From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id E718FC25B07 for ; Wed, 10 Aug 2022 18:10:19 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 601CA8E0001; Wed, 10 Aug 2022 14:10:19 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 5B0E36B0072; Wed, 10 Aug 2022 14:10:19 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 478C68E0001; Wed, 10 Aug 2022 14:10:19 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 390B06B0071 for ; Wed, 10 Aug 2022 14:10:19 -0400 (EDT) Received: from smtpin11.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id 1506C1A1397 for ; Wed, 10 Aug 2022 18:10:19 +0000 (UTC) X-FDA: 79784472558.11.A114A53 Received: from out1.migadu.com (out1.migadu.com [91.121.223.63]) by imf03.hostedemail.com (Postfix) with ESMTP id 38CC920181 for ; Wed, 10 Aug 2022 18:10:17 +0000 (UTC) Date: Wed, 10 Aug 2022 11:10:06 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1660155016; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=zTuSuFtUPwcOmTfxvlWmgCK8CoOf1NlVunoS26Fz4FY=; b=gjJJ5MFRjkZZC95NgeuwwqFSHUptFn8KS1MWkoVoclKZftoX+0FmDlrVunyjPPkfXhU9T/ cVP/ahEN3OonmyObzIVeae46k5Hgx9I8tPxnzFH0GBpaDD99boO2ObPyaSP21Pxbat5W8t jAzAqTtQ6x8un9faFNxL1KW3y+bs2YU= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Roman Gushchin To: Waiman Long Cc: Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Vlastimil Babka , Hyeonggon Yoo <42.hyeyoo@gmail.com>, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v2] mm/slab_common: Deleting kobject in kmem_cache_destroy() without holding slab_mutex/cpu_hotplug_lock Message-ID: References: <20220810164946.148634-1-longman@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20220810164946.148634-1-longman@redhat.com> X-Migadu-Flow: FLOW_OUT X-Migadu-Auth-User: linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1660155018; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=zTuSuFtUPwcOmTfxvlWmgCK8CoOf1NlVunoS26Fz4FY=; b=kogxU1ALP97pnV8QxAG7+mv30vo4ocblRi+fZhsiemrIuHR5C6oqQHcMOtNhH1nfb2/2Yc OvdoX5qUoXImvFGvtbHTwRVpzZR8ypG3yNGXy5lHdEaoRWpiPoo33825qoeNCo1Rw28Uwk ToR3Hph+4sQCl5OA478A9cAdWIQZ7eU= ARC-Authentication-Results: i=1; imf03.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=gjJJ5MFR; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf03.hostedemail.com: domain of roman.gushchin@linux.dev designates 91.121.223.63 as permitted sender) smtp.mailfrom=roman.gushchin@linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1660155018; a=rsa-sha256; cv=none; b=a3ShLorrfp6NCVjVK7J7of+6f2Ed7+aagFHz8E4POQJYlOblXXFHTHeG4fmEu5MzRCwTPp j5tu06RQzgtS7FkgKShEQqiA4PIrS9cNkEFaiJzbWkGyYSm/zF6PsnqooRKpIfXJWeusMg 2i7m2bnL4qFS5s30qU4V9jisLmMu3c0= X-Rspamd-Server: rspam10 X-Rspamd-Queue-Id: 38CC920181 X-Rspam-User: X-Stat-Signature: eh3me36mmaa8wbb4b4dsdx9k9nb6ghb5 Authentication-Results: imf03.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=gjJJ5MFR; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf03.hostedemail.com: domain of roman.gushchin@linux.dev designates 91.121.223.63 as permitted sender) smtp.mailfrom=roman.gushchin@linux.dev X-HE-Tag: 1660155017-255322 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, Aug 10, 2022 at 12:49:46PM -0400, Waiman Long wrote: > A circular locking problem is reported by lockdep due to the following > circular locking dependency. > > +--> cpu_hotplug_lock --> slab_mutex --> kn->active --+ > | | > +-----------------------------------------------------+ > > The forward cpu_hotplug_lock ==> slab_mutex ==> kn->active dependency > happens in > > kmem_cache_destroy(): cpus_read_lock(); mutex_lock(&slab_mutex); > ==> sysfs_slab_unlink() > ==> kobject_del() > ==> kernfs_remove() > ==> __kernfs_remove() > ==> kernfs_drain(): rwsem_acquire(&kn->dep_map, ...); > > The backward kn->active ==> cpu_hotplug_lock dependency happens in > > kernfs_fop_write_iter(): kernfs_get_active(); > ==> slab_attr_store() > ==> cpu_partial_store() > ==> flush_all(): cpus_read_lock() > > One way to break this circular locking chain is to avoid holding > cpu_hotplug_lock and slab_mutex while deleting the kobject in > sysfs_slab_unlink() which should be equivalent to doing a write_lock > and write_unlock pair of the kn->active virtual lock. > > Since the kobject structures are not protected by slab_mutex or the > cpu_hotplug_lock, we can certainly release those locks before doing > the delete operation. > > Move sysfs_slab_unlink() and sysfs_slab_release() to the newly > created kmem_cache_release() and call it outside the slab_mutex & > cpu_hotplug_lock critical sections. > > Signed-off-by: Waiman Long > --- > [v2] Break kmem_cache_release() helper into 2 separate ones. > > mm/slab_common.c | 54 +++++++++++++++++++++++++++++++++--------------- > 1 file changed, 37 insertions(+), 17 deletions(-) > > diff --git a/mm/slab_common.c b/mm/slab_common.c > index 17996649cfe3..7742d0446d8b 100644 > --- a/mm/slab_common.c > +++ b/mm/slab_common.c > @@ -392,6 +392,36 @@ kmem_cache_create(const char *name, unsigned int size, unsigned int align, > } > EXPORT_SYMBOL(kmem_cache_create); > > +#ifdef SLAB_SUPPORTS_SYSFS > +static void kmem_cache_workfn_release(struct kmem_cache *s) > +{ > + sysfs_slab_release(s); > +} > +#else > +static void kmem_cache_workfn_release(struct kmem_cache *s) > +{ > + slab_kmem_cache_release(s); > +} > +#endif > + > +/* > + * For a given kmem_cache, kmem_cache_destroy() should only be called > + * once or there will be a use-after-free problem. The actual deletion > + * and release of the kobject does not need slab_mutex or cpu_hotplug_lock > + * protection. So they are now done without holding those locks. > + */ > +static void kmem_cache_release(struct kmem_cache *s) > +{ > +#ifdef SLAB_SUPPORTS_SYSFS > + sysfs_slab_unlink(s); > +#endif > + > + if (s->flags & SLAB_TYPESAFE_BY_RCU) > + schedule_work(&slab_caches_to_rcu_destroy_work); > + else > + kmem_cache_workfn_release(s); > +} > + > static void slab_caches_to_rcu_destroy_workfn(struct work_struct *work) > { > LIST_HEAD(to_destroy); > @@ -418,11 +448,7 @@ static void slab_caches_to_rcu_destroy_workfn(struct work_struct *work) > list_for_each_entry_safe(s, s2, &to_destroy, list) { > debugfs_slab_release(s); > kfence_shutdown_cache(s); > -#ifdef SLAB_SUPPORTS_SYSFS > - sysfs_slab_release(s); > -#else > - slab_kmem_cache_release(s); > -#endif > + kmem_cache_workfn_release(s); > } > } > > @@ -437,20 +463,10 @@ static int shutdown_cache(struct kmem_cache *s) > list_del(&s->list); > > if (s->flags & SLAB_TYPESAFE_BY_RCU) { > -#ifdef SLAB_SUPPORTS_SYSFS > - sysfs_slab_unlink(s); > -#endif > list_add_tail(&s->list, &slab_caches_to_rcu_destroy); > - schedule_work(&slab_caches_to_rcu_destroy_work); Hi Waiman! This version is much more readable, thank you! But can we, please, leave this schedule_work(&slab_caches_to_rcu_destroy_work) call here? I don't see a good reason to move it, do I miss something? It's nice to have list_add_tail() and schedule_work() calls nearby, so it's obvious we can't miss the latter. Thanks!