Commit aa2f9ae3 authored by Thomas Gleixner's avatar Thomas Gleixner Committed by Greg Kroah-Hartman

slub/memcg: cure the brainless abuse of sysfs attributes

commit 478fe303 upstream.

memcg_propagate_slab_attrs() abuses the sysfs attribute file functions
to propagate settings from the root kmem_cache to a newly created
kmem_cache.  It does that with:

     attr->show(root, buf);
     attr->store(new, buf, strlen(bug);

Aside of being a lazy and absurd hackery this is broken because it does
not check the return value of the show() function.

Some of the show() functions return 0 w/o touching the buffer.  That
means in such a case the store function is called with the stale content
of the previous show().  That causes nonsense like invoking
kmem_cache_shrink() on a newly created kmem_cache.  In the worst case it
would cause handing in an uninitialized buffer.

This should be rewritten proper by adding a propagate() callback to
those slub_attributes which must be propagated and avoid that insane
conversion to and from ASCII, but that's too large for a hot fix.

Check at least the return value of the show() function, so calling
store() with stale content is prevented.

Steven said:
 "It can cause a deadlock with get_online_cpus() that has been uncovered
  by recent cpu hotplug and lockdep changes that Thomas and Peter have
  been doing.

     Possible unsafe locking scenario:

           CPU0                    CPU1
           ----                    ----
      lock(cpu_hotplug.lock);
                                   lock(slab_mutex);
                                   lock(cpu_hotplug.lock);
      lock(slab_mutex);

     *** DEADLOCK ***"

Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1705201244540.2255@nanosSigned-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Reported-by: default avatarSteven Rostedt <rostedt@goodmis.org>
Acked-by: default avatarDavid Rientjes <rientjes@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Christoph Hellwig <hch@infradead.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 2c41aea2
...@@ -4959,6 +4959,7 @@ static void memcg_propagate_slab_attrs(struct kmem_cache *s) ...@@ -4959,6 +4959,7 @@ static void memcg_propagate_slab_attrs(struct kmem_cache *s)
char mbuf[64]; char mbuf[64];
char *buf; char *buf;
struct slab_attribute *attr = to_slab_attr(slab_attrs[i]); struct slab_attribute *attr = to_slab_attr(slab_attrs[i]);
ssize_t len;
if (!attr || !attr->store || !attr->show) if (!attr || !attr->store || !attr->show)
continue; continue;
...@@ -4983,8 +4984,9 @@ static void memcg_propagate_slab_attrs(struct kmem_cache *s) ...@@ -4983,8 +4984,9 @@ static void memcg_propagate_slab_attrs(struct kmem_cache *s)
buf = buffer; buf = buffer;
} }
attr->show(root_cache, buf); len = attr->show(root_cache, buf);
attr->store(s, buf, strlen(buf)); if (len > 0)
attr->store(s, buf, len);
} }
if (buffer) if (buffer)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment