From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6886DCD80B9 for ; Tue, 10 Oct 2023 12:03:09 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id B91B080043; Tue, 10 Oct 2023 08:03:08 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id B41EC8D0002; Tue, 10 Oct 2023 08:03:08 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A39FC80043; Tue, 10 Oct 2023 08:03:08 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 959A78D0002 for ; Tue, 10 Oct 2023 08:03:08 -0400 (EDT) Received: from smtpin04.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id AB9BA1A0348 for ; Tue, 10 Oct 2023 12:03:07 +0000 (UTC) X-FDA: 81329416014.04.0771E47 Received: from mgamail.intel.com (mgamail.intel.com [192.55.52.88]) by imf07.hostedemail.com (Postfix) with ESMTP id 3F6554001E for ; Tue, 10 Oct 2023 12:03:04 +0000 (UTC) Authentication-Results: imf07.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=mVYp0FXY; spf=pass (imf07.hostedemail.com: domain of andrzej.hajda@intel.com designates 192.55.52.88 as permitted sender) smtp.mailfrom=andrzej.hajda@intel.com; dmarc=pass (policy=none) header.from=intel.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1696939385; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=kn3Sm/V2VVNLCw+r9D4hL0wnnNRO3TvuxExHK7/iZ64=; b=NfTdjmlnOafXpNLgh0OoCi8w6x0zfjAVqwspZ6b3CXbk8kEpF0dunU0VX+qMh1b/56fGyF CPCK7hpUgPF89HjhymV47YVnS6g+Cci4AEYZnQWwJ4YM9Me+v3ieVMuTLp2OZAWGJ/ho18 MTUwngKVqbqfH7oqWONYhgqJtJbwirA= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1696939385; a=rsa-sha256; cv=none; b=T2/hm9Qicu7l6sXtxNDlY+rWVlZlOThjx+mFB4ZH/3wqieXN4tZaX3cx5FGuqS+plw6Fje aH6Fri9r8NYqjGUa8jMCegCPQTPjufgV4cT6XJY6vIwVd/z73KkNIveucjn5d5obeQ97uO xOip2+UHq1F4ftZLYLdkWAUFsfgniig= ARC-Authentication-Results: i=1; imf07.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=mVYp0FXY; spf=pass (imf07.hostedemail.com: domain of andrzej.hajda@intel.com designates 192.55.52.88 as permitted sender) smtp.mailfrom=andrzej.hajda@intel.com; dmarc=pass (policy=none) header.from=intel.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1696939384; x=1728475384; h=message-id:date:mime-version:subject:to:cc:references: from:in-reply-to:content-transfer-encoding; bh=a4c3M+Jokf+rlTYMTvfK4kVpcRX4L5tV26F4pNU+sFo=; b=mVYp0FXYjStRnVbyUOZEuNutkKAtKPYMjlRgpQALEKafiLBJm25C/odk 4GeKI4TiqOOI1Xcz9PNgxEb+SuDHy6Pbq/7e7XzBmJcoCU69agkXqkOgY bD0QnpW87vijCSfHXxAIRpXVT21lH7/Ti0bMjg3OMbbIleeVye6vwh5uE O0KQJKqEqvUTCPADIFqnoOUjs31/mBRg1iiq30IPz9uZCqjSZf/Uw0hM5 AZA6NPZH1KujDyz3JIfudXTrStB7gmq1twBtNVImpCEyVg7rWkNgLnkKy IHs/yFopVxjmtfbeR7QMExOFwwp0iUEg8rHCAYfsprhi3LRPdvZ7pj3cC w==; X-IronPort-AV: E=McAfee;i="6600,9927,10858"; a="415382897" X-IronPort-AV: E=Sophos;i="6.03,212,1694761200"; d="scan'208";a="415382897" Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 10 Oct 2023 05:02:59 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10858"; a="819214237" X-IronPort-AV: E=Sophos;i="6.03,212,1694761200"; d="scan'208";a="819214237" Received: from ahajda-mobl.ger.corp.intel.com (HELO [10.213.14.169]) ([10.213.14.169]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 10 Oct 2023 05:02:57 -0700 Message-ID: Date: Tue, 10 Oct 2023 14:02:54 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v2] debugobjects: stop accessing objects after releasing spinlock Content-Language: en-US To: linux-kernel@vger.kernel.org, intel-gfx@lists.freedesktop.org, linux-mm@kvack.org, Thomas Gleixner Cc: Andi Shyti , Nirmoy Das , Janusz Krzysztofik References: <20230925131359.2948827-1-andrzej.hajda@intel.com> From: Andrzej Hajda Organization: Intel Technology Poland sp. z o.o. - ul. Slowackiego 173, 80-298 Gdansk - KRS 101882 - NIP 957-07-52-316 In-Reply-To: <20230925131359.2948827-1-andrzej.hajda@intel.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Rspamd-Queue-Id: 3F6554001E X-Rspam-User: X-Stat-Signature: ya4auumqwdhuzz38fqwmyo5jnjwuzr43 X-Rspamd-Server: rspam03 X-HE-Tag: 1696939384-145295 X-HE-Meta: U2FsdGVkX1+EMnDjR3yHL4bUgSl8duAzIuK5EFJVGBI8QCCFCxJdY2lLs/Q/Nt2tirEz3e/SweRck7O6+rXQr4HppEBvM0KFqZtLgMvWy3V6sg0b7MsgBNkVYJ983zRn7wBEHynN/LpykIKUjWAGPK1ComMgMeivrs0MUpcr9uMOOKwVidKO+BcEPTTDc5FGOmJS0t1BRzw6GaYg7Ghw5znuG2hlIuLgnYF3K+CicW5233iHeASoIO8QhseJOxX0YJgFbnCjEL3gf9+ONGRQRWblhphx12XXTFHqaAdYB7Gi7SujgHuL/CEK+odmiU3y77u/LUfddQAvTw/Lk4N1/wfteUzS17OspaLALBg0IATZmTVpurcuEET7+WLzn3eyGIIhawSJaxZMz3hk8KfL0hfeoa91A+KV7/c93cPoCTULY8fF3zNdh6Jaa4PSYoujdZAbcoGqZDUR5V8WlYrCR4yatYEcweKUkdHD8OEi4veiJdfB8VD/v4AWJ/qVo4wubkYB8Z5H20rmAco9mZqPPslG4tL1oRgMe+wi/Hl+uHcZgjStsFpBwjjWSVZl7zu8z+yl/Gf1XxFd+QMm38twNdJ34f+dUEsPt5hO6lUQ0iuUHNKPQ7A9UIiG+CxG73vNdxsvYsz57TfL8k093wgttxuwgyDZz4E/p4L53MoE/vZHFUO0TRf5HE5Z9iruc0hX591Ws5xwbZRaWO6lMaRp98gKiv65ySbaLx1OqIyYE4oUNJ7ROihhIMUiSpiGAnfK+hu137ChCD1qSVrF5XIB4IGyUyWKKdvssl+J5SHlW570gWfBM/jerdhdDeEFz4X9xwnCZkPcCeg8ykx3g90oMWDBGY2KRKYdGoU3trmU+nZNZTF57vuFhW9N6IPiKiNY+HrfmlX1UYxgc5y7EW+hlR47Rop7YlfMhV1DpDsXOzwAKjdgFKP0qCiIlMc+dSkGBEs2B8GEmOheqnVpTNj V1kpsPk6 ofO1vQFTQxyErK2EJWVstugyfqE8tDifyPcLG4XbX/8L+nBSUM8Bg2s+4R3eLoMFqchZLBnrptne3Yk2DbpiLDEnxe4XKnleSCA/ccDdTp90S/mP099UTStphZEwE5NrmK6h2x/znYmi0TQQL1WijTmVfduR+KTn3EGu1+NxyQ5zpa9FM8FWX2Dku6Y9mx9HcNfEip9qeTvq22g2pHImZR2fZZosAZNwr94d4VnEjaEpqTJo= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 25.09.2023 15:13, Andrzej Hajda wrote: > After spinlock release object can be modified/freed by concurrent thread. > Using it in such case is error prone, even for printing object state. > To avoid such situation local copy of the object is created if necessary. > > Signed-off-by: Andrzej Hajda > --- > v2: add missing switch breaks > --- Ping, any volunteer to review? Regards Andrzej > lib/debugobjects.c | 206 +++++++++++++++++++++------------------------ > 1 file changed, 97 insertions(+), 109 deletions(-) > > diff --git a/lib/debugobjects.c b/lib/debugobjects.c > index a517256a270b71..3afff2f668fc1e 100644 > --- a/lib/debugobjects.c > +++ b/lib/debugobjects.c > @@ -620,9 +620,8 @@ static void debug_objects_fill_pool(void) > static void > __debug_object_init(void *addr, const struct debug_obj_descr *descr, int onstack) > { > - enum debug_obj_state state; > struct debug_bucket *db; > - struct debug_obj *obj; > + struct debug_obj *obj, o; > unsigned long flags; > > debug_objects_fill_pool(); > @@ -644,23 +643,19 @@ __debug_object_init(void *addr, const struct debug_obj_descr *descr, int onstack > case ODEBUG_STATE_INACTIVE: > obj->state = ODEBUG_STATE_INIT; > break; > - > - case ODEBUG_STATE_ACTIVE: > - state = obj->state; > - raw_spin_unlock_irqrestore(&db->lock, flags); > - debug_print_object(obj, "init"); > - debug_object_fixup(descr->fixup_init, addr, state); > - return; > - > - case ODEBUG_STATE_DESTROYED: > - raw_spin_unlock_irqrestore(&db->lock, flags); > - debug_print_object(obj, "init"); > - return; > default: > - break; > + o = *obj; > + obj = NULL; > } > > raw_spin_unlock_irqrestore(&db->lock, flags); > + > + if (obj) > + return; > + > + debug_print_object(&o, "init"); > + if (o.state == ODEBUG_STATE_ACTIVE) > + debug_object_fixup(descr->fixup_init, addr, o.state); > } > > /** > @@ -700,12 +695,9 @@ EXPORT_SYMBOL_GPL(debug_object_init_on_stack); > */ > int debug_object_activate(void *addr, const struct debug_obj_descr *descr) > { > - struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr }; > - enum debug_obj_state state; > struct debug_bucket *db; > - struct debug_obj *obj; > + struct debug_obj *obj, o; > unsigned long flags; > - int ret; > > if (!debug_objects_enabled) > return 0; > @@ -717,49 +709,47 @@ int debug_object_activate(void *addr, const struct debug_obj_descr *descr) > raw_spin_lock_irqsave(&db->lock, flags); > > obj = lookup_object_or_alloc(addr, db, descr, false, true); > - if (likely(!IS_ERR_OR_NULL(obj))) { > - bool print_object = false; > - > + if (unlikely(!obj)) { > + raw_spin_unlock_irqrestore(&db->lock, flags); > + debug_objects_oom(); > + return 0; > + } else if (likely(!IS_ERR(obj))) { > switch (obj->state) { > case ODEBUG_STATE_INIT: > case ODEBUG_STATE_INACTIVE: > obj->state = ODEBUG_STATE_ACTIVE; > - ret = 0; > break; > - > case ODEBUG_STATE_ACTIVE: > - state = obj->state; > - raw_spin_unlock_irqrestore(&db->lock, flags); > - debug_print_object(obj, "activate"); > - ret = debug_object_fixup(descr->fixup_activate, addr, state); > - return ret ? 0 : -EINVAL; > - > case ODEBUG_STATE_DESTROYED: > - print_object = true; > - ret = -EINVAL; > + o = *obj; > + obj = NULL; > break; > default: > - ret = 0; > break; > } > - raw_spin_unlock_irqrestore(&db->lock, flags); > - if (print_object) > - debug_print_object(obj, "activate"); > - return ret; > + } else { > + o.object = addr; > + o.state = ODEBUG_STATE_NOTAVAILABLE; > + o.descr = descr; > + obj = NULL; > } > > raw_spin_unlock_irqrestore(&db->lock, flags); > > - /* If NULL the allocation has hit OOM */ > - if (!obj) { > - debug_objects_oom(); > + if (obj) > return 0; > - } > > - /* Object is neither static nor tracked. It's not initialized */ > debug_print_object(&o, "activate"); > - ret = debug_object_fixup(descr->fixup_activate, addr, ODEBUG_STATE_NOTAVAILABLE); > - return ret ? 0 : -EINVAL; > + > + switch (o.state) { > + case ODEBUG_STATE_ACTIVE: > + case ODEBUG_STATE_NOTAVAILABLE: > + if (debug_object_fixup(descr->fixup_activate, addr, o.state)) > + return 0; > + fallthrough; > + default: > + return -EINVAL; > + } > } > EXPORT_SYMBOL_GPL(debug_object_activate); > > @@ -771,9 +761,8 @@ EXPORT_SYMBOL_GPL(debug_object_activate); > void debug_object_deactivate(void *addr, const struct debug_obj_descr *descr) > { > struct debug_bucket *db; > - struct debug_obj *obj; > + struct debug_obj *obj, o; > unsigned long flags; > - bool print_object = false; > > if (!debug_objects_enabled) > return; > @@ -788,30 +777,29 @@ void debug_object_deactivate(void *addr, const struct debug_obj_descr *descr) > case ODEBUG_STATE_INIT: > case ODEBUG_STATE_INACTIVE: > case ODEBUG_STATE_ACTIVE: > - if (!obj->astate) > + if (!obj->astate) { > obj->state = ODEBUG_STATE_INACTIVE; > - else > - print_object = true; > - break; > - > + break; > + } > + fallthrough; > case ODEBUG_STATE_DESTROYED: > - print_object = true; > + o = *obj; > + obj = NULL; > break; > default: > break; > } > + } else { > + o.object = addr; > + o.state = ODEBUG_STATE_NOTAVAILABLE; > + o.descr = descr; > + obj = NULL; > } > > raw_spin_unlock_irqrestore(&db->lock, flags); > - if (!obj) { > - struct debug_obj o = { .object = addr, > - .state = ODEBUG_STATE_NOTAVAILABLE, > - .descr = descr }; > > + if (!obj) > debug_print_object(&o, "deactivate"); > - } else if (print_object) { > - debug_print_object(obj, "deactivate"); > - } > } > EXPORT_SYMBOL_GPL(debug_object_deactivate); > > @@ -822,11 +810,9 @@ EXPORT_SYMBOL_GPL(debug_object_deactivate); > */ > void debug_object_destroy(void *addr, const struct debug_obj_descr *descr) > { > - enum debug_obj_state state; > struct debug_bucket *db; > - struct debug_obj *obj; > + struct debug_obj *obj, o; > unsigned long flags; > - bool print_object = false; > > if (!debug_objects_enabled) > return; > @@ -836,8 +822,10 @@ void debug_object_destroy(void *addr, const struct debug_obj_descr *descr) > raw_spin_lock_irqsave(&db->lock, flags); > > obj = lookup_object(addr, db); > - if (!obj) > - goto out_unlock; > + if (!obj) { > + raw_spin_unlock_irqrestore(&db->lock, flags); > + return; > + } > > switch (obj->state) { > case ODEBUG_STATE_NONE: > @@ -846,22 +834,23 @@ void debug_object_destroy(void *addr, const struct debug_obj_descr *descr) > obj->state = ODEBUG_STATE_DESTROYED; > break; > case ODEBUG_STATE_ACTIVE: > - state = obj->state; > - raw_spin_unlock_irqrestore(&db->lock, flags); > - debug_print_object(obj, "destroy"); > - debug_object_fixup(descr->fixup_destroy, addr, state); > - return; > - > case ODEBUG_STATE_DESTROYED: > - print_object = true; > + o = *obj; > + obj = NULL; > break; > default: > break; > } > -out_unlock: > + > raw_spin_unlock_irqrestore(&db->lock, flags); > - if (print_object) > - debug_print_object(obj, "destroy"); > + > + if (obj) > + return; > + > + debug_print_object(&o, "destroy"); > + > + if (o.state == ODEBUG_STATE_ACTIVE) > + debug_object_fixup(descr->fixup_destroy, addr, o.state); > } > EXPORT_SYMBOL_GPL(debug_object_destroy); > > @@ -872,9 +861,8 @@ EXPORT_SYMBOL_GPL(debug_object_destroy); > */ > void debug_object_free(void *addr, const struct debug_obj_descr *descr) > { > - enum debug_obj_state state; > struct debug_bucket *db; > - struct debug_obj *obj; > + struct debug_obj *obj, o; > unsigned long flags; > > if (!debug_objects_enabled) > @@ -885,24 +873,29 @@ void debug_object_free(void *addr, const struct debug_obj_descr *descr) > raw_spin_lock_irqsave(&db->lock, flags); > > obj = lookup_object(addr, db); > - if (!obj) > - goto out_unlock; > + if (!obj) { > + raw_spin_unlock_irqrestore(&db->lock, flags); > + return; > + } > > switch (obj->state) { > case ODEBUG_STATE_ACTIVE: > - state = obj->state; > - raw_spin_unlock_irqrestore(&db->lock, flags); > - debug_print_object(obj, "free"); > - debug_object_fixup(descr->fixup_free, addr, state); > - return; > + o = *obj; > + obj = NULL; > + break; > default: > hlist_del(&obj->node); > - raw_spin_unlock_irqrestore(&db->lock, flags); > + } > + > + raw_spin_unlock_irqrestore(&db->lock, flags); > + > + if (obj) { > free_object(obj); > return; > } > -out_unlock: > - raw_spin_unlock_irqrestore(&db->lock, flags); > + > + debug_print_object(&o, "free"); > + debug_object_fixup(descr->fixup_free, addr, o.state); > } > EXPORT_SYMBOL_GPL(debug_object_free); > > @@ -955,9 +948,8 @@ debug_object_active_state(void *addr, const struct debug_obj_descr *descr, > unsigned int expect, unsigned int next) > { > struct debug_bucket *db; > - struct debug_obj *obj; > + struct debug_obj *obj, o; > unsigned long flags; > - bool print_object = false; > > if (!debug_objects_enabled) > return; > @@ -970,28 +962,27 @@ debug_object_active_state(void *addr, const struct debug_obj_descr *descr, > if (obj) { > switch (obj->state) { > case ODEBUG_STATE_ACTIVE: > - if (obj->astate == expect) > + if (obj->astate == expect) { > obj->astate = next; > - else > - print_object = true; > - break; > - > + break; > + } > + fallthrough; > default: > - print_object = true; > + o = *obj; > + obj = NULL; > break; > } > + } else { > + o.object = addr; > + o.state = ODEBUG_STATE_NOTAVAILABLE; > + o.descr = descr; > + obj = NULL; > } > > raw_spin_unlock_irqrestore(&db->lock, flags); > - if (!obj) { > - struct debug_obj o = { .object = addr, > - .state = ODEBUG_STATE_NOTAVAILABLE, > - .descr = descr }; > > + if (!obj) > debug_print_object(&o, "active_state"); > - } else if (print_object) { > - debug_print_object(obj, "active_state"); > - } > } > EXPORT_SYMBOL_GPL(debug_object_active_state); > > @@ -999,11 +990,9 @@ EXPORT_SYMBOL_GPL(debug_object_active_state); > static void __debug_check_no_obj_freed(const void *address, unsigned long size) > { > unsigned long flags, oaddr, saddr, eaddr, paddr, chunks; > - const struct debug_obj_descr *descr; > - enum debug_obj_state state; > struct debug_bucket *db; > struct hlist_node *tmp; > - struct debug_obj *obj; > + struct debug_obj *obj, o; > int cnt, objs_checked = 0; > > saddr = (unsigned long) address; > @@ -1026,12 +1015,11 @@ static void __debug_check_no_obj_freed(const void *address, unsigned long size) > > switch (obj->state) { > case ODEBUG_STATE_ACTIVE: > - descr = obj->descr; > - state = obj->state; > + o = *obj; > raw_spin_unlock_irqrestore(&db->lock, flags); > - debug_print_object(obj, "free"); > - debug_object_fixup(descr->fixup_free, > - (void *) oaddr, state); > + debug_print_object(&o, "free"); > + debug_object_fixup(o.descr->fixup_free, > + (void *) oaddr, o.state); > goto repeat; > default: > hlist_del(&obj->node);