uk \
--cc=gregkh@linuxfoundation.org \
--cc=intel-gfx@lists.freedesktop.org \
--cc=jack@suse.com \
--cc=jani.nikula@linux.intel.com \
--cc=joonas.lahtinen@linux.intel.com \
--cc=kadlec@blackhole.kfki.hu \
--cc=kuznet@ms2.inr.ac.ru \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux-s390@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=rodrigo.vivi@intel.com \
--cc=torvalds@linux-foundation.org \
--cc=tytso@mit.edu \
--cc=ubraun@linux.ibm.com \
--cc=yoshfuji@linux-ipv6.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).