From: Christopher Lameter <cl@linux.com>
To: Yu Zhao <yuzhao@google.com>
Cc: Pekka Enberg <penberg@kernel.org>,
David Rientjes <rientjes@google.com>,
Joonsoo Kim <iamjoonsoo.kim@lge.com>,
Andrew Morton <akpm@linux-foundation.org>,
"Kirill A . Shutemov" <kirill@shutemov.name>,
Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>,
linux-mm@kvack.org, linux-kernel@vger.kernel.org,
"Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>
Subject: [FIX] slub: Remove kmalloc under list_lock from list_slab_objects() V2
Date: Mon, 11 Nov 2019 15:55:05 +0000 (UTC) [thread overview]
Message-ID: <alpine.DEB.2.21.1911111553020.15366@www.lameter.com> (raw)
In-Reply-To: <alpine.DEB.2.21.1911111543420.10669@www.lameter.com>
Regardless of the issue with memcgs allowing allocations from its
kmalloc array during shutdown: This patch cleans things up and properly
allocates the bitmap outside of the list_lock.
[FIX] slub: Remove kmalloc under list_lock from list_slab_objects() V2
V1->V2 : Properly handle CONFIG_SLUB_DEBUG. Handle bitmap free correctly.
list_slab_objects() is called when a slab is destroyed and there are objects still left
to list the objects in the syslog. This is a pretty rare event.
And there it seems we take the list_lock and call kmalloc while holding that lock.
Perform the allocation in free_partial() before the list_lock is taken.
Fixes: bbd7d57bfe852d9788bae5fb171c7edb4021d8ac ("slub: Potential stack overflow")
Signed-off-by: Christoph Lameter
Index: linux/mm/slub.c
===================================================================
--- linux.orig/mm/slub.c 2019-10-15 13:54:57.032655296 +0000
+++ linux/mm/slub.c 2019-11-11 15:52:11.616397853 +0000
@@ -3690,14 +3690,15 @@ error:
}
static void list_slab_objects(struct kmem_cache *s, struct page *page,
- const char *text)
+ const char *text, unsigned long *map)
{
#ifdef CONFIG_SLUB_DEBUG
void *addr = page_address(page);
void *p;
- unsigned long *map = bitmap_zalloc(page->objects, GFP_ATOMIC);
+
if (!map)
return;
+
slab_err(s, page, text, s->name);
slab_lock(page);
@@ -3710,7 +3711,6 @@ static void list_slab_objects(struct kme
}
}
slab_unlock(page);
- bitmap_free(map);
#endif
}
@@ -3723,6 +3723,11 @@ static void free_partial(struct kmem_cac
{
LIST_HEAD(discard);
struct page *page, *h;
+ unsigned long *map = NULL;
+
+#ifdef CONFIG_SLUB_DEBUG
+ map = bitmap_alloc(oo_objects(s->max), GFP_KERNEL);
+#endif
BUG_ON(irqs_disabled());
spin_lock_irq(&n->list_lock);
@@ -3732,11 +3737,16 @@ static void free_partial(struct kmem_cac
list_add(&page->slab_list, &discard);
} else {
list_slab_objects(s, page,
- "Objects remaining in %s on __kmem_cache_shutdown()");
+ "Objects remaining in %s on __kmem_cache_shutdown()",
+ map);
}
}
spin_unlock_irq(&n->list_lock);
+#ifdef CONFIG_SLUB_DEBUG
+ bitmap_free(map);
+#endif
+
list_for_each_entry_safe(page, h, &discard, slab_list)
discard_slab(s, page);
}
next prev parent reply other threads:[~2019-11-11 15:55 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-09 6:10 [PATCH] mm: avoid slub allocation while holding list_lock Yu Zhao
2019-09-09 16:00 ` Kirill A. Shutemov
2019-09-09 20:57 ` Tetsuo Handa
2019-09-09 21:39 ` Yu Zhao
2019-09-10 1:41 ` Tetsuo Handa
2019-09-10 2:16 ` Yu Zhao
2019-09-10 9:16 ` Kirill A. Shutemov
2019-09-11 14:13 ` Andrew Morton
2019-09-12 0:29 ` [PATCH 1/3] mm: correct mask size for slub page->objects Yu Zhao
2019-09-12 0:29 ` [PATCH 2/3] mm: avoid slub allocation while holding list_lock Yu Zhao
2019-09-12 0:44 ` Kirill A. Shutemov
2019-09-12 1:31 ` Yu Zhao
2019-09-12 2:31 ` [PATCH v2 1/4] mm: correct mask size for slub page->objects Yu Zhao
2019-09-12 2:31 ` [PATCH v2 2/4] mm: clean up validate_slab() Yu Zhao
2019-09-12 9:46 ` Kirill A. Shutemov
2019-09-12 2:31 ` [PATCH v2 3/4] mm: avoid slub allocation while holding list_lock Yu Zhao
2019-09-12 10:04 ` Kirill A. Shutemov
2019-09-12 2:31 ` [PATCH v2 4/4] mm: lock slub page when listing objects Yu Zhao
2019-09-12 10:06 ` Kirill A. Shutemov
2019-09-12 21:12 ` Yu Zhao
2019-09-13 14:58 ` Christopher Lameter
2019-09-12 9:40 ` [PATCH v2 1/4] mm: correct mask size for slub page->objects Kirill A. Shutemov
2019-09-12 21:11 ` Yu Zhao
2019-09-12 22:03 ` Kirill A. Shutemov
2019-09-14 0:07 ` [PATCH v3 1/2] mm: clean up validate_slab() Yu Zhao
2019-09-14 0:07 ` [PATCH v3 2/2] mm: avoid slub allocation while holding list_lock Yu Zhao
2019-09-16 8:39 ` [PATCH v3 1/2] mm: clean up validate_slab() Kirill A. Shutemov
2019-11-08 19:39 ` [PATCH v4 " Yu Zhao
2019-11-08 19:39 ` [PATCH v4 2/2] mm: avoid slub allocation while holding list_lock Yu Zhao
2019-11-09 20:52 ` Christopher Lameter
2019-11-09 23:01 ` Yu Zhao
2019-11-09 23:16 ` Christopher Lameter
2019-11-10 18:47 ` Yu Zhao
2019-11-11 15:47 ` Christopher Lameter
2019-11-11 15:55 ` Christopher Lameter [this message]
2019-11-30 23:09 ` [FIX] slub: Remove kmalloc under list_lock from list_slab_objects() V2 Andrew Morton
2019-12-01 1:17 ` Tetsuo Handa
2019-12-02 15:12 ` Christopher Lameter
2019-12-07 22:03 ` Yu Zhao
2020-01-10 14:11 ` Vlastimil Babka
2020-01-12 11:03 ` Tetsuo Handa
2020-01-13 1:34 ` Christopher Lameter
2019-11-11 18:15 ` [PATCH v4 2/2] mm: avoid slub allocation while holding list_lock Shakeel Butt
2019-09-12 0:29 ` [PATCH 3/3] mm: lock slub page when listing objects Yu Zhao
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.DEB.2.21.1911111553020.15366@www.lameter.com \
--to=cl@linux.com \
--cc=akpm@linux-foundation.org \
--cc=iamjoonsoo.kim@lge.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=kirill@shutemov.name \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=penberg@kernel.org \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=rientjes@google.com \
--cc=yuzhao@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).