linux-kernel - Re: [PATCH] slab, slub: skip unnecessary kasan_cache

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 28 Mar 2018 20:03:20 +0300
From:   Andrey Ryabinin <aryabinin@...tuozzo.com>
To:     Shakeel Butt <shakeelb@...gle.com>,
        Vladimir Davydov <vdavydov.dev@...il.com>,
        Alexander Potapenko <glider@...gle.com>,
        Greg Thelen <gthelen@...gle.com>,
        Dmitry Vyukov <dvyukov@...gle.com>,
        Christoph Lameter <cl@...ux.com>,
        Pekka Enberg <penberg@...nel.org>,
        David Rientjes <rientjes@...gle.com>,
        Joonsoo Kim <iamjoonsoo.kim@....com>,
        Andrew Morton <akpm@...ux-foundation.org>
Cc:     linux-mm@...ck.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] slab, slub: skip unnecessary kasan_cache_shutdown()



On 03/28/2018 02:06 AM, Shakeel Butt wrote:
> The kasan quarantine is designed to delay freeing slab objects to catch
> use-after-free. The quarantine can be large (several percent of machine
> memory size). When kmem_caches are deleted related objects are flushed
> from the quarantine but this requires scanning the entire quarantine
> which can be very slow. We have seen the kernel busily working on this
> while holding slab_mutex and badly affecting cache_reaper, slabinfo
> readers and memcg kmem cache creations.
> 
> It can easily reproduced by following script:
> 
> 	yes . | head -1000000 | xargs stat > /dev/null
> 	for i in `seq 1 10`; do
> 		seq 500 | (cd /cg/memory && xargs mkdir)
> 		seq 500 | xargs -I{} sh -c 'echo $BASHPID > \
> 			/cg/memory/{}/tasks && exec stat .' > /dev/null
> 		seq 500 | (cd /cg/memory && xargs rmdir)
> 	done
> 
> The busy stack:
>     kasan_cache_shutdown
>     shutdown_cache
>     memcg_destroy_kmem_caches
>     mem_cgroup_css_free
>     css_free_rwork_fn
>     process_one_work
>     worker_thread
>     kthread
>     ret_from_fork
> 
> This patch is based on the observation that if the kmem_cache to be
> destroyed is empty then there should not be any objects of this cache in
> the quarantine.
> 
> Without the patch the script got stuck for couple of hours. With the
> patch the script completed within a second.
> 
> Signed-off-by: Shakeel Butt <shakeelb@...gle.com>
> 

Acked-by: Andrey Ryabinin <aryabinin@...tuozzo.com>