From patchwork Sat Sep 26 14:13:41 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Shakeel Butt X-Patchwork-Id: 11801499 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 8BA666CA for ; Sat, 26 Sep 2020 14:14:10 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 25AA4221E5 for ; Sat, 26 Sep 2020 14:14:09 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=google.com header.i=@google.com header.b="BgE/DG1K" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 25AA4221E5 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 0831A6B005C; Sat, 26 Sep 2020 10:14:09 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 0324A6B005D; Sat, 26 Sep 2020 10:14:08 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id E8AEC6B0068; Sat, 26 Sep 2020 10:14:08 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0115.hostedemail.com [216.40.44.115]) by kanga.kvack.org (Postfix) with ESMTP id D2B226B005C for ; Sat, 26 Sep 2020 10:14:08 -0400 (EDT) Received: from smtpin16.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id 912471DED for ; Sat, 26 Sep 2020 14:14:08 +0000 (UTC) X-FDA: 77305406976.16.worm44_2c102e927170 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin16.hostedemail.com (Postfix) with ESMTP id 6C5FF101EA7D4 for ; Sat, 26 Sep 2020 14:14:08 +0000 (UTC) X-Spam-Summary: 1,0,0,ac2b3152ef697333,d41d8cd98f00b204,3rkxvxwgkcaczohrllsinvvnsl.jvtspu14-ttr2hjr.vyn@flex--shakeelb.bounces.google.com,,RULES_HIT:41:152:355:379:541:800:960:965:966:973:988:989:1260:1277:1313:1314:1345:1437:1516:1518:1535:1542:1593:1594:1711:1730:1747:1777:1792:2196:2199:2393:2553:2559:2562:2895:3138:3139:3140:3141:3142:3152:3353:3865:3866:3867:3868:3872:4250:4385:4390:4395:5007:6261:6653:6742:8603:8660:9010:9969:10004:10400:11026:11658:11914:12043:12296:12297:12555:12679:12895:13148:13161:13221:13229:13230:14181:14394:14659:14721:21080:21444:21451:21611:21627:21939:30054:30064:30070:30090,0,RBL:209.85.210.202:@flex--shakeelb.bounces.google.com:.lbl8.mailshell.net-66.100.201.100 62.18.0.100;04yg6dwdk7rnyctjecnb6kz4xj98poc5ntj7ncnd8e4mpwf5wopqjxw5ypnz3ga.a6netphdcpsi5q79bsrfbpoohr619jdctf179jybiioed5ipepb114dhyjixwuk.k-lbl8.mailshell.net-223.238.255.100,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fp,MSBL:0,DNSBL:none,Custom _rules:0 X-HE-Tag: worm44_2c102e927170 X-Filterd-Recvd-Size: 5231 Received: from mail-pf1-f202.google.com (mail-pf1-f202.google.com [209.85.210.202]) by imf10.hostedemail.com (Postfix) with ESMTP for ; Sat, 26 Sep 2020 14:14:08 +0000 (UTC) Received: by mail-pf1-f202.google.com with SMTP id y76so4513699pfb.10 for ; Sat, 26 Sep 2020 07:14:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=sender:date:message-id:mime-version:subject:from:to:cc; bh=m/uDDlgpBgXWW89xazDHWjz3boz0toRZLi7D2ESN7XU=; b=BgE/DG1KpovclMjH/nTyDFh0Pcc7770NEJg1GXpBCY8DWnT2MQJTbbknkYr5PCPPqh oUepBgYmeWNUs1Ug1BSEDn99PRdALVsQcAjW4Cywni4dFvrvLR4kF4xNedDEEePVeNgQ kFjo9wMXms2AKceIKndrDMYOxX0o4qb8IRtRXCDsnTNt3gv0cGQrNEgus5WOUp0X2a0P 4gNszvDQ1WF1sDWi4o8np+s3NNZ6ax7WIqldys9kchvWOFgH3waBfWDKLmBhoe4sZPLN 1zkXZyTxfL4sEx4c5VxvVPTjoN8taF8UfEzvvaHrDyjbEWtQCD7slnhYCV6KsZzbmwpb KSDg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:date:message-id:mime-version:subject:from :to:cc; bh=m/uDDlgpBgXWW89xazDHWjz3boz0toRZLi7D2ESN7XU=; b=oMYr/apoZ2bmHB9xmcIrPo5gzWgbxtXYdOFk7eRKq22p4tW/ePYrCFua6ojHXgwo83 P6CVSTFLq5OTwY0oqsjkU6MOxT9fABja/XJdU5QNWAnHaKWeLCZ9flmpZqOoFYcYWSAB SC3vY4atJFVPNOuUhxxJR+hMPMd059RtpdQPhCULUyBe44fPwU/FHQkyuMu0x3cuU4sH W0fTh/H6GWyC0pbxJu6tUwX7Fzy0NSSwskdG4ItiO6ilr8+r3vpgqOif/g2NpsYxCzuh bwOTAQ27ha8g8stCXXt69/9v82Dw8/qep5Bl7Q1l5z3dwURCrlJ+Vp225wbZj60dZiVW RMGA== X-Gm-Message-State: AOAM530SUV/WeMB+MxZNR5SA8lGJBg6M0qjcElnty8WZHNBjsJGW04wx 5P/FxXlEuW1XoVwWSIl9Y+SjKXO/esf76g== X-Google-Smtp-Source: ABdhPJwjnrF1UPRWbzIMd9eg+ICsfjh1JD/aM1fOQp8CRlWO1qsSKd+RnRtXepsbMut5ZHm26nKmH3jvVjQOvw== X-Received: from shakeelb.svl.corp.google.com ([2620:15c:2cd:202:a28c:fdff:fee8:36f0]) (user=shakeelb job=sendgmr) by 2002:a63:f342:: with SMTP id t2mr2912320pgj.313.1601129646924; Sat, 26 Sep 2020 07:14:06 -0700 (PDT) Date: Sat, 26 Sep 2020 07:13:41 -0700 Message-Id: <20200926141341.785180-1-shakeelb@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.28.0.681.g6f77f65b4e-goog Subject: [PATCH] mm: slab: fix potential double free in ___cache_free From: Shakeel Butt To: Roman Gushchin , Ming Lei Cc: Johannes Weiner , Andrew Morton , Linus Torvalds , "Theodore Y . Ts'o" , Jens Axboe , Ext4 Developers List , linux-block , Vlastimil Babka , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Shakeel Butt , kernel test robot X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: With the commit 10befea91b61 ("mm: memcg/slab: use a single set of kmem_caches for all allocations"), it becomes possible to call kfree() from the slabs_destroy(). The functions cache_flusharray() and do_drain() calls slabs_destroy() on array_cache of the local CPU without updating the size of the array_cache. This enables the kfree() call from the slabs_destroy() to recursively call cache_flusharray() which can potentially call free_block() on the same elements of the array_cache of the local CPU and causing double free and memory corruption. To fix the issue, simply update the local CPU array_cache cache before calling slabs_destroy(). Fixes: 10befea91b61 ("mm: memcg/slab: use a single set of kmem_caches for all allocations") Signed-off-by: Shakeel Butt Reviewed-by: Roman Gushchin Tested-by: Ming Lei Reported-by: kernel test robot --- mm/slab.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/mm/slab.c b/mm/slab.c index 3160dff6fd76..f658e86ec8ce 100644 --- a/mm/slab.c +++ b/mm/slab.c @@ -1632,6 +1632,10 @@ static void slab_destroy(struct kmem_cache *cachep, struct page *page) kmem_cache_free(cachep->freelist_cache, freelist); } +/* + * Update the size of the caches before calling slabs_destroy as it may + * recursively call kfree. + */ static void slabs_destroy(struct kmem_cache *cachep, struct list_head *list) { struct page *page, *n; @@ -2153,8 +2157,8 @@ static void do_drain(void *arg) spin_lock(&n->list_lock); free_block(cachep, ac->entry, ac->avail, node, &list); spin_unlock(&n->list_lock); - slabs_destroy(cachep, &list); ac->avail = 0; + slabs_destroy(cachep, &list); } static void drain_cpu_caches(struct kmem_cache *cachep) @@ -3402,9 +3406,9 @@ static void cache_flusharray(struct kmem_cache *cachep, struct array_cache *ac) } #endif spin_unlock(&n->list_lock); - slabs_destroy(cachep, &list); ac->avail -= batchcount; memmove(ac->entry, &(ac->entry[batchcount]), sizeof(void *)*ac->avail); + slabs_destroy(cachep, &list); } /*