linux-kernel - Re: [PATCH] slab: Fix using this_cpu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAADnVQJ-bkd2UVsZmhdb1L5ZrXjZbTnRcaJ-D=ojsoiRHmHwaw@mail.gmail.com>
Date: Tue, 30 Sep 2025 13:19:15 +0200
From: Alexei Starovoitov <alexei.starovoitov@...il.com>
To: Harry Yoo <harry.yoo@...cle.com>
Cc: ranxiaokai627@....com, Vlastimil Babka <vbabka@...e.cz>, 
	Andrew Morton <akpm@...ux-foundation.org>, cl@...two.org, 
	David Rientjes <rientjes@...gle.com>, Roman Gushchin <roman.gushchin@...ux.dev>, 
	Alexei Starovoitov <ast@...nel.org>, LKML <linux-kernel@...r.kernel.org>, 
	linux-mm <linux-mm@...ck.org>, ran.xiaokai@....com.cn
Subject: Re: [PATCH] slab: Fix using this_cpu_ptr() in preemptible context

On Tue, Sep 30, 2025 at 12:54 PM Harry Yoo <harry.yoo@...cle.com> wrote:
>
> On Tue, Sep 30, 2025 at 08:34:02AM +0000, ranxiaokai627@....com wrote:
> > From: Ran Xiaokai <ran.xiaokai@....com.cn>
> >
> > defer_free() maybe called in preemptible context, this will
> > trigger the below warning message:
> >
> > BUG: using smp_processor_id() in preemptible [00000000] code: swapper/0/1
> > caller is defer_free+0x1b/0x60
> > Call Trace:
> >  <TASK>
> >  dump_stack_lvl+0xac/0xc0
> >  check_preemption_disabled+0xbe/0xe0
> >  defer_free+0x1b/0x60
> >  kfree_nolock+0x1eb/0x2b0
> >  alloc_slab_obj_exts+0x356/0x390

Please share config and repro details, since the stack trace
looks theoretical, but you somehow got it?
This is not CONFIG_SLUB_TINY, but kfree_nolock()
sees locked per-cpu slab?
Is this PREEMPT_RT ?

> >  __alloc_tagging_slab_alloc_hook+0xa0/0x300
> >  __kmalloc_cache_noprof+0x1c4/0x5c0
> >  __set_page_owner+0x10d/0x1c0
> >  post_alloc_hook+0x84/0xf0
> >  get_page_from_freelist+0x73b/0x1380
> >  __alloc_frozen_pages_noprof+0x110/0x2c0
> >  alloc_pages_mpol+0x44/0x140
> >  alloc_slab_page+0xac/0x150
> >  allocate_slab+0x78/0x3a0
> >  ___slab_alloc+0x76b/0xed0
> >  __slab_alloc.constprop.0+0x5a/0xb0
> >  __kmalloc_noprof+0x3dc/0x6d0
> >  __list_lru_init+0x6c/0x210
> >  alloc_super+0x3b6/0x470
> >  sget_fc+0x5f/0x3a0
> >  get_tree_nodev+0x27/0x90
> >  vfs_get_tree+0x26/0xc0
> >  vfs_kern_mount.part.0+0xb6/0x140
> >  kern_mount+0x24/0x40
> >  init_pipe_fs+0x4f/0x70
> >  do_one_initcall+0x62/0x2e0
> >  kernel_init_freeable+0x25b/0x4b0
> >  kernel_init+0x1a/0x1c0
> >  ret_from_fork+0x290/0x2e0
> >  ret_from_fork_asm+0x11/0x20
> > </TASK>
> >
> > Replace this_cpu_ptr with raw_cpu_ptr to eliminate
> > the above warning message.
> >
> > Fixes: af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().")
>
> There's no mainline commit hash yet, should be adjusted later.
>
> > Signed-off-by: Ran Xiaokai <ran.xiaokai@....com.cn>
> > ---
> >  mm/slub.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/mm/slub.c b/mm/slub.c
> > index 1433f5b988f7..67c57f1b5a86 100644
> > --- a/mm/slub.c
> > +++ b/mm/slub.c
> > @@ -6432,7 +6432,7 @@ static void free_deferred_objects(struct irq_work *work)
> >
> >  static void defer_free(struct kmem_cache *s, void *head)
> >  {
> > -     struct defer_free *df = this_cpu_ptr(&defer_free_objects);
> > +     struct defer_free *df = raw_cpu_ptr(&defer_free_objects);
>
> This suppresses warning, but let's answer the question;
> Is it actually safe to not disable preemption here?
>
> >       if (llist_add(head + s->offset, &df->objects))
>
> Let's say a task was running on CPU X and migrated to a different CPU
> (say, Y) after returning from llist_add() or before calling llist_add(),
> then we're queueing the irq_work of CPU X on CPU Y.
>
> I think technically this should be safe because, although we're using
> per-cpu irq_work here, the irq_work framework itself is designed to handle
> concurrent access from multiple CPUs (otherwise it won't be safe to use
> a global irq_work like in other places) by using lockless list, which
> uses try_cmpxchg() and xchg() for atomic update.
>
> So if I'm not missing something it should be safe, but it was very
> confusing to confirm that it's safe as we're using per-cpu irq_work...
>
> I don't think these paths are very performance critical, so why not disable
> preemption instead of replacing it with raw_cpu_ptr()?

+1.
Though irq_work_queue() works for any irq_work it should
be used for current cpu, since it IPIs itself.
So pls use guard(preempt)(); instead.