netdev - Re: [PATCH] Revert "batman-adv: prefer kfree_rcu() over call

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZmnL4jkhJLIW924W@pc636>
Date: Wed, 12 Jun 2024 18:25:06 +0200
From: Uladzislau Rezki <urezki@...il.com>
To: Linus Lüssing <linus.luessing@...3.blue>,
	Vlastimil Babka <vbabka@...e.cz>
Cc: "Paul E. McKenney" <paulmck@...nel.org>,
	b.a.t.m.a.n@...ts.open-mesh.org,
	Dmitry Antipov <dmantipov@...dex.ru>, netdev@...r.kernel.org,
	rcu@...r.kernel.org, Matthew Wilcox <willy@...radead.org>,
	"linux-mm@...ck.org" <linux-mm@...ck.org>
Subject: Re: [PATCH] Revert "batman-adv: prefer kfree_rcu() over call_rcu()
 with free-only callbacks"

+ Vlastimil Babka
+ Matthew Wilcox

> On Wed, Jun 12, 2024 at 07:06:04AM -0700, Paul E. McKenney wrote:
> > Let me make sure that I understand...
> > 
> > You need rcu_barrier() to wait for any memory passed to kfree_rcu()
> > to actually be freed?  If so, please explain why you need this, as
> > in what bad thing happens if the actual kfree() happens later.
> > 
> > (I could imagine something involving OOM avoidance, but I need to
> > hear your code's needs rather than my imaginations.)
> > 
> > 							Thanx, Paul
> 
> We have allocated a kmem-cache for some objects, which are like
> batman-adv's version of a bridge's FDB entry.
> 
> The very last thing we do before unloading the module is
> free'ing/destroying this kmem-cache with a call to
> kmem_cache_destroy().
> 
> As far as I understand before calling kmem_cache_destroy()
> we need to ensure that all previously allocated objects on this
> kmem-cache were free'd. At least we get this kernel splat
> (from Slub?) otherwise. I'm not quite sure if any other bad things
> other than this noise in dmesg would occur though. Other than a
> stale, zero objects entry remaining in /proc/slabinfo maybe. Which
> gets duplicated everytime we repeat loading+unloading the module.
> At least these entries would be a memory leak I suppose?
> 
> ```
> # after insmod/rmmod'ing batman-adv 6 times:
> $ cat /proc/slabinfo  | grep batadv_tl_cache
> batadv_tl_cache        0     16    256   16    1 : tunables    0    0    0 : slabdata      1      1      0
> batadv_tl_cache        0     16    256   16    1 : tunables    0    0    0 : slabdata      1      1      0
> batadv_tl_cache        0     16    256   16    1 : tunables    0    0    0 : slabdata      1      1      0
> batadv_tl_cache        0     16    256   16    1 : tunables    0    0    0 : slabdata      1      1      0
> batadv_tl_cache        0     16    256   16    1 : tunables    0    0    0 : slabdata      1      1      0
> batadv_tl_cache        0     16    256   16    1 : tunables    0    0    0 : slabdata      1      1      0
> ```
> 
> That's why we added this rcu_barrier() call on module
> shutdown in the batman-adv module __exit function right before the
> kmem_cache_destroy() calls. Hoping that this would wait for all
> call_rcu() / kfree_rcu() callbacks and their final kfree() to finish.
> This worked when we were using call_rcu() with our own callback
> with a kfree(). However for kfree_rcu() this somehow does not seem
> to be the case anymore (- or more likely I'm missing something else,
> some other bug within the batman-adv code?).
> 
Some background:

Before kfree_rcu() could deal only with "internal system slab caches" which
are static and live forever. After removing SLAB allocator it become possible
to free a memory over RCU using kfree_rcu() without specifying a kmem-cache
an object belongs to because two remaining allocators are capable of convert
an object to its cache internally.

So, now, kfree_rcu() does not need to be aware of any cache and this is
something new.

In your scenario the cache is destroyed and after that kfree_rcu()
started to free objects into non-existing cache which is a problem.

I have a question to Vlastimil. Is kmem_cached_destroy() removes the
cache right away even though there are allocated objects which have
not yet been freed? If so, is that possible to destroy the cache only
when usage counter becomes zero? i.e. when all objects were returned
back to the cache.

Thank you!

--
Uladzislau Rezki