Messages in this thread | | | Subject | Re: [PATCHv3] mm/slab: fix race with dereferencing NULL ptr in alloc_calls_show | From | Dmitry Safonov <> | Date | Wed, 3 Feb 2016 14:30:59 +0300 |
| |
On 02/03/2016 12:44 PM, Vladimir Davydov wrote: > On Wed, Feb 03, 2016 at 10:52:13AM +0300, Dmitry Safonov wrote: > ... >> diff --git a/mm/slab_common.c b/mm/slab_common.c >> index b50aef0..2bfc0b1 100644 >> --- a/mm/slab_common.c >> +++ b/mm/slab_common.c >> @@ -451,6 +451,8 @@ EXPORT_SYMBOL(kmem_cache_create); >> static int shutdown_cache(struct kmem_cache *s, >> struct list_head *release, bool *need_rcu_barrier) >> { >> + sysfs_slab_remove(s); >> + > shutdown_cache is called with slab_mutex held. slab_attr_store may take > the mutex. So placing sysfs_slab_remove here introduces a potential > deadlock. > >> if (__kmem_cache_shutdown(s) != 0) >> return -EBUSY; >> >> @@ -468,13 +470,8 @@ static void release_caches(struct list_head *release, bool need_rcu_barrier) >> if (need_rcu_barrier) >> rcu_barrier(); >> >> - list_for_each_entry_safe(s, s2, release, list) { >> -#ifdef SLAB_SUPPORTS_SYSFS >> - sysfs_slab_remove(s); >> -#else >> + list_for_each_entry_safe(s, s2, release, list) >> slab_kmem_cache_release(s); >> -#endif >> - } >> } >> >> #if defined(CONFIG_MEMCG) && !defined(CONFIG_SLOB) >> @@ -614,6 +611,7 @@ void memcg_destroy_kmem_caches(struct mem_cgroup *memcg) >> list_for_each_entry_safe(s, s2, &slab_caches, list) { >> if (is_root_cache(s) || s->memcg_params.memcg != memcg) >> continue; >> + > Please remove this hunk. > >> /* >> * The cgroup is about to be freed and therefore has no charges >> * left. Hence, all its caches must be empty by now. >> diff --git a/mm/slub.c b/mm/slub.c >> index 2e1355a..b6a68b7 100644 >> --- a/mm/slub.c >> +++ b/mm/slub.c >> @@ -5296,11 +5296,6 @@ static void memcg_propagate_slab_attrs(struct kmem_cache *s) >> #endif >> } >> >> -static void kmem_cache_release(struct kobject *k) >> -{ >> - slab_kmem_cache_release(to_slab(k)); >> -} >> - >> static const struct sysfs_ops slab_sysfs_ops = { >> .show = slab_attr_show, >> .store = slab_attr_store, >> @@ -5308,7 +5303,6 @@ static const struct sysfs_ops slab_sysfs_ops = { >> >> static struct kobj_type slab_ktype = { >> .sysfs_ops = &slab_sysfs_ops, >> - .release = kmem_cache_release, > I surmise this will resurrect the bug that was fixed by 41a212859a4dd > ("slub: use sysfs'es release mechanism for kmem_cache"). So, I move __kmem_cache_shutdown into slab_kmem_cache_release, release list will still be collected under slab_mutex. Seems like no other way to do this. Will resend mended version. > > Thanks, > Vladimir
-- Regards, Dmitry Safonov
| |