From patchwork Fri Sep 30 10:07:30 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Feng Tang X-Patchwork-Id: 12995115 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id A2BE5C433F5 for ; Fri, 30 Sep 2022 10:07:48 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 0BA358D0001; Fri, 30 Sep 2022 06:07:48 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 06A836B0073; Fri, 30 Sep 2022 06:07:48 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id E74768D0001; Fri, 30 Sep 2022 06:07:47 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id D8A566B0072 for ; Fri, 30 Sep 2022 06:07:47 -0400 (EDT) Received: from smtpin12.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay05.hostedemail.com (Postfix) with ESMTP id A3BA2402E0 for ; Fri, 30 Sep 2022 10:07:47 +0000 (UTC) X-FDA: 79968325374.12.2528574 Received: from mga01.intel.com (mga01.intel.com [192.55.52.88]) by imf04.hostedemail.com (Postfix) with ESMTP id 812AC40016 for ; Fri, 30 Sep 2022 10:07:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1664532466; x=1696068466; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=tDWtMj2GvFVA4IHpATwIcizZYdM1TOn0Oc2oCI6pk6Y=; b=OzWki69shQrcOeVzxakWUmrEZLpih/u0Oe1DoO/Ck6PhIOeuc9MQ107N b4R1zTehbAIXr2KLqWexMWQhabQpxXqMatPeTT+ydShGT+xuEIcV0FuD2 RE5SJQGxr07cQ819LlgQBjIDCLEs+Yo9MwCuFsgPkaQAePqk4apZO1k2b WY613W2heCTdQXwhNTayG/41RjPuDO8ZEnCpAhFlzdLDcZ7DYy4oraXOi E0RiLHYX50PjLAB75ILDRd/iv9tE8XaSC9YSdZpSRGMv2xIO3f9SfFj53 lbd3u2RK7EJ6VtflWTUpGNQafIU6y7v/05BAFHxgKxghKy4oMJrw86KG1 g==; X-IronPort-AV: E=McAfee;i="6500,9779,10485"; a="328538140" X-IronPort-AV: E=Sophos;i="5.93,358,1654585200"; d="scan'208";a="328538140" Received: from orsmga001.jf.intel.com ([10.7.209.18]) by fmsmga101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Sep 2022 03:07:45 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6500,9779,10485"; a="655905949" X-IronPort-AV: E=Sophos;i="5.93,358,1654585200"; d="scan'208";a="655905949" Received: from feng-clx.sh.intel.com ([10.238.200.228]) by orsmga001.jf.intel.com with ESMTP; 30 Sep 2022 03:07:41 -0700 From: Feng Tang To: Vlastimil Babka , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Roman Gushchin , Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Feng Tang Subject: [PATCH -next] mm/slub: fix a slab missed to be freed problem Date: Fri, 30 Sep 2022 18:07:30 +0800 Message-Id: <20220930100730.250248-1-feng.tang@intel.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1664532467; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:references:dkim-signature; bh=2bwilFefrRuhCWUDUYZXxsmQ881RZH3YrM0dLvTTd9o=; b=5ptnABnn6txcgV5wj9pmBFnSUENUQcJLGew8dMTuC7PvZy/96FF+nHbAhrM26VmYoROXY4 FuHTKMZzRjGiFZviP/ERdOgSWNIDX00QYjDenYVJOuEbIVMXPGxUvOqeZg8n0EjAc722x0 3H15y4arghz2EZSMiTUEbGMf8M/2qZ4= ARC-Authentication-Results: i=1; imf04.hostedemail.com; dkim=none ("invalid DKIM record") header.d=intel.com header.s=Intel header.b=OzWki69s; spf=pass (imf04.hostedemail.com: domain of feng.tang@intel.com designates 192.55.52.88 as permitted sender) smtp.mailfrom=feng.tang@intel.com; dmarc=pass (policy=none) header.from=intel.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1664532467; a=rsa-sha256; cv=none; b=kmPr7fiV+uPkydeFujUkhjKQReoWWDocfp2i4WIrH7pF4PORkhFwI1BxULPocse1+hXiLJ tzdFZqcOxyS0ayW5f8Zc+WU8VvO5Te5vPuI/zyR4j7T94eZVGsMhafqaKFDMfelS2EBuza rzXXpq3Z3bdzhGuK9mzv0xo5vKo9Q9I= Authentication-Results: imf04.hostedemail.com; dkim=none ("invalid DKIM record") header.d=intel.com header.s=Intel header.b=OzWki69s; spf=pass (imf04.hostedemail.com: domain of feng.tang@intel.com designates 192.55.52.88 as permitted sender) smtp.mailfrom=feng.tang@intel.com; dmarc=pass (policy=none) header.from=intel.com X-Rspam-User: X-Stat-Signature: 41cacs6yiazgoqt4ercjn1rfhktz8dbs X-Rspamd-Queue-Id: 812AC40016 X-Rspamd-Server: rspam08 X-HE-Tag: 1664532466-689100 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: When enable kasan and kfence's in-kernel kunit test with slub_debug on, it caught a problem (in linux-next tree): ------------[ cut here ]------------ kmem_cache_destroy test: Slab cache still has objects when called from test_exit+0x1a/0x30 WARNING: CPU: 3 PID: 240 at mm/slab_common.c:492 kmem_cache_destroy+0x16c/0x170 Modules linked in: CPU: 3 PID: 240 Comm: kunit_try_catch Tainted: G B N 6.0.0-rc7-next-20220929 #52 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:kmem_cache_destroy+0x16c/0x170 Code: 41 5c 41 5d e9 a5 04 0b 00 c3 cc cc cc cc 48 8b 55 60 48 8b 4c 24 20 48 c7 c6 40 37 d2 82 48 c7 c7 e8 a0 33 83 e8 4e d7 14 01 <0f> 0b eb a7 41 56 41 89 d6 41 55 49 89 f5 41 54 49 89 fc 55 48 89 RSP: 0000:ffff88800775fea0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffff83bdec48 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 1ffff11000eebf9e RDI: ffffed1000eebfc6 RBP: ffff88804362fa00 R08: ffffffff81182e58 R09: ffff88800775fbdf R10: ffffed1000eebf7b R11: 0000000000000001 R12: 000000008c800d00 R13: ffff888005e78040 R14: 0000000000000000 R15: ffff888005cdfad0 FS: 0000000000000000(0000) GS:ffff88807ed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000000360e001 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: test_exit+0x1a/0x30 kunit_try_run_case+0xad/0xc0 kunit_generic_run_threadfn_adapter+0x26/0x50 kthread+0x17b/0x1b0 It was biscted to commit c7323a5ad078 ("mm/slub: restrict sysfs validation to debug caches and make it safe") The problem is inside free_debug_processing(), in one path, the slab on partial list is missed to be freed when partial list is full. Signed-off-by: Feng Tang Reviewed-by: Hyeonggon Yoo <42.hyeyoo@gmail.com> --- Hi reviewers, Sorry for the late reporting, but it's curious that this problem didn't show up in my earlier test (which caught some other problems). mm/slub.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/mm/slub.c b/mm/slub.c index 5c3c31a154ba..4c037bd0b22b 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -2880,28 +2880,34 @@ static noinline void free_debug_processing( out: if (checks_ok) { void *prior = slab->freelist; + bool slab_need_discard = false; /* Perform the actual freeing while we still hold the locks */ slab->inuse -= cnt; set_freepointer(s, tail, prior); slab->freelist = head; - /* Do we need to remove the slab from full or partial list? */ + /* + * If the slab is empty, and node's partial list is full, + * it should be discarded anyway no matter it's on full or + * partial list. + */ + if (slab->inuse == 0 && n->nr_partial >= s->min_partial) { + slab_need_discard = true; + slab_free = slab; + } + if (!prior) { + /* was on full list */ remove_full(s, n, slab); - } else if (slab->inuse == 0 && - n->nr_partial >= s->min_partial) { + if (!slab_need_discard) { + add_partial(n, slab, DEACTIVATE_TO_TAIL); + stat(s, FREE_ADD_PARTIAL); + } + } else if (slab_need_discard) { remove_partial(n, slab); stat(s, FREE_REMOVE_PARTIAL); } - - /* Do we need to discard the slab or add to partial list? */ - if (slab->inuse == 0 && n->nr_partial >= s->min_partial) { - slab_free = slab; - } else if (!prior) { - add_partial(n, slab, DEACTIVATE_TO_TAIL); - stat(s, FREE_ADD_PARTIAL); - } } if (slab_free) {