linux-kernel - Re: [PATCH] mm, slab: clean up slab->obj

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJuCfpFEoGaczKvL-fpd=tzaHvPa5xU6gMWTzp6=OPxYcxBVsA@mail.gmail.com>
Date: Fri, 18 Apr 2025 16:09:00 -0700
From: Suren Baghdasaryan <surenb@...gle.com>
To: Harry Yoo <harry.yoo@...cle.com>
Cc: Zhenhua Huang <quic_zhenhuah@...cinc.com>, cl@...ux.com, rientjes@...gle.com, 
	vbabka@...e.cz, roman.gushchin@...ux.dev, pasha.tatashin@...een.com, 
	akpm@...ux-foundation.org, linux-mm@...ck.org, linux-kernel@...r.kernel.org, 
	quic_tingweiz@...cinc.com
Subject: Re: [PATCH] mm, slab: clean up slab->obj_exts always

On Fri, Apr 18, 2025 at 8:17 AM Harry Yoo <harry.yoo@...cle.com> wrote:
>
> On Fri, Apr 18, 2025 at 02:14:59PM +0800, Zhenhua Huang wrote:
> > When memory allocation profiling is disabled at runtime or due to an
> > error, shutdown_mem_profiling() is called: slab->obj_exts which
> > previously allocated remains.
> > It won't be cleared by unaccount_slab() because of
> > mem_alloc_profiling_enabled() not true. It's incorrect, slab->obj_exts
> > should always be cleaned up in unaccount_slab() to avoid following error:
> >
> > [...]BUG: Bad page state in process...
> > ..
> > [...]page dumped because: page still charged to cgroup
> >
> > Fixes: 21c690a349baa ("mm: introduce slabobj_ext to support slab object extensions")
> > Signed-off-by: Zhenhua Huang <quic_zhenhuah@...cinc.com>

Thanks for reporting and fixing the issue!

> > ---
>
> Acked-by: Harry Yoo <harry.yoo@...cle.com>
>
> I reproduced the issue locally and confirmed that this patch fixes
> the issue.
>
> Tested-by: Harry Yoo <harry.yoo@...cle.com>
>
> By the way, I think this should probably be backported to -stable?
>
> --
> Cheers,
> Harry / Hyeonggon
>
> >  mm/slub.c | 8 ++++++--
> >  1 file changed, 6 insertions(+), 2 deletions(-)
> >
> > diff --git a/mm/slub.c b/mm/slub.c
> > index dac149df1be1..b42ce3a88806 100644
> > --- a/mm/slub.c
> > +++ b/mm/slub.c
> > @@ -2023,7 +2023,7 @@ int alloc_slab_obj_exts(struct slab *slab, struct kmem_cache *s,
> >       return 0;
> >  }
> >
> > -/* Should be called only if mem_alloc_profiling_enabled() */
> > +/* Should be called if slab_obj_exts(slab) */
> >  static noinline void free_slab_obj_exts(struct slab *slab)
> >  {
> >       struct slabobj_ext *obj_exts;
> > @@ -2592,7 +2592,11 @@ static __always_inline void account_slab(struct slab *slab, int order,
> >  static __always_inline void unaccount_slab(struct slab *slab, int order,
> >                                          struct kmem_cache *s)
> >  {
> > -     if (memcg_kmem_online() || need_slab_obj_ext())
> > +     /*
> > +      * The slab object extensions should now be freed regardless of
> > +      * whether mem_alloc_profiling_enabled() or not now.

This comment does not explain why. I amended it in my suggestion below.

> > +      */
> > +     if (memcg_kmem_online() || slab_obj_exts(slab))
> >               free_slab_obj_exts(slab);

free_slab_obj_exts() will be checking again that for
slab_obj_exts(slab) != NULL. Since this change effectively removes the
static key check (mem_alloc_profiling_enabled() call inside
need_slab_obj_ext()), I think we can simply make free_slab_obj_exts()
inline function and remove the above condition completely. IOW:

static inline void free_slab_obj_exts(struct slab *slab)
{
        struct slabobj_ext *obj_exts;

        obj_exts = slab_obj_exts(slab);
        if (!obj_exts)
                return;
        ...
        slab->obj_exts = 0;
}

static __always_inline void unaccount_slab(...)
{
     /*
      * The slab object extensions should be freed regardless of
      * whether mem_alloc_profiling_enabled() or not because profiling
      * might have been disabled after slab->obj_exts got allocated.
      */
      free_slab_obj_exts(slab);
      ...
}

> >
> >       mod_node_page_state(slab_pgdat(slab), cache_vmstat_idx(s),
> > --
> > 2.25.1
> >
> >