[lkml]   [2017]   [Jun]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH 4.4 35/53] slub/memcg: cure the brainless abuse of sysfs attributes
4.4-stable review patch.  If anyone has any objections, please let me know.


From: Thomas Gleixner <>

commit 478fe3037b2278d276d4cd9cd0ab06c4cb2e9b32 upstream.

memcg_propagate_slab_attrs() abuses the sysfs attribute file functions
to propagate settings from the root kmem_cache to a newly created
kmem_cache. It does that with:

attr->show(root, buf);
attr->store(new, buf, strlen(bug);

Aside of being a lazy and absurd hackery this is broken because it does
not check the return value of the show() function.

Some of the show() functions return 0 w/o touching the buffer. That
means in such a case the store function is called with the stale content
of the previous show(). That causes nonsense like invoking
kmem_cache_shrink() on a newly created kmem_cache. In the worst case it
would cause handing in an uninitialized buffer.

This should be rewritten proper by adding a propagate() callback to
those slub_attributes which must be propagated and avoid that insane
conversion to and from ASCII, but that's too large for a hot fix.

Check at least the return value of the show() function, so calling
store() with stale content is prevented.

Steven said:
"It can cause a deadlock with get_online_cpus() that has been uncovered
by recent cpu hotplug and lockdep changes that Thomas and Peter have
been doing.

Possible unsafe locking scenario:

---- ----

*** DEADLOCK ***"

Signed-off-by: Thomas Gleixner <>
Reported-by: Steven Rostedt <>
Acked-by: David Rientjes <>
Cc: Johannes Weiner <>
Cc: Michal Hocko <>
Cc: Peter Zijlstra <>
Cc: Christoph Lameter <>
Cc: Pekka Enberg <>
Cc: Joonsoo Kim <>
Cc: Christoph Hellwig <>
Signed-off-by: Andrew Morton <>
Signed-off-by: Linus Torvalds <>
Signed-off-by: Greg Kroah-Hartman <>

mm/slub.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)

--- a/mm/slub.c
+++ b/mm/slub.c
@@ -5261,6 +5261,7 @@ static void memcg_propagate_slab_attrs(s
char mbuf[64];
char *buf;
struct slab_attribute *attr = to_slab_attr(slab_attrs[i]);
+ ssize_t len;

if (!attr || !attr->store || !attr->show)
@@ -5285,8 +5286,9 @@ static void memcg_propagate_slab_attrs(s
buf = buffer;

- attr->show(root_cache, buf);
- attr->store(s, buf, strlen(buf));
+ len = attr->show(root_cache, buf);
+ if (len > 0)
+ attr->store(s, buf, len);

if (buffer)

 \ /
  Last update: 2017-06-12 00:30    [W:0.135 / U:0.664 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site