From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753829AbaA3VOu (ORCPT ); Thu, 30 Jan 2014 16:14:50 -0500 Received: from mail-pd0-f178.google.com ([209.85.192.178]:54936 "EHLO mail-pd0-f178.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752930AbaA3VOs (ORCPT ); Thu, 30 Jan 2014 16:14:48 -0500 Date: Thu, 30 Jan 2014 13:14:46 -0800 (PST) From: David Rientjes X-X-Sender: rientjes@chino.kir.corp.google.com To: Andrew Morton cc: Vladimir Davydov , mhocko@suse.cz, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] memcg: fix mutex not unlocked on memcg_create_kmem_cache fail path In-Reply-To: <20140130130129.6f8bd7fd9da55d17a9338443@linux-foundation.org> Message-ID: References: <1391097693-31401-1-git-send-email-vdavydov@parallels.com> <20140130130129.6f8bd7fd9da55d17a9338443@linux-foundation.org> User-Agent: Alpine 2.02 (DEB 1266 2009-07-14) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, 30 Jan 2014, Andrew Morton wrote: > Well gee, how did that one get through? > > What was the point in permanently allocating tmp_name, btw? "This > static temporary buffer is used to prevent from pointless shortliving > allocation"? That's daft - memcg_create_kmem_cache() is not a fastpath > and there are a million places in the kernel where we could permanently > leak memory because it is "pointless" to allocate on demand. > > The allocation of PATH_MAX bytes is unfortunate - kasprintf() wouild > work well here, but cgroup_name()'s need for rcu_read_lock() screws us > up. > What's funnier is that tmp_name isn't required at all since kmem_cache_create_memcg() is just going to do a kstrdup() on it anyway, so you could easily just pass in the pointer to memory that has been allocated for s->name rather than allocating memory twice. > So how about doing this? > > From: Andrew Morton > Subject: mm/memcontrol.c: memcg_create_kmem_cache() tweaks > > Allocate tmp_name on demand rather than permanently consuming PATH_MAX > bytes of memory. This permits a small reduction in the mutex hold time as > well. > > Cc: Glauber Costa > Cc: Johannes Weiner > Cc: Michal Hocko > Cc: Vladimir Davydov > Signed-off-by: Andrew Morton > --- > > mm/memcontrol.c | 11 +++++------ > 1 file changed, 5 insertions(+), 6 deletions(-) > > diff -puN mm/memcontrol.c~mm-memcontrolc-memcg_create_kmem_cache-tweaks mm/memcontrol.c > --- a/mm/memcontrol.c~mm-memcontrolc-memcg_create_kmem_cache-tweaks > +++ a/mm/memcontrol.c > @@ -3401,17 +3401,14 @@ static struct kmem_cache *memcg_create_k > struct kmem_cache *s) > { > struct kmem_cache *new = NULL; > - static char *tmp_name = NULL; > + static char *tmp_name; You're keeping it static and the mutex so you're still keeping it global, ok... > static DEFINE_MUTEX(mutex); /* protects tmp_name */ > > BUG_ON(!memcg_can_account_kmem(memcg)); > > - mutex_lock(&mutex); > /* > - * kmem_cache_create_memcg duplicates the given name and > - * cgroup_name for this name requires RCU context. > - * This static temporary buffer is used to prevent from > - * pointless shortliving allocation. > + * kmem_cache_create_memcg duplicates the given name and cgroup_name() > + * for this name requires rcu_read_lock(). > */ > if (!tmp_name) { > tmp_name = kmalloc(PATH_MAX, GFP_KERNEL); Eek, memory leak. Two concurrent calls to memcg_create_kmem_cache() find !tmp_name and do the kmalloc() concurrently. > @@ -3419,6 +3416,7 @@ static struct kmem_cache *memcg_create_k > goto out; > } > > + mutex_lock(&mutex); > rcu_read_lock(); > snprintf(tmp_name, PATH_MAX, "%s(%d:%s)", s->name, > memcg_cache_id(memcg), cgroup_name(memcg->css.cgroup)); > @@ -3432,6 +3430,7 @@ static struct kmem_cache *memcg_create_k > new = s; > out: > mutex_unlock(&mutex); > + kfree(tmp_name); Why would we free the global buffer? > return new; > } >