From: David Rientjes <rientjes@google.com>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: Vladimir Davydov <vdavydov@parallels.com>,
mhocko@suse.cz, linux-mm@kvack.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] memcg: fix mutex not unlocked on memcg_create_kmem_cache fail path
Date: Thu, 30 Jan 2014 13:14:46 -0800 (PST) [thread overview]
Message-ID: <alpine.DEB.2.02.1401301310270.15271@chino.kir.corp.google.com> (raw)
In-Reply-To: <20140130130129.6f8bd7fd9da55d17a9338443@linux-foundation.org>
On Thu, 30 Jan 2014, Andrew Morton wrote:
> Well gee, how did that one get through?
>
> What was the point in permanently allocating tmp_name, btw? "This
> static temporary buffer is used to prevent from pointless shortliving
> allocation"? That's daft - memcg_create_kmem_cache() is not a fastpath
> and there are a million places in the kernel where we could permanently
> leak memory because it is "pointless" to allocate on demand.
>
> The allocation of PATH_MAX bytes is unfortunate - kasprintf() wouild
> work well here, but cgroup_name()'s need for rcu_read_lock() screws us
> up.
>
What's funnier is that tmp_name isn't required at all since
kmem_cache_create_memcg() is just going to do a kstrdup() on it anyway, so
you could easily just pass in the pointer to memory that has been
allocated for s->name rather than allocating memory twice.
> So how about doing this?
>
> From: Andrew Morton <akpm@linux-foundation.org>
> Subject: mm/memcontrol.c: memcg_create_kmem_cache() tweaks
>
> Allocate tmp_name on demand rather than permanently consuming PATH_MAX
> bytes of memory. This permits a small reduction in the mutex hold time as
> well.
>
> Cc: Glauber Costa <glommer@parallels.com>
> Cc: Johannes Weiner <hannes@cmpxchg.org>
> Cc: Michal Hocko <mhocko@suse.cz>
> Cc: Vladimir Davydov <vdavydov@parallels.com>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> ---
>
> mm/memcontrol.c | 11 +++++------
> 1 file changed, 5 insertions(+), 6 deletions(-)
>
> diff -puN mm/memcontrol.c~mm-memcontrolc-memcg_create_kmem_cache-tweaks mm/memcontrol.c
> --- a/mm/memcontrol.c~mm-memcontrolc-memcg_create_kmem_cache-tweaks
> +++ a/mm/memcontrol.c
> @@ -3401,17 +3401,14 @@ static struct kmem_cache *memcg_create_k
> struct kmem_cache *s)
> {
> struct kmem_cache *new = NULL;
> - static char *tmp_name = NULL;
> + static char *tmp_name;
You're keeping it static and the mutex so you're still keeping it global,
ok...
> static DEFINE_MUTEX(mutex); /* protects tmp_name */
>
> BUG_ON(!memcg_can_account_kmem(memcg));
>
> - mutex_lock(&mutex);
> /*
> - * kmem_cache_create_memcg duplicates the given name and
> - * cgroup_name for this name requires RCU context.
> - * This static temporary buffer is used to prevent from
> - * pointless shortliving allocation.
> + * kmem_cache_create_memcg duplicates the given name and cgroup_name()
> + * for this name requires rcu_read_lock().
> */
> if (!tmp_name) {
> tmp_name = kmalloc(PATH_MAX, GFP_KERNEL);
Eek, memory leak. Two concurrent calls to memcg_create_kmem_cache() find
!tmp_name and do the kmalloc() concurrently.
> @@ -3419,6 +3416,7 @@ static struct kmem_cache *memcg_create_k
> goto out;
> }
>
> + mutex_lock(&mutex);
> rcu_read_lock();
> snprintf(tmp_name, PATH_MAX, "%s(%d:%s)", s->name,
> memcg_cache_id(memcg), cgroup_name(memcg->css.cgroup));
> @@ -3432,6 +3430,7 @@ static struct kmem_cache *memcg_create_k
> new = s;
> out:
> mutex_unlock(&mutex);
> + kfree(tmp_name);
Why would we free the global buffer?
> return new;
> }
>
next prev parent reply other threads:[~2014-01-30 21:14 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-01-30 16:01 [PATCH] memcg: fix mutex not unlocked on memcg_create_kmem_cache fail path Vladimir Davydov
2014-01-30 21:01 ` Andrew Morton
2014-01-30 21:14 ` David Rientjes [this message]
2014-01-30 21:29 ` Andrew Morton
2014-01-30 21:38 ` David Rientjes
2014-01-30 21:50 ` Andrew Morton
2014-01-30 22:04 ` David Rientjes
2014-01-30 22:09 ` Andrew Morton
2014-01-30 22:13 ` David Rientjes
2014-01-30 22:15 ` Andrew Morton
2014-01-30 22:39 ` David Rientjes
2014-01-31 6:53 ` Vladimir Davydov
2014-01-31 10:42 ` David Rientjes
2014-01-31 11:29 ` Vladimir Davydov
2014-01-30 21:36 ` David Rientjes
2014-01-30 21:09 ` David Rientjes
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.DEB.2.02.1401301310270.15271@chino.kir.corp.google.com \
--to=rientjes@google.com \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mhocko@suse.cz \
--cc=vdavydov@parallels.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).