On Wed, 12 Jul 2017 16:11:28 +0200 Alexander Potapenko <glider@xxxxxxxxxx> wrote: > >> At creation time the kmem_cache structure is private and no one can run a > >> free operation. > I've double-checked the code path and this turned out to be a false > positive caused by KMSAN not instrumenting the contents of mm/slub.c > (i.e. the initialization of the spinlock remained unnoticed). > Christoph is indeed right that kmem_cache_structure is private, so a > race is not possible here. > I am sorry for the false alarm. > >> > Inviting a use-after-free? I guess not, as there should be no way > >> > to look up these items at this stage. > >> > >> Right. > > > > Still. It looks bad, and other sites do these things in the other order. > If the maintainers agree the initialization order needs to be fixed, > we'll need to remove the (irrelevant) KMSAN report from the patch > description. Yup. I did this: From: Alexander Potapenko <glider@xxxxxxxxxx> Subject: slub: tidy up initialization ordering - free_kmem_cache_nodes() frees the cache node before nulling out a reference to it - init_kmem_cache_nodes() publishes the cache node before initializing it Neither of these matter at runtime because the cache nodes cannot be looked up by any other thread. But it's neater and more consistent to reorder these. Link: http://lkml.kernel.org/r/20170707083408.40410-1-glider@xxxxxxxxxx Signed-off-by: Alexander Potapenko <glider@xxxxxxxxxx> Cc: Christoph Lameter <cl@xxxxxxxxx> Cc: Pekka Enberg <penberg@xxxxxxxxxx> Cc: David Rientjes <rientjes@xxxxxxxxxx> Cc: Joonsoo Kim <iamjoonsoo.kim@xxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- mm/slub.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff -puN mm/slub.c~slub-make-sure-struct-kmem_cache_node-is-initialized-before-publication mm/slub.c --- a/mm/slub.c~slub-make-sure-struct-kmem_cache_node-is-initialized-before-publication +++ a/mm/slub.c @@ -3358,8 +3358,8 @@ static void free_kmem_cache_nodes(struct struct kmem_cache_node *n; for_each_kmem_cache_node(s, node, n) { - kmem_cache_free(kmem_cache_node, n); s->node[node] = NULL; + kmem_cache_free(kmem_cache_node, n); } } @@ -3389,8 +3389,8 @@ static int init_kmem_cache_nodes(struct return 0; } - s->node[node] = n; init_kmem_cache_node(n); + s->node[node] = n; } return 1; } _ -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>
