From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 43007C3ABBF for ; Tue, 6 May 2025 10:24:25 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 1FBF16B0089; Tue, 6 May 2025 06:24:23 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 184E16B008A; Tue, 6 May 2025 06:24:23 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id F41CE6B008C; Tue, 6 May 2025 06:24:22 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id CF25F6B0089 for ; Tue, 6 May 2025 06:24:22 -0400 (EDT) Received: from smtpin23.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id 9DA2C8210C for ; Tue, 6 May 2025 10:24:23 +0000 (UTC) X-FDA: 83412098406.23.4735185 Received: from mail-pf1-f179.google.com (mail-pf1-f179.google.com [209.85.210.179]) by imf26.hostedemail.com (Postfix) with ESMTP id F2E07140003 for ; Tue, 6 May 2025 10:24:21 +0000 (UTC) Authentication-Results: imf26.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=UQUKLprl; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf26.hostedemail.com: domain of aha310510@gmail.com designates 209.85.210.179 as permitted sender) smtp.mailfrom=aha310510@gmail.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1746527062; a=rsa-sha256; cv=none; b=YWqBa25RjG/LzqniYcqH1DaRBlG/l8pMv4QjHD6ZscUzLCM1//hwscG7yf6iqnUno4IC/Y cj2KeJ1OxjaD5OX9T0EvpvyaQmh5wDn27xBsWrhKn2lAG+xNCfkMcum8uplsIrl8uMTVyD 23gbFSwNxDTyjt1SOIcZ7TlDc65LGu0= ARC-Authentication-Results: i=1; imf26.hostedemail.com; dkim=pass header.d=gmail.com header.s=20230601 header.b=UQUKLprl; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf26.hostedemail.com: domain of aha310510@gmail.com designates 209.85.210.179 as permitted sender) smtp.mailfrom=aha310510@gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1746527062; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:references:dkim-signature; bh=5OOecS8teiPhRlJLpXUsRlmizQbllXdt4yll7Iq6sT4=; b=3ZzQl/zYSJE6kcnKyIoG6KOgBzL7dnPbIeDlyBDUiL6z8SYLGx32+rkFqBDoRQdCce3fXZ DSxIud+rRGZKlmjxhM99XHm/WlTIib5T5d1FQq0E3fEVcgcG+D2ZVAt0d4t6dbLYQ9t3U/ BFhTttLbrYLdEHYZGLOETrVWWxTzc48= Received: by mail-pf1-f179.google.com with SMTP id d2e1a72fcca58-736a7e126c7so4835503b3a.3 for ; Tue, 06 May 2025 03:24:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1746527061; x=1747131861; darn=kvack.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=5OOecS8teiPhRlJLpXUsRlmizQbllXdt4yll7Iq6sT4=; b=UQUKLprlpwPiIm6GMBeW52mQ+uwTdAHyZUuCEuAAxwhqQ8aHnxnQc8HlivJg7Wb11O YMxqF6U1zRcRBQZ7Z8mf61Hya7aeNapnKK5FCCY7qwsSW8N6+rTIElvfbKC88oupHyvD umcAFhGXxcYVPWpZtm0DOAjunyybmd7oY/5/kUgfFRlutnTZjkCdJHwxrxTzabnJEHhG 14RdQzCJCbFWwBE9CpHteIoRQ6hOUq60xzUXEis+1XNpDrJCtobEZs6rtJlqX//9LUf6 3zhkjrdq1MeBpv9XQeyy6S2uSIt6AFgyPjAJgC2Vidop3vgxJ13RTlb7FNdjbpz2dLAR chQA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1746527061; x=1747131861; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=5OOecS8teiPhRlJLpXUsRlmizQbllXdt4yll7Iq6sT4=; b=wsPw9V+gAdVHxmrFeaSKrgt6RAIYhjS2NUzhXTDGtm3Wnr5fgUGWbFFizs2FctBJe2 AXuKGXukd1SrAxANOFB/A3nbXzxdqxHF/SwWK3IQKL7xqmOJ+jVm0a/xEdJP+z61Y+fK wmhZyKOWpLaODSj68eaZFsVkazJira+edUAnxyvD3oNshVjJCJsaaR+h9uMxlXb9+47X Dys8M+c/E13YN84FPztw+vE+UMPtzVOFCPZRtxDSeMVPK+hiJp3NHglhEPARwsj88Kih GbVShsvO7hLqmB0Tjx48o9TW0mqDrnrR1LRWqnwWOC1db1ClXrE+mikt82lW58qZfgxZ zRng== X-Forwarded-Encrypted: i=1; AJvYcCXKesKrwR54U/QLrQgXaUUyPkW2RthDnIg4ZXX1tvtyBlSd8ch/Mo2illZbudCttdFhVYYMsYZv2A==@kvack.org X-Gm-Message-State: AOJu0Yx7sUrOJLCwk4ub2M982sb2Aa5C+21fMwdVlTZ1DbmXzZPqBG3M UnRCyB6Q+JpkPF3Vz67Wo2jjPQ+cdC/v1AqaAg0fi3sm/n+TYttB X-Gm-Gg: ASbGncsfxEJAFFnmC3Hnaa46FkplhtT3J3xqdx7X71K1DQ5ZBRoKxsZJuxxDdSK7DWk WXNG+QLFreC7fwOJdcnLk+CTgsikCA9WjYUBiFPymua/piPQO83j/XkYDEB4FbWPhptpTvjU3LG RUOgYp0fGy/3Gewikbe4KJWb4bxMe2ROvUP0pcfVijT0ZN8jMUgQqp16ygdJtVV3BytBZtcl3Hp Nq5XLzSCZcGRJ4fTkUPakVI8OaXXPk7cNyfAA+HiJxkZwNJvdAXM6lW7bWG8n/U7XYpIEFmWgST MZq5WdFpL/F4y3QF0w0healmlwyuyEL0W2m29VomgNKkdC6bOGXF2DYQh+X7dzJfdWcSwg== X-Google-Smtp-Source: AGHT+IHDlz/QY612dZgx+2M3TO/osh8oqkZrBLmtzexErVIpEEkK7Hjl4gPDHOWO1x61ejU+rtbYjQ== X-Received: by 2002:a05:6a21:398a:b0:1f5:a3e8:64dd with SMTP id adf61e73a8af0-2117dcfed41mr4638467637.0.1746527060692; Tue, 06 May 2025 03:24:20 -0700 (PDT) Received: from localhost.localdomain ([121.185.186.233]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-b1fb3c442b7sm7112621a12.54.2025.05.06.03.24.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 06 May 2025 03:24:20 -0700 (PDT) From: Jeongjun Park To: dennis@kernel.org, tj@kernel.org, cl@linux.com, akpm@linux-foundation.org Cc: jack@suse.cz, hughd@google.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Jeongjun Park Subject: [PATCH] lib/percpu_counter: fix data race in __percpu_counter_limited_add() Date: Tue, 6 May 2025 19:24:02 +0900 Message-ID: <20250506102402.88141-1-aha310510@gmail.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Rspamd-Server: rspam03 X-Rspamd-Queue-Id: F2E07140003 X-Stat-Signature: 554zcfikx1xc1r6a5ps6xj78fqzjb4zj X-Rspam-User: X-HE-Tag: 1746527061-168020 X-HE-Meta: U2FsdGVkX1/yHh9cGSBkWN5UHQXmjrutsoivxtUQxXi1xZsZH4m5JTTr0PuyukUIrLEI57YtOBZ3pPU1R+9nfSpDyoHdB6gQSojjr60x1MS0nYp0IDAa4fKUiTQGMsSoRjIRx4uNlRZK6h+TrssUZcWV8s9l95QMm07iE2Q8Jlcbe7kciaG8BRHNl1BA2hRQeXzxz7P+/M3H4HLH9mAtMmad51maWDs8HgyZqC0lxFeq3pd5CH4TRRhwyQz6qLb55NGblNdNge5aCyxJDCHwUbbaKJNovps/0flRtzDANBjREmlqhrrM7FikACDj6k3//EHXcFzX6V8DGYUeUQlrgIvWbLJ6Z+fCK5z0yGAz88UFaTPoiIht+nFohk2o3eUAp9gFZKIscEOdDE3TlobK39l9C6m3wvIJmaW6MzGw9XoXw73lg92ZqXLG38Vmc8P+qzsIoryO3Qj91to5Ww8XGPC0GlBsQZr5ZuLqS0sTAGy9Z5VzMjLE9tpZOzpVOxjX1ZYYHLuHVkJ2MF8gvvRDBD1mrDtuXpPQi4X5R0zF/6+wUOb72x+WbcLi5W7F4rGT9i1wMm5/6YI+iQ9/Jznv0odd9s5EgEZC7klBUDItsOBKVLpheh1g3NLa7Sej3V8iFts/C0WEEb+54aD3liN3123qgWFLvHT+BRUHivbKA2N4UIZQjE2uI27C6TXRYhfoVPfiCBTLJ67JXlGImZS9MtKrmaAVEIPiJ9Iae7O8ywiic590PlB0v8YRy5Wkz3prYAiim0WNJog/IbibptQ8eHXG5CjVOlm6nesCE7x805yoLQnSBG3ih2sp2B03pL0uPgUwjd52HkfU6tjIl4uCn43jQKeJqCFrDqZpBxXi5NVuabmnqp8ZnHjKP5/8edolri07Dn1e2PrS8bHx2V5379olJanQrOvgkELXwkdsNtIA3C4MVP6mfdGw8XlAQVqrgRkPY1w8S4FlUFBIkmj efghv2Wi xfHdS7umObK1Ex6+fWfNlaasDjbA/fL67r9rNyMu+D91dPTCkDWasSJ5s74zMmOR/O4D4 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: The following data-race was found in __percpu_counter_limited_add(): ================================================================== BUG: KCSAN: data-race in __percpu_counter_limited_add / __percpu_counter_limited_add write to 0xffff88801f417e50 of 8 bytes by task 6663 on cpu 0: __percpu_counter_limited_add+0x388/0x4a0 lib/percpu_counter.c:386 percpu_counter_limited_add include/linux/percpu_counter.h:77 [inline] shmem_inode_acct_blocks+0x10e/0x230 mm/shmem.c:233 shmem_alloc_and_add_folio mm/shmem.c:1923 [inline] shmem_get_folio_gfp.constprop.0+0x87f/0xc90 mm/shmem.c:2533 shmem_get_folio mm/shmem.c:2639 [inline] .... read to 0xffff88801f417e50 of 8 bytes by task 6659 on cpu 1: __percpu_counter_limited_add+0xc8/0x4a0 lib/percpu_counter.c:344 percpu_counter_limited_add include/linux/percpu_counter.h:77 [inline] shmem_inode_acct_blocks+0x10e/0x230 mm/shmem.c:233 shmem_alloc_and_add_folio mm/shmem.c:1923 [inline] shmem_get_folio_gfp.constprop.0+0x87f/0xc90 mm/shmem.c:2533 shmem_get_folio mm/shmem.c:2639 [inline] .... value changed: 0x000000000000396d -> 0x000000000000398e ================================================================== __percpu_counter_limited_add() should protect fbc via raw_spin_lock(), but it calls spinlock in the wrong place. This causes a data-race, so we need to fix it to call raw_spin_lock() a bit earlier. Fixes: beb986862844 ("shmem,percpu_counter: add _limited_add(fbc, limit, amount)") Signed-off-by: Jeongjun Park --- lib/percpu_counter.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/percpu_counter.c b/lib/percpu_counter.c index 2891f94a11c6..17f9fc12b409 100644 --- a/lib/percpu_counter.c +++ b/lib/percpu_counter.c @@ -336,6 +336,7 @@ bool __percpu_counter_limited_add(struct percpu_counter *fbc, return true; local_irq_save(flags); + raw_spin_lock(&fbc->lock); unknown = batch * num_online_cpus(); count = __this_cpu_read(*fbc->counters); @@ -344,11 +345,10 @@ bool __percpu_counter_limited_add(struct percpu_counter *fbc, ((amount > 0 && fbc->count + unknown <= limit) || (amount < 0 && fbc->count - unknown >= limit))) { this_cpu_add(*fbc->counters, amount); - local_irq_restore(flags); - return true; + good = true; + goto out; } - raw_spin_lock(&fbc->lock); count = fbc->count + amount; /* Skip percpu_counter_sum() when safe */ --