| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Sun, 30 Jan 2022 22:55:56 -0500
From: Waiman Long <longman@...hat.com>
To: Roman Gushchin <guro@...com>
Cc: Johannes Weiner <hannes@...xchg.org>,
Michal Hocko <mhocko@...nel.org>,
Vladimir Davydov <vdavydov.dev@...il.com>,
Andrew Morton <akpm@...ux-foundation.org>,
Vlastimil Babka <vbabka@...e.cz>, linux-kernel@...r.kernel.org,
cgroups@...r.kernel.org, linux-mm@...ck.org,
Shakeel Butt <shakeelb@...gle.com>,
Muchun Song <songmuchun@...edance.com>
Subject: Re: [PATCH 1/3] mm, memcg: Don't put offlined memcg into local stock
On 10/1/21 19:51, Roman Gushchin wrote:
> On Fri, Oct 01, 2021 at 03:09:36PM -0400, Waiman Long wrote:
>> When freeing a page associated with an offlined memcg, refill_stock()
>> will put it into local stock delaying its demise until another memcg
>> comes in to take its place in the stock. To avoid that, we now check
>> for offlined memcg and go directly in this case to the slowpath for
>> the uncharge via the repurposed cancel_charge() function.
> Hi Waiman!
>
> I'm afraid it can make a cleanup of a dying cgroup slower: for every
> released page we'll potentially traverse the whole cgroup tree and
> decrease atomic page counters.
>
> I'm not sure I understand the benefits we get from this change which
> do justify the slowdown on the cleanup path.
>
> Thanks!
I was notified of a lockdep splat that this patch may help to prevent.
[18073.102101] ======================================================
[18073.102101] WARNING: possible circular locking dependency detected
[18073.102101] 5.14.0-42.el9.x86_64+debug #1 Not tainted
[18073.102101] ------------------------------------------------------
[18073.102101] bz1567074_bin/420270 is trying to acquire lock:
[18073.102101] ffffffff9bdfc478 (css_set_lock){..-.}-{2:2}, at:
obj_cgroup_release+0x79/0x210
[18073.102101]
[18073.102101] but task is already holding lock:
[18073.102101] ffff88806ba4ef18 (&sighand->siglock){-...}-{2:2}, at:
force_sig_info_to_task+0x6c/0x370
[18073.102101]
[18073.102101] which lock already depends on the new lock.
[18073.102101]
[18073.102101]
[18073.102101] the existing dependency chain (in reverse order) is:
[18073.102101]
[18073.102101] -> #1 (&sighand->siglock){-...}-{2:2}:
[18073.102101] __lock_acquire+0xb72/0x1870
[18073.102101] lock_acquire.part.0+0x117/0x340
[18073.102101] _raw_spin_lock_irqsave+0x43/0x90
[18073.102101] __lock_task_sighand+0xa0/0x210
[18073.102101] cgroup_freeze_task+0x6f/0x150
[18073.102101] cgroup_migrate_execute+0x25f/0xf90
[18073.102101] cgroup_update_dfl_csses+0x417/0x4f0
[18073.102101] cgroup_subtree_control_write+0x67b/0xa10
[18073.102101] cgroup_file_write+0x1ef/0x6a0
[18073.102101] kernfs_fop_write_iter+0x2c7/0x460
[18073.102101] new_sync_write+0x36f/0x610
[18073.102101] vfs_write+0x5c6/0x890
[18073.102101] ksys_write+0xf9/0x1d0
[18073.102101] do_syscall_64+0x3b/0x90
[18073.102101] entry_SYSCALL_64_after_hwframe+0x44/0xae
[18073.102101]
[18073.102101] -> #0 (css_set_lock){..-.}-{2:2}:
[18073.102101] check_prev_add+0x15e/0x20f0
[18073.102101] validate_chain+0xac6/0xde0
[18073.102101] __lock_acquire+0xb72/0x1870
[18073.102101] lock_acquire.part.0+0x117/0x340
[18073.102101] _raw_spin_lock_irqsave+0x43/0x90
[18073.102101] obj_cgroup_release+0x79/0x210
[18073.102101] percpu_ref_put_many.constprop.0+0x16b/0x1a0
[18073.102101] drain_obj_stock+0x1a8/0x310
[18073.102101] refill_obj_stock+0xa4/0x480
[18073.102101] obj_cgroup_charge+0x104/0x240
[18073.102101] kmem_cache_alloc+0x94/0x400
[18073.102101] __sigqueue_alloc+0x1b9/0x460
[18073.102101] __send_signal+0x4b2/0xf60
[18073.102101] force_sig_info_to_task+0x226/0x370
[18073.102101] force_sig_fault+0xb0/0xf0
[18073.102101] noist_exc_debug+0xec/0x110
[18073.102101] asm_exc_debug+0x2b/0x30
[18073.102101]
[18073.102101] other info that might help us debug this:
[18073.102101]
[18073.102101] Possible unsafe locking scenario:
[18073.102101]
[18073.102101] CPU0 CPU1
[18073.102101] ---- ----
[18073.102101] lock(&sighand->siglock);
[18073.102101] lock(css_set_lock);
[18073.102101] lock(&sighand->siglock);
[18073.102101] lock(css_set_lock);
[18073.102101]
[18073.102101] *** DEADLOCK ***
[18073.102101]
[18073.102101] 2 locks held by bz1567074_bin/420270:
[18073.102101] #0: ffff88806ba4ef18 (&sighand->siglock){-...}-{2:2},
at: force_sig_info_to_task+0x6c/0x370
[18073.102101] #1: ffffffff9bd0ea00 (rcu_read_lock){....}-{1:2}, at:
percpu_ref_put_many.constprop.0+0x0/0x1a0
[18073.102101]
[18073.102101] stack backtrace:
[18073.102101] CPU: 0 PID: 420270 Comm: bz1567074_bin Kdump: loaded Not
tainted 5.14.0-42.el9.x86_64+debug #1
[18073.102101] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2007
[18073.102101] Call Trace:
[18073.102101] dump_stack_lvl+0x57/0x7d
[18073.102101] check_noncircular+0x26a/0x310
[18073.102101] ? pvclock_clocksource_read+0x2b8/0x520
[18073.102101] ? print_circular_bug+0x1f0/0x1f0
[18073.102101] ? alloc_chain_hlocks+0x1de/0x530
[18073.102101] check_prev_add+0x15e/0x20f0
[18073.102101] validate_chain+0xac6/0xde0
[18073.102101] ? check_prev_add+0x20f0/0x20f0
[18073.102101] __lock_acquire+0xb72/0x1870
[18073.102101] ? __lock_acquire+0xb72/0x1870
[18073.102101] lock_acquire.part.0+0x117/0x340
[18073.102101] ? obj_cgroup_release+0x79/0x210
[18073.102101] ? rcu_read_unlock+0x40/0x40
[18073.102101] ? rcu_read_lock_sched_held+0x3f/0x70
[18073.102101] ? lock_acquire+0x224/0x2d0
[18073.102101] ? obj_cgroup_release+0x79/0x210
[18073.102101] _raw_spin_lock_irqsave+0x43/0x90
[18073.102101] ? obj_cgroup_release+0x79/0x210
[18073.102101] obj_cgroup_release+0x79/0x210
[18073.102101] percpu_ref_put_many.constprop.0+0x16b/0x1a0
[18073.102101] drain_obj_stock+0x1a8/0x310
[18073.102101] refill_obj_stock+0xa4/0x480
[18073.102101] obj_cgroup_charge+0x104/0x240
[18073.102101] ? __sigqueue_alloc+0x1b9/0x460
[18073.102101] kmem_cache_alloc+0x94/0x400
[18073.102101] ? __sigqueue_alloc+0x129/0x460
[18073.102101] __sigqueue_alloc+0x1b9/0x460
[18073.102101] __send_signal+0x4b2/0xf60
[18073.102101] ? send_signal+0x9f/0x580
[18073.102101] force_sig_info_to_task+0x226/0x370
[18073.102101] force_sig_fault+0xb0/0xf0
[18073.102101] ? force_sig_fault_to_task+0xe0/0xe0
[18073.102101] ? asm_exc_debug+0x23/0x30
[18073.102101] ? notify_die+0x88/0x100
[18073.102101] ? asm_exc_debug+0x23/0x30
[18073.102101] noist_exc_debug+0xec/0x110
[18073.102101] asm_exc_debug+0x2b/0x30
The &sighand->siglock => css_set_lock locking sequence is caused by a
task holding sighand->siglock and call kmem_cache_alloc(GFP_ATOMIC) and
the release of the obj_cgroup originally from an offlined memcg in
percpu stock leading to the call of obj_cgroup_release() which takes the
cs_set_lock. The chance of hitting that is very small, but it can still
happen. So do you think addressing this possible deadlock scenario is
worth the possible slower release of an offlined memcg?
Cheers,
Longman
>> Signed-off-by: Waiman Long <longman@...hat.com>
>> ---
>> mm/memcontrol.c | 16 +++++++++++-----
>> 1 file changed, 11 insertions(+), 5 deletions(-)
>>
>> diff --git a/mm/memcontrol.c b/mm/memcontrol.c
>> index 4b32896d87a2..4568363062c1 100644
>> --- a/mm/memcontrol.c
>> +++ b/mm/memcontrol.c
>> @@ -2167,6 +2167,8 @@ static bool consume_stock(struct mem_cgroup *memcg, unsigned int nr_pages)
>> return ret;
>> }
>>
>> +static void cancel_charge(struct mem_cgroup *memcg, unsigned int nr_pages);
>> +
>> /*
>> * Returns stocks cached in percpu and reset cached information.
>> */
>> @@ -2178,9 +2180,7 @@ static void drain_stock(struct memcg_stock_pcp *stock)
>> return;
>>
>> if (stock->nr_pages) {
>> - page_counter_uncharge(&old->memory, stock->nr_pages);
>> - if (do_memsw_account())
>> - page_counter_uncharge(&old->memsw, stock->nr_pages);
>> + cancel_charge(old, stock->nr_pages);
>> stock->nr_pages = 0;
>> }
>>
>> @@ -2219,6 +2219,14 @@ static void refill_stock(struct mem_cgroup *memcg, unsigned int nr_pages)
>> struct memcg_stock_pcp *stock;
>> unsigned long flags;
>>
>> + /*
>> + * An offlined memcg shouldn't be put into stock.
>> + */
>> + if (unlikely(memcg->kmem_state != KMEM_ONLINE)) {
>> + cancel_charge(memcg, nr_pages);
>> + return;
>> + }
>> +
>> local_irq_save(flags);
>>
>> stock = this_cpu_ptr(&memcg_stock);
>> @@ -2732,7 +2740,6 @@ static inline int try_charge(struct mem_cgroup *memcg, gfp_t gfp_mask,
>> return try_charge_memcg(memcg, gfp_mask, nr_pages);
>> }
>>
>> -#if defined(CONFIG_MEMCG_KMEM) || defined(CONFIG_MMU)
>> static void cancel_charge(struct mem_cgroup *memcg, unsigned int nr_pages)
>> {
>> if (mem_cgroup_is_root(memcg))
>> @@ -2742,7 +2749,6 @@ static void cancel_charge(struct mem_cgroup *memcg, unsigned int nr_pages)
>> if (do_memsw_account())
>> page_counter_uncharge(&memcg->memsw, nr_pages);
>> }
>> -#endif
>>
>> static void commit_charge(struct folio *folio, struct mem_cgroup *memcg)
>> {
>> --
>> 2.18.1
>>
Powered by blists - more mailing lists