| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <c8f6933e-f733-4f86-c09d-8028ad862f33@google.com>
Date: Mon, 1 Sep 2025 00:50:29 -0700 (PDT)
From: David Rientjes <rientjes@...gle.com>
To: yangshiguang1011@....com
cc: harry.yoo@...cle.com, vbabka@...e.cz, akpm@...ux-foundation.org,
cl@...two.org, roman.gushchin@...ux.dev, glittao@...il.com,
linux-mm@...ck.org, linux-kernel@...r.kernel.org,
yangshiguang <yangshiguang@...omi.com>, stable@...r.kernel.org
Subject: Re: [PATCH v4] mm: slub: avoid wake up kswapd in set_track_prepare
On Sat, 30 Aug 2025, yangshiguang1011@....com wrote:
> From: yangshiguang <yangshiguang@...omi.com>
>
> From: yangshiguang <yangshiguang@...omi.com>
>
Duplicate lines.
> set_track_prepare() can incur lock recursion.
> The issue is that it is called from hrtimer_start_range_ns
> holding the per_cpu(hrtimer_bases)[n].lock, but when enabled
> CONFIG_DEBUG_OBJECTS_TIMERS, may wake up kswapd in set_track_prepare,
> and try to hold the per_cpu(hrtimer_bases)[n].lock.
>
> Avoid deadlock caused by implicitly waking up kswapd by
> passing in allocation flags. And the slab caller context has
> preemption disabled, so __GFP_KSWAPD_RECLAIM must not appear in gfp_flags.
>
This mentions __GFP_KSWAPD_RECLAIM, but the patch actually masks off
__GFP_DIRECT_RECLAIM which would be a heavierweight operation. Disabling
direct reclaim does not necessarily imply that kswapd will be disabled as
well.
Are you meaning to clear __GFP_RECLAIM in set_track_prepare()?
> The oops looks something like:
>
> BUG: spinlock recursion on CPU#3, swapper/3/0
> lock: 0xffffff8a4bf29c80, .magic: dead4ead, .owner: swapper/3/0, .owner_cpu: 3
> Hardware name: Qualcomm Technologies, Inc. Popsicle based on SM8850 (DT)
> Call trace:
> spin_bug+0x0
> _raw_spin_lock_irqsave+0x80
> hrtimer_try_to_cancel+0x94
> task_contending+0x10c
> enqueue_dl_entity+0x2a4
> dl_server_start+0x74
> enqueue_task_fair+0x568
> enqueue_task+0xac
> do_activate_task+0x14c
> ttwu_do_activate+0xcc
> try_to_wake_up+0x6c8
> default_wake_function+0x20
> autoremove_wake_function+0x1c
> __wake_up+0xac
> wakeup_kswapd+0x19c
> wake_all_kswapds+0x78
> __alloc_pages_slowpath+0x1ac
> __alloc_pages_noprof+0x298
> stack_depot_save_flags+0x6b0
> stack_depot_save+0x14
> set_track_prepare+0x5c
> ___slab_alloc+0xccc
> __kmalloc_cache_noprof+0x470
> __set_page_owner+0x2bc
> post_alloc_hook[jt]+0x1b8
> prep_new_page+0x28
> get_page_from_freelist+0x1edc
> __alloc_pages_noprof+0x13c
> alloc_slab_page+0x244
> allocate_slab+0x7c
> ___slab_alloc+0x8e8
> kmem_cache_alloc_noprof+0x450
> debug_objects_fill_pool+0x22c
> debug_object_activate+0x40
> enqueue_hrtimer[jt]+0xdc
> hrtimer_start_range_ns+0x5f8
> ...
>
> Signed-off-by: yangshiguang <yangshiguang@...omi.com>
> Fixes: 5cf909c553e9 ("mm/slub: use stackdepot to save stack trace in objects")
> Cc: stable@...r.kernel.org
> ---
>
> v1 -> v2:
> propagate gfp flags to set_track_prepare()
> v2 -> v3:
> Remove the gfp restriction in set_track_prepare()
> v3 -> v4:
> Re-describe the comments in set_track_prepare.
>
> [1]https://lore.kernel.org/all/20250801065121.876793-1-yangshiguang1011@163.com/
> [2]https://lore.kernel.org/all/20250814111641.380629-2-yangshiguang1011@163.com/
> [3]https://lore.kernel.org/all/20250825121737.2535732-1-yangshiguang1011@163.com/
> ---
> mm/slub.c | 26 ++++++++++++++++----------
> 1 file changed, 16 insertions(+), 10 deletions(-)
>
> diff --git a/mm/slub.c b/mm/slub.c
> index 30003763d224..b0af51a5321b 100644
> --- a/mm/slub.c
> +++ b/mm/slub.c
> @@ -962,19 +962,25 @@ static struct track *get_track(struct kmem_cache *s, void *object,
> }
>
> #ifdef CONFIG_STACKDEPOT
> -static noinline depot_stack_handle_t set_track_prepare(void)
> +static noinline depot_stack_handle_t set_track_prepare(gfp_t gfp_flags)
> {
> depot_stack_handle_t handle;
> unsigned long entries[TRACK_ADDRS_COUNT];
> unsigned int nr_entries;
> + /*
> + * Preemption is disabled in ___slab_alloc() so we need to disallow
> + * blocking. The flags are further adjusted by gfp_nested_mask() in
> + * stack_depot itself.
> + */
> + gfp_flags &= ~(__GFP_DIRECT_RECLAIM);
>
> nr_entries = stack_trace_save(entries, ARRAY_SIZE(entries), 3);
> - handle = stack_depot_save(entries, nr_entries, GFP_NOWAIT);
> + handle = stack_depot_save(entries, nr_entries, gfp_flags);
>
> return handle;
> }
> #else
> -static inline depot_stack_handle_t set_track_prepare(void)
> +static inline depot_stack_handle_t set_track_prepare(gfp_t gfp_flags)
> {
> return 0;
> }
> @@ -996,9 +1002,9 @@ static void set_track_update(struct kmem_cache *s, void *object,
> }
>
> static __always_inline void set_track(struct kmem_cache *s, void *object,
> - enum track_item alloc, unsigned long addr)
> + enum track_item alloc, unsigned long addr, gfp_t gfp_flags)
> {
> - depot_stack_handle_t handle = set_track_prepare();
> + depot_stack_handle_t handle = set_track_prepare(gfp_flags);
>
> set_track_update(s, object, alloc, addr, handle);
> }
> @@ -1921,9 +1927,9 @@ static inline bool free_debug_processing(struct kmem_cache *s,
> static inline void slab_pad_check(struct kmem_cache *s, struct slab *slab) {}
> static inline int check_object(struct kmem_cache *s, struct slab *slab,
> void *object, u8 val) { return 1; }
> -static inline depot_stack_handle_t set_track_prepare(void) { return 0; }
> +static inline depot_stack_handle_t set_track_prepare(gfp_t gfp_flags) { return 0; }
> static inline void set_track(struct kmem_cache *s, void *object,
> - enum track_item alloc, unsigned long addr) {}
> + enum track_item alloc, unsigned long addr, gfp_t gfp_flags) {}
> static inline void add_full(struct kmem_cache *s, struct kmem_cache_node *n,
> struct slab *slab) {}
> static inline void remove_full(struct kmem_cache *s, struct kmem_cache_node *n,
> @@ -3878,7 +3884,7 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node,
> * tracking info and return the object.
> */
> if (s->flags & SLAB_STORE_USER)
> - set_track(s, freelist, TRACK_ALLOC, addr);
> + set_track(s, freelist, TRACK_ALLOC, addr, gfpflags);
>
> return freelist;
> }
> @@ -3910,7 +3916,7 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node,
> goto new_objects;
>
> if (s->flags & SLAB_STORE_USER)
> - set_track(s, freelist, TRACK_ALLOC, addr);
> + set_track(s, freelist, TRACK_ALLOC, addr, gfpflags);
>
> return freelist;
> }
> @@ -4422,7 +4428,7 @@ static noinline void free_to_partial_list(
> depot_stack_handle_t handle = 0;
>
> if (s->flags & SLAB_STORE_USER)
> - handle = set_track_prepare();
> + handle = set_track_prepare(__GFP_NOWARN);
>
> spin_lock_irqsave(&n->list_lock, flags);
>
> --
> 2.43.0
>
>
Powered by blists - more mailing lists