From patchwork Sun May 29 08:15:33 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Rongwei Wang X-Patchwork-Id: 12864138 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id C4185C433EF for ; Sun, 29 May 2022 08:15:45 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id BC9288D0003; Sun, 29 May 2022 04:15:44 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id B9CB78D0002; Sun, 29 May 2022 04:15:44 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 9FD8C8D0002; Sun, 29 May 2022 04:15:44 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 93D5C8D0002 for ; Sun, 29 May 2022 04:15:44 -0400 (EDT) Received: from smtpin11.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id 61BBA33D5C for ; Sun, 29 May 2022 08:15:44 +0000 (UTC) X-FDA: 79518071808.11.95CAF5E Received: from out30-57.freemail.mail.aliyun.com (out30-57.freemail.mail.aliyun.com [115.124.30.57]) by imf14.hostedemail.com (Postfix) with ESMTP id 72DEC100034 for ; Sun, 29 May 2022 08:15:38 +0000 (UTC) X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R971e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=e01e04357;MF=rongwei.wang@linux.alibaba.com;NM=1;PH=DS;RN=9;SR=0;TI=SMTPD_---0VEe4qN3_1653812135; Received: from localhost.localdomain(mailfrom:rongwei.wang@linux.alibaba.com fp:SMTPD_---0VEe4qN3_1653812135) by smtp.aliyun-inc.com(127.0.0.1); Sun, 29 May 2022 16:15:37 +0800 From: Rongwei Wang To: akpm@linux-foundation.org, vbabka@suse.cz, roman.gushchin@linux.dev, iamjoonsoo.kim@lge.com, rientjes@google.com, penberg@kernel.org, cl@linux.com Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: [PATCH 1/3] mm/slub: fix the race between validate_slab and slab_free Date: Sun, 29 May 2022 16:15:33 +0800 Message-Id: <20220529081535.69275-1-rongwei.wang@linux.alibaba.com> X-Mailer: git-send-email 2.32.0 MIME-Version: 1.0 X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: 72DEC100034 X-Stat-Signature: wsctt5zh6phrg81mwz9qbhhmfgppkrh9 X-Rspam-User: Authentication-Results: imf14.hostedemail.com; dkim=none; dmarc=pass (policy=none) header.from=alibaba.com; spf=pass (imf14.hostedemail.com: domain of rongwei.wang@linux.alibaba.com designates 115.124.30.57 as permitted sender) smtp.mailfrom=rongwei.wang@linux.alibaba.com X-HE-Tag: 1653812138-467833 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: In use cases where allocating and freeing slab frequently, some error messages, such as "Left Redzone overwritten", "First byte 0xbb instead of 0xcc" would be printed when validating slabs. That's because an object has been filled with SLAB_RED_INACTIVE, but has not been added to slab's freelist. And between these two states, the behaviour of validating slab is likely to occur. Actually, it doesn't mean the slab can not work stably. But, these confusing messages will disturb slab debugging more or less. Signed-off-by: Rongwei Wang Reported-by: Rongwei Wang Signed-off-by: Vlastimil Babka --- mm/slub.c | 40 +++++++++++++++++----------------------- 1 file changed, 17 insertions(+), 23 deletions(-) diff --git a/mm/slub.c b/mm/slub.c index ed5c2c03a47a..310e56d99116 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -1374,15 +1374,12 @@ static noinline int free_debug_processing( void *head, void *tail, int bulk_cnt, unsigned long addr) { - struct kmem_cache_node *n = get_node(s, slab_nid(slab)); void *object = head; int cnt = 0; - unsigned long flags, flags2; + unsigned long flags; int ret = 0; - spin_lock_irqsave(&n->list_lock, flags); - slab_lock(slab, &flags2); - + slab_lock(slab, &flags); if (s->flags & SLAB_CONSISTENCY_CHECKS) { if (!check_slab(s, slab)) goto out; @@ -1414,8 +1411,7 @@ static noinline int free_debug_processing( slab_err(s, slab, "Bulk freelist count(%d) invalid(%d)\n", bulk_cnt, cnt); - slab_unlock(slab, &flags2); - spin_unlock_irqrestore(&n->list_lock, flags); + slab_unlock(slab, &flags); if (!ret) slab_fix(s, "Object at 0x%p not freed", object); return ret; @@ -3304,7 +3300,7 @@ static void __slab_free(struct kmem_cache *s, struct slab *slab, { void *prior; - int was_frozen; + int was_frozen, to_take_off = 0; struct slab new; unsigned long counters; struct kmem_cache_node *n = NULL; @@ -3315,15 +3311,19 @@ static void __slab_free(struct kmem_cache *s, struct slab *slab, if (kfence_free(head)) return; + n = get_node(s, slab_nid(slab)); + spin_lock_irqsave(&n->list_lock, flags); + if (kmem_cache_debug(s) && - !free_debug_processing(s, slab, head, tail, cnt, addr)) + !free_debug_processing(s, slab, head, tail, cnt, addr)) { + + spin_unlock_irqrestore(&n->list_lock, flags); return; + } do { - if (unlikely(n)) { - spin_unlock_irqrestore(&n->list_lock, flags); - n = NULL; - } + if (unlikely(to_take_off)) + to_take_off = 0; prior = slab->freelist; counters = slab->counters; set_freepointer(s, tail, prior); @@ -3343,18 +3343,11 @@ static void __slab_free(struct kmem_cache *s, struct slab *slab, new.frozen = 1; } else { /* Needs to be taken off a list */ - - n = get_node(s, slab_nid(slab)); /* - * Speculatively acquire the list_lock. * If the cmpxchg does not succeed then we may - * drop the list_lock without any processing. - * - * Otherwise the list_lock will synchronize with - * other processors updating the list of slabs. + * drop this behavior without any processing. */ - spin_lock_irqsave(&n->list_lock, flags); - + to_take_off = 1; } } @@ -3363,8 +3356,9 @@ static void __slab_free(struct kmem_cache *s, struct slab *slab, head, new.counters, "__slab_free")); - if (likely(!n)) { + if (likely(!to_take_off)) { + spin_unlock_irqrestore(&n->list_lock, flags); if (likely(was_frozen)) { /* * The list lock was not taken therefore no list