linux-kernel - [PATCH v2] vmscan: Do not free nr_deferred for memcg aware shrinkers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 28 Jul 2022 17:13:41 +0800
From:   tujinjiang@...edance.com
To:     mhocko@...e.com
Cc:     shy828301@...il.com, akpm@...ux-foundation.org, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org,
        Jinjiang Tu <tujinjiang@...edance.com>
Subject: [PATCH v2] vmscan: Do not free nr_deferred for memcg aware shrinkers

From: Jinjiang Tu <tujinjiang@...edance.com>

When a memcg aware shrinker is registered by register_shrinker(),
shrinker->nr_deferred will not be initialized. But when the shrinker
is unregistered by unregister_shrinker(), shrinker->nr_deferred
will be freed.

Luckily, the memcg aware shrinkers in the current kernel are pre-zeroed.
But a new memcg aware shrinker may be added in the future, and we should
not assume the shrinker is pre-zeroed.

Another unregister API free_prealloced_shrinker() does not assume the
shrinker is pre-zered and free shrinker->nr_deferred only if it is
not memcg aware. So unregister_shrinker() should do like
free_prealloced_shrinker().

Signed-off-by: Jinjiang Tu <tujinjiang@...edance.com>
---
 mm/vmscan.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/mm/vmscan.c b/mm/vmscan.c
index f7d9a683e3a7..f8a9a5349b6e 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -675,8 +675,11 @@ void unregister_shrinker(struct shrinker *shrinker)
 	down_write(&shrinker_rwsem);
 	list_del(&shrinker->list);
 	shrinker->flags &= ~SHRINKER_REGISTERED;
-	if (shrinker->flags & SHRINKER_MEMCG_AWARE)
+	if (shrinker->flags & SHRINKER_MEMCG_AWARE) {
 		unregister_memcg_shrinker(shrinker);
+		up_write(&shrinker_rwsem);
+		return;
+	}
 	up_write(&shrinker_rwsem);

 	kfree(shrinker->nr_deferred);
-- 
2.17.1