linux-kernel - Re: [PATCH v2] mm, slab: clean up slab->obj

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJuCfpGwspnceQ5oq_ovViHnawcVCkM1pKawJGckfKsvK1s_Aw@mail.gmail.com>
Date: Mon, 21 Apr 2025 09:02:06 -0700
From: Suren Baghdasaryan <surenb@...gle.com>
To: Zhenhua Huang <quic_zhenhuah@...cinc.com>
Cc: cl@...ux.com, rientjes@...gle.com, vbabka@...e.cz, 
	roman.gushchin@...ux.dev, harry.yoo@...cle.com, pasha.tatashin@...een.com, 
	akpm@...ux-foundation.org, linux-mm@...ck.org, linux-kernel@...r.kernel.org, 
	quic_tingweiz@...cinc.com, stable@...r.kernel.org
Subject: Re: [PATCH v2] mm, slab: clean up slab->obj_exts always

On Mon, Apr 21, 2025 at 12:52 AM Zhenhua Huang
<quic_zhenhuah@...cinc.com> wrote:
>
> When memory allocation profiling is disabled at runtime or due to an
> error, shutdown_mem_profiling() is called: slab->obj_exts which
> previously allocated remains.
> It won't be cleared by unaccount_slab() because of
> mem_alloc_profiling_enabled() not true. It's incorrect, slab->obj_exts
> should always be cleaned up in unaccount_slab() to avoid following error:
>
> [...]BUG: Bad page state in process...
> ..
> [...]page dumped because: page still charged to cgroup
>
> Cc: stable@...r.kernel.org
> Fixes: 21c690a349ba ("mm: introduce slabobj_ext to support slab object extensions")
> Signed-off-by: Zhenhua Huang <quic_zhenhuah@...cinc.com>
> Acked-by: David Rientjes <rientjes@...gle.com>
> Acked-by: Harry Yoo <harry.yoo@...cle.com>
> Tested-by: Harry Yoo <harry.yoo@...cle.com>

Acked-by: Suren Baghdasaryan <surenb@...gle.com>

> ---
>  mm/slub.c | 12 ++++++++----
>  1 file changed, 8 insertions(+), 4 deletions(-)
>
> diff --git a/mm/slub.c b/mm/slub.c
> index 566eb8b8282d..a98ce1426076 100644
> --- a/mm/slub.c
> +++ b/mm/slub.c
> @@ -2028,8 +2028,8 @@ int alloc_slab_obj_exts(struct slab *slab, struct kmem_cache *s,
>         return 0;
>  }
>
> -/* Should be called only if mem_alloc_profiling_enabled() */
> -static noinline void free_slab_obj_exts(struct slab *slab)
> +/* Free only if slab_obj_exts(slab) */

nit: the above comment is unnecessary. It's quite obvious from the code.

> +static inline void free_slab_obj_exts(struct slab *slab)
>  {
>         struct slabobj_ext *obj_exts;
>
> @@ -2601,8 +2601,12 @@ static __always_inline void account_slab(struct slab *slab, int order,
>  static __always_inline void unaccount_slab(struct slab *slab, int order,
>                                            struct kmem_cache *s)
>  {
> -       if (memcg_kmem_online() || need_slab_obj_ext())
> -               free_slab_obj_exts(slab);
> +       /*
> +        * The slab object extensions should now be freed regardless of
> +        * whether mem_alloc_profiling_enabled() or not because profiling
> +        * might have been disabled after slab->obj_exts got allocated.
> +        */
> +       free_slab_obj_exts(slab);
>
>         mod_node_page_state(slab_pgdat(slab), cache_vmstat_idx(s),
>                             -(PAGE_SIZE << order));
> --
> 2.34.1
>