Re: [PATCHv3] mm/slab: fix race with dereferencing NULL ptr in alloc_calls_show

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 02/03/2016 12:44 PM, Vladimir Davydov wrote:
On Wed, Feb 03, 2016 at 10:52:13AM +0300, Dmitry Safonov wrote:
...
diff --git a/mm/slab_common.c b/mm/slab_common.c
index b50aef0..2bfc0b1 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -451,6 +451,8 @@ EXPORT_SYMBOL(kmem_cache_create);
  static int shutdown_cache(struct kmem_cache *s,
  		struct list_head *release, bool *need_rcu_barrier)
  {
+	sysfs_slab_remove(s);
+
shutdown_cache is called with slab_mutex held. slab_attr_store may take
the mutex. So placing sysfs_slab_remove here introduces a potential
deadlock.

  	if (__kmem_cache_shutdown(s) != 0)
  		return -EBUSY;
@@ -468,13 +470,8 @@ static void release_caches(struct list_head *release, bool need_rcu_barrier)
  	if (need_rcu_barrier)
  		rcu_barrier();
- list_for_each_entry_safe(s, s2, release, list) {
-#ifdef SLAB_SUPPORTS_SYSFS
-		sysfs_slab_remove(s);
-#else
+	list_for_each_entry_safe(s, s2, release, list)
  		slab_kmem_cache_release(s);
-#endif
-	}
  }
#if defined(CONFIG_MEMCG) && !defined(CONFIG_SLOB)
@@ -614,6 +611,7 @@ void memcg_destroy_kmem_caches(struct mem_cgroup *memcg)
  	list_for_each_entry_safe(s, s2, &slab_caches, list) {
  		if (is_root_cache(s) || s->memcg_params.memcg != memcg)
  			continue;
+
Please remove this hunk.

  		/*
  		 * The cgroup is about to be freed and therefore has no charges
  		 * left. Hence, all its caches must be empty by now.
diff --git a/mm/slub.c b/mm/slub.c
index 2e1355a..b6a68b7 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -5296,11 +5296,6 @@ static void memcg_propagate_slab_attrs(struct kmem_cache *s)
  #endif
  }
-static void kmem_cache_release(struct kobject *k)
-{
-	slab_kmem_cache_release(to_slab(k));
-}
-
  static const struct sysfs_ops slab_sysfs_ops = {
  	.show = slab_attr_show,
  	.store = slab_attr_store,
@@ -5308,7 +5303,6 @@ static const struct sysfs_ops slab_sysfs_ops = {
static struct kobj_type slab_ktype = {
  	.sysfs_ops = &slab_sysfs_ops,
-	.release = kmem_cache_release,
I surmise this will resurrect the bug that was fixed by 41a212859a4dd
("slub: use sysfs'es release mechanism for kmem_cache").
So, I move __kmem_cache_shutdown into slab_kmem_cache_release,
release list will still be collected under slab_mutex.
Seems like no other way to do this.
Will resend mended version.

Thanks,
Vladimir


--
Regards,
Dmitry Safonov

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@xxxxxxxxx.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>



[Index of Archives]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Bugtraq]     [Linux]     [Linux OMAP]     [Linux MIPS]     [ECOS]     [Asterisk Internet PBX]     [Linux API]