From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3562AC6FD1F for ; Wed, 3 Apr 2024 02:16:36 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 3BBDA6B0089; Tue, 2 Apr 2024 22:16:35 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 344306B008A; Tue, 2 Apr 2024 22:16:35 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 1BEB56B008C; Tue, 2 Apr 2024 22:16:35 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id EE16C6B0089 for ; Tue, 2 Apr 2024 22:16:34 -0400 (EDT) Received: from smtpin02.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id 7851B160BB2 for ; Wed, 3 Apr 2024 02:16:34 +0000 (UTC) X-FDA: 81966606708.02.8255F98 Received: from dggsgout11.his.huawei.com (unknown [45.249.212.51]) by imf10.hostedemail.com (Postfix) with ESMTP id 15C9AC000F for ; Wed, 3 Apr 2024 02:16:29 +0000 (UTC) Authentication-Results: imf10.hostedemail.com; dkim=none; spf=pass (imf10.hostedemail.com: domain of shikemeng@huaweicloud.com designates 45.249.212.51 as permitted sender) smtp.mailfrom=shikemeng@huaweicloud.com; dmarc=none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1712110592; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=BqmANvEqy8BhaSWbNl32mzfO4yrF64lR9srl/2a2wUk=; b=y5c7fEt1AKErYjU0OUMSrVj1/Hnh2pL7vFwcOanqPZO2P+Hr+Igun5MAGCzoYiegijs16r sR3obFsPeFsSV5vQh+hivWmSGnLC8NDCQm/Od6oV8MZF/hd2yCUlIDRUv2o3RzZAp/ksuv hdL/N98dQtdlnB7B3XWx6pmYdlywIEI= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1712110592; a=rsa-sha256; cv=none; b=vF49PNw3/ceV3wPeHnR7/KrNvfPr7crwXxQeo9WOzOjjCYV/xYceYuwF+WEKe+q7A7sO7g B8LFhLAqG6IYmrWWb3jrp5BYFbwu4ypEdJKdqTovxoZEea9Uh2aEAraLYw71Fa9ILR3KQu ZqNWTJgWyY76xPlSOlTqikAGgmD254Y= ARC-Authentication-Results: i=1; imf10.hostedemail.com; dkim=none; spf=pass (imf10.hostedemail.com: domain of shikemeng@huaweicloud.com designates 45.249.212.51 as permitted sender) smtp.mailfrom=shikemeng@huaweicloud.com; dmarc=none Received: from mail.maildlp.com (unknown [172.19.163.216]) by dggsgout11.his.huawei.com (SkyGuard) with ESMTP id 4V8SzN2WhDz4f3m6t for ; Wed, 3 Apr 2024 10:16:16 +0800 (CST) Received: from mail02.huawei.com (unknown [10.116.40.112]) by mail.maildlp.com (Postfix) with ESMTP id B49CD1A01B9 for ; Wed, 3 Apr 2024 10:16:24 +0800 (CST) Received: from [10.174.178.129] (unknown [10.174.178.129]) by APP1 (Coremail) with SMTP id cCh0CgAXMgv2uwxmq02RIw--.21036S2; Wed, 03 Apr 2024 10:16:24 +0800 (CST) Subject: Re: [PATCH v2 1/6] writeback: protect race between bdi release and bdi_debug_stats_show To: Brian Foster Cc: akpm@linux-foundation.org, willy@infradead.org, jack@suse.cz, tj@kernel.org, dsterba@suse.com, mjguzik@gmail.com, dhowells@redhat.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-fsdevel@vger.kernel.org References: <20240327155751.3536-1-shikemeng@huaweicloud.com> <20240327155751.3536-2-shikemeng@huaweicloud.com> From: Kemeng Shi Message-ID: <7232e82a-5073-003c-539f-f4627a9ee688@huaweicloud.com> Date: Wed, 3 Apr 2024 10:16:22 +0800 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.5.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=gbk Content-Transfer-Encoding: 7bit X-CM-TRANSID:cCh0CgAXMgv2uwxmq02RIw--.21036S2 X-Coremail-Antispam: 1UD129KBjvJXoWxCF4fWF47CF18JFW3Ww15urg_yoW5ArW8pa 15Ga98Kr48X34agr13ZayDur9aqw40qrnrWF97ua1rAr1kCr1SkFyIkryj9r95ZrZ7Cw1Y va15Ar9rC3yDAaDanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUvIb4IE77IF4wAFF20E14v26r4j6ryUM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rwA2F7IY1VAKz4 vEj48ve4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_tr0E3s1l84ACjcxK6xIIjxv20xvEc7Cj xVAFwI0_Gr1j6F4UJwA2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x 0267AKxVW0oVCq3wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG 6I80ewAv7VC0I7IYx2IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFV Cjc4AY6r1j6r4UM4x0Y48IcVAKI48JM4IIrI8v6xkF7I0E8cxan2IY04v7Mxk0xIA0c2IE e2xFo4CEbIxvr21l42xK82IYc2Ij64vIr41l4I8I3I0E4IkC6x0Yz7v_Jr0_Gr1lx2IqxV Aqx4xG67AKxVWUJVWUGwC20s026x8GjcxK67AKxVWUGVWUWwC2zVAF1VAY17CE14v26r1q 6r43MIIYrxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_JF4lIxAIcVC0I7IYx2IY6x kF7I0E14v26r4j6F4UMIIF0xvE42xK8VAvwI8IcIk0rVWrZr1j6s0DMIIF0xvEx4A2jsIE 14v26r1j6r4UMIIF0xvEx4A2jsIEc7CjxVAFwI0_Gr0_Gr1UYxBIdaVFxhVjvjDU0xZFpf 9x07UWE__UUUUU= X-CM-SenderInfo: 5vklyvpphqwq5kxd4v5lfo033gof0z/ X-Stat-Signature: 15f334hect8c9yc7d6ofq69bxr6ciqja X-Rspamd-Server: rspam10 X-Rspamd-Queue-Id: 15C9AC000F X-Rspam-User: X-HE-Tag: 1712110589-951475 X-HE-Meta: U2FsdGVkX19HFRJh1FZz1W9InuAHa1hiymndIofJbFgE7Pdbq1rR7CigbU23jGSY+YrFR7qajaqZRHzAJlbbi4wQtfqTvI+HIvu6Q+VScchGGTfiNNkkIfEXcjeyyXhZGgdnAHcDkYDTnLT0H+CEEC1Z9aFX+zPtXcVdQbQcZgkiHlapZpftIZXKr7KyzZEENIM2+2sIWN5paItZo6d5Pmqg46K0TVFTU3P9gTM0mKXwCwS/nJEg2wT94HIEvjBHfk5ZCMdgqLhVJ5Q1+36dm/gTAIMPcfcKkB1XvIQnVYXQmeF2JFwDf7XfQo5ghrgFjHfISHgsY826RUseUU8jrh7+oA2jwEDrJy1HpGxdNRt7u2kSESYYs/Lc4xB8IUvRywtW5gzHOETT2n4A7G0uSO41HrDs7shaCixoh55yNf+2af+Zwa0/bCP5MbKlG75thzf+ef4DrmUZB/5sDtNP4bALHBQDtDfvB8q+epK5r6oX4XvZgE+92EG21MvhE/h8LBA6fEXpR/aFYcpmKPhJMok4RLyZMtB9j9Le8XADdgayJt0GE+oA7XZJf1bA6vOWAfFthUwOIw3kuMjnUhIbFt3XZjIfA9K489rR9e/PMNYV8Z1NEcfH/LXGnyGcISIlNbOdC7/+zTbKQhpa1Y7FbkTpMEbjWje3tvpRrQBAATRjSW5qPwxNwfmgtni5OvvTPtJKcVY4D6LFNyr5GKZPmt/AGzlbk+7R2u0u8xXFxBhYbJjxkBMKcNvrTbFeFlBVXj6UZeTE124kxpzuVv5ycVvUHbTCTZxWIv+nUN1mDV73402jin6XetXM4UXpxDUeF/Gb60GX+MmmoOcbQGB0TBQPKmxnReDe1/hRr5T+qZfK4aQpCf61VKpSPhlOgHnxw1OKB2v8Kqs1l3aRFHSlLvsTMg7y8D6fEUpxtu9klADpq2vJcwvRbS7Ox7Po/yKLyDTxoWFszQj3G64CgS1 fF5ei/mC NR79VbNh6CfzIt3qbpt4W+/+DoKjFhSTwgnY79m35aFD+Nnsd+dHJ7I60N27JTlv0hcCLQmF9D0lgMrYAfIIYZ0OwU46sqX+BsjSma9qof6Nm10Y6rxSEyNyuZhQAWi+N0KraSim38NVWJqiA2KCzo+Nhr0odcrPL9BBQfKQBwxkDvsQBNfZFbMCucExIb1T7fpPxQe0ovgPNfRldOjHPsMJYGhKYpJGE1KGWAwwNSzilYGAvbl1hNyADFr6mpKbe4dGuMbgk7le5DZl2pUe0HOuJaQ== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: on 3/29/2024 1:53 AM, Brian Foster wrote: > On Wed, Mar 27, 2024 at 11:57:46PM +0800, Kemeng Shi wrote: >> There is a race between bdi release and bdi_debug_stats_show: >> /* get debug info */ /* bdi release */ >> bdi_debug_stats_show >> bdi = m->private; >> wb = &bdi->wb; >> bdi_unregister >> bdi_put >> release_bdi >> kfree(bdi) >> /* use after free */ >> spin_lock(&wb->list_lock); >> > > Maybe I'm missing something, but it looks to me that > bdi_unregister_debug() can't complete until active readers of associated > debugfs files have completed. For example, see __debugfs_file_removed() > and use of ->active_users[_drained]. Once the dentry is unlinked, > further reads fail (I think) via debugfs_file_get(). Hm? Sorry for missing this. The race seems not possible if debugfs could prevent this. Thanks for the information. I will drop this in next version. Kemeng > > Brian > >> Search bdi on bdi_list under rcu lock in bdi_debug_stats_show to ensure >> the bdi is not freed to fix the issue. >> >> Signed-off-by: Kemeng Shi >> --- >> mm/backing-dev.c | 33 +++++++++++++++++++++++++++++++-- >> 1 file changed, 31 insertions(+), 2 deletions(-) >> >> diff --git a/mm/backing-dev.c b/mm/backing-dev.c >> index 5f2be8c8df11..70f02959f3bd 100644 >> --- a/mm/backing-dev.c >> +++ b/mm/backing-dev.c >> @@ -46,16 +46,44 @@ static void bdi_debug_init(void) >> bdi_debug_root = debugfs_create_dir("bdi", NULL); >> } >> >> -static int bdi_debug_stats_show(struct seq_file *m, void *v) >> +static struct backing_dev_info *lookup_bdi(struct seq_file *m) >> { >> + const struct file *file = m->file; >> struct backing_dev_info *bdi = m->private; >> - struct bdi_writeback *wb = &bdi->wb; >> + struct backing_dev_info *exist; >> + >> + list_for_each_entry_rcu(exist, &bdi_list, bdi_list) { >> + if (exist != bdi) >> + continue; >> + >> + if (exist->debug_dir == file->f_path.dentry->d_parent) >> + return bdi; >> + else >> + return NULL; >> + } >> + >> + return NULL; >> +} >> + >> + >> +static int bdi_debug_stats_show(struct seq_file *m, void *v) >> +{ >> + struct backing_dev_info *bdi; >> + struct bdi_writeback *wb; >> unsigned long background_thresh; >> unsigned long dirty_thresh; >> unsigned long wb_thresh; >> unsigned long nr_dirty, nr_io, nr_more_io, nr_dirty_time; >> struct inode *inode; >> >> + rcu_read_lock(); >> + bdi = lookup_bdi(m); >> + if (!bdi) { >> + rcu_read_unlock(); >> + return -EEXIST; >> + } >> + >> + wb = &bdi->wb; >> nr_dirty = nr_io = nr_more_io = nr_dirty_time = 0; >> spin_lock(&wb->list_lock); >> list_for_each_entry(inode, &wb->b_dirty, i_io_list) >> @@ -101,6 +129,7 @@ static int bdi_debug_stats_show(struct seq_file *m, void *v) >> nr_dirty_time, >> !list_empty(&bdi->bdi_list), bdi->wb.state); >> >> + rcu_read_unlock(); >> return 0; >> } >> DEFINE_SHOW_ATTRIBUTE(bdi_debug_stats); >> -- >> 2.30.0 >> > >