From: "Jason A. Donenfeld" <Jason@zx2c4.com>
To: Shakeel Butt <shakeelb@google.com>
Cc: aryabinin@virtuozzo.com, Alexander Potapenko <glider@google.com>,
Dmitry Vyukov <dvyukov@google.com>,
cl@linux.com, penberg@kernel.org, rientjes@google.com,
iamjoonsoo.kim@lge.com, Andrew Morton <akpm@linux-foundation.org>,
kasan-dev@googlegroups.com, Linux-MM <linux-mm@kvack.org>,
LKML <linux-kernel@vger.kernel.org>
Subject: Re: Possible regression in "slab, slub: skip unnecessary kasan_cache_shutdown()"
Date: Tue, 19 Jun 2018 15:25:25 +0200 [thread overview]
Message-ID: <CAHmME9r=+91YtujYqsBwf52VkCdPMD8VXJED_AsR42H5h9--mA@mail.gmail.com> (raw)
In-Reply-To: <CALvZod5ZrxjZjJjAV_iH6hgq9pY2QEuFjNi+qvPSzob5Vighjg@mail.gmail.com>
On Tue, Jun 19, 2018 at 7:06 AM Shakeel Butt <shakeelb@google.com> wrote:
> Currently refcnt in your
> code can underflow, through it does not seem like the selftest will
> cause the underflow but still you should fix it.
Indeed, and if this happened this would be a bug in the caller, not
the ratelimiter itself, kind of like lock imbalances; however it's
easy to mitigate this by just replacing that atomic64_dec_return with
atomic64_dec_if_positive, so I'll do that. Thanks for the suggestion.
> From high level your code seems fine. Does the issue occur on first
> try of selftest? Basically I wanted to ask if kmem_cache_destroy of
> your entry_cache was ever executed
Yes, it is.
> and have you tried to run this
> selftest multiple time while the system was up.
Interesting, it crashes on the second run of it, when executing
`KMEM_CACHE(ratelimiter_entry, 0)`. (OOPS is below.)
> As Dmitry already asked, are you using SLAB or SLUB?
SLUB.
> Sorry, I can not really give a definitive answer.
Alright, we'll poke it from both ends, then.
Crash on second run:
[ 1.648240] general protection fault: 0000 [#1] PREEMPT SMP
DEBUG_PAGEALLOC KASAN
[ 1.648240] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.17.2 #51
[ 1.648240] RIP: 0010:__lock_acquire+0x9a9/0x3430
[ 1.648240] RSP: 0000:ffff8800003b76a0 EFLAGS: 00010006
[ 1.648240] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 1.648240] RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000001
[ 1.648240] RBP: ffff8800003a8000 R08: 0000000000000001 R09: 0000000000000000
[ 1.648240] R10: 0000000000000001 R11: ffffffff828c69e3 R12: 0000000000000001
[ 1.648240] R13: 0000000000000018 R14: 0000000000000000 R15: ffff8800003a8000
[ 1.648240] FS: 0000000000000000(0000) GS:ffff880036400000(0000)
knlGS:000000000
[ 1.648240] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1.648240] CR2: 0000000000000000 CR3: 0000000002220001 CR4: 00000000001606b0
[ 1.660020] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1.660020] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 1.660020] Call Trace:
[ 1.660020] ? _raw_spin_unlock_irqrestore+0x4a/0x90
[ 1.660020] ? debug_check_no_locks_held+0xb0/0xb0
[ 1.660020] ? depot_save_stack.cold.2+0x1e/0x1e
[ 1.660020] ? handle_null_ptr_deref+0x178/0x1f0
[ 1.660020] ? depot_save_stack.cold.2+0x1e/0x1e
[ 1.660020] ? _raw_spin_unlock+0x32/0x70
[ 1.660020] lock_acquire+0xf4/0x240
[ 1.660020] ? __slab_free.isra.11+0x1db/0x770
[ 1.660020] ? __slab_free.isra.11+0x1db/0x770
[ 1.660020] _raw_spin_lock_irqsave+0x4b/0x70
[ 1.660020] ? __slab_free.isra.11+0x1db/0x770
[ 1.660020] __slab_free.isra.11+0x1db/0x770
[ 1.660020] ? __free_pages_ok+0x49a/0xd10
[ 1.660020] ? mark_held_locks+0xdf/0x1b0
[ 1.660020] ? _raw_spin_unlock_irqrestore+0x61/0x90
[ 1.660020] ? qlist_free_all+0x58/0x1c0
[ 1.660020] qlist_free_all+0x70/0x1c0
[ 1.660020] ? trace_hardirqs_on_caller+0x3d0/0x630
[ 1.660020] quarantine_reduce+0x221/0x310
[ 1.660020] kasan_kmalloc+0x95/0xc0
[ 1.660020] kmem_cache_alloc+0x167/0x2e0
[ 1.660020] ? do_one_initcall+0x104/0x232
[ 1.660020] create_object+0xa7/0xa70
[ 1.660020] ? kmemleak_disable+0x90/0x90
[ 1.660020] ? quarantine_reduce+0x207/0x310
[ 1.660020] ? fs_reclaim_acquire.part.15+0x30/0x30
[ 1.660020] kmem_cache_alloc_node+0x209/0x340
[ 1.660020] __kmem_cache_create+0xe6/0x5c0
[ 1.660020] kmem_cache_create_usercopy+0x1ef/0x380
[ 1.660020] ? length_mt_init+0x11/0x11
[ 1.660020] kmem_cache_create+0xd/0x10
[ 1.660020] ratelimiter_init+0x4a/0x1e0
[ 1.660020] ratelimiter_selftest+0x13/0x9ec
[ 1.660020] ? length_mt_init+0x11/0x11
[ 1.660020] mod_init+0xb/0xa5
[ 1.660020] do_one_initcall+0x104/0x232
[ 1.660020] ? start_kernel+0x62c/0x62c
[ 1.660020] ? up_write+0x78/0x220
[ 1.660020] ? up_read+0x130/0x130
[ 1.660020] ? kasan_unpoison_shadow+0x30/0x40
[ 1.660020] kernel_init_freeable+0x3e8/0x48c
[ 1.660020] ? rest_init+0x2bf/0x2bf
[ 1.660020] kernel_init+0x7/0x121
[ 1.660020] ? rest_init+0x2bf/0x2bf
[ 1.660020] ret_from_fork+0x24/0x30
[ 1.660020] Code: 81 c4 40 01 00 00 5b 5d 41 5c 41 5d 41 5e 41 5f
c3 4d 85 ed 0f
[ 1.660020] RIP: __lock_acquire+0x9a9/0x3430 RSP: ffff8800003b76a0
[ 1.660020] ---[ end trace daba3b506c5594e5 ]---
next prev parent reply other threads:[~2018-06-19 13:25 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-06-19 2:51 Jason A. Donenfeld
2018-06-19 3:59 ` Shakeel Butt
2018-06-19 4:08 ` Jason A. Donenfeld
2018-06-19 4:55 ` Dmitry Vyukov
2018-06-19 13:04 ` Jason A. Donenfeld
2018-06-19 13:16 ` Dmitry Vyukov
2018-06-19 15:08 ` Shakeel Butt
2018-06-19 15:18 ` Jason A. Donenfeld
2018-06-19 19:21 ` Shakeel Butt
2018-06-19 20:20 ` Jason A. Donenfeld
2018-06-19 5:06 ` Shakeel Butt
2018-06-19 13:25 ` Jason A. Donenfeld [this message]
2018-06-19 13:30 ` Dmitry Vyukov
2018-06-19 13:40 ` Jason A. Donenfeld
2018-06-19 17:34 ` Andrey Ryabinin
2018-06-19 20:17 ` Jason A. Donenfeld
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAHmME9r=+91YtujYqsBwf52VkCdPMD8VXJED_AsR42H5h9--mA@mail.gmail.com' \
--to=jason@zx2c4.com \
--cc=akpm@linux-foundation.org \
--cc=aryabinin@virtuozzo.com \
--cc=cl@linux.com \
--cc=dvyukov@google.com \
--cc=glider@google.com \
--cc=iamjoonsoo.kim@lge.com \
--cc=kasan-dev@googlegroups.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=penberg@kernel.org \
--cc=rientjes@google.com \
--cc=shakeelb@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox