From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5C402C77B73 for ; Tue, 2 May 2023 18:25:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233955AbjEBSZc (ORCPT ); Tue, 2 May 2023 14:25:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57358 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232117AbjEBSZ3 (ORCPT ); Tue, 2 May 2023 14:25:29 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C9543CC for ; Tue, 2 May 2023 11:25:28 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 645AC627C4 for ; Tue, 2 May 2023 18:25:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B55A0C433EF; Tue, 2 May 2023 18:25:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1683051927; bh=Q20qjeo91yOynGJIHGTl4H0pVljv/a/9+imSNmdYXEA=; h=Date:To:From:Subject:From; b=s1zu7bexUbXXzEDpDUMAacrU22VsVyhfCeBmwboedsAAvMk/uKMw2VAS4AbrdyvCN 1KbgXSJZR5V1lkHz5YKLEZbRcpPaakbsuj87RWYpYiXD1BsL/62NcT9CycsN1P1hOk gz2gRijtVY94QunTpXaGG6hJgerQU2yYjjU193Qs= Date: Tue, 02 May 2023 11:25:27 -0700 To: mm-commits@vger.kernel.org, yosryahmed@google.com, shakeelb@google.com, dvyukov@google.com, roman.gushchin@linux.dev, akpm@linux-foundation.org From: Andrew Morton Subject: + mm-memcg-use-read_once-write_once-to-access-stock-cached.patch added to mm-unstable branch Message-Id: <20230502182527.B55A0C433EF@smtp.kernel.org> Precedence: bulk Reply-To: linux-kernel@vger.kernel.org List-ID: X-Mailing-List: mm-commits@vger.kernel.org The patch titled Subject: mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached has been added to the -mm mm-unstable branch. Its filename is mm-memcg-use-read_once-write_once-to-access-stock-cached.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/mm-memcg-use-read_once-write_once-to-access-stock-cached.patch This patch will later appear in the mm-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Roman Gushchin Subject: mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached Date: Tue, 2 May 2023 09:08:39 -0700 A memcg pointer in the percpu stock can be accessed by drain_all_stock() from another cpu in a lockless way. In theory it might lead to an issue, similar to the one which has been discovered with stock->cached_objcg, where the pointer was zeroed between the check for being NULL and dereferencing. In this case the issue is unlikely a real problem, but to make it bulletproof and similar to stock->cached_objcg, let's annotate all accesses to stock->cached with READ_ONCE()/WTRITE_ONCE(). Link: https://lkml.kernel.org/r/20230502160839.361544-2-roman.gushchin@linux.dev Signed-off-by: Roman Gushchin Cc: Dmitry Vyukov Cc: Yosry Ahmed Cc: Shakeel Butt Signed-off-by: Andrew Morton --- mm/memcontrol.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) --- a/mm/memcontrol.c~mm-memcg-use-read_once-write_once-to-access-stock-cached +++ a/mm/memcontrol.c @@ -2275,7 +2275,7 @@ static bool consume_stock(struct mem_cgr local_lock_irqsave(&memcg_stock.stock_lock, flags); stock = this_cpu_ptr(&memcg_stock); - if (memcg == stock->cached && stock->nr_pages >= nr_pages) { + if (memcg == READ_ONCE(stock->cached) && stock->nr_pages >= nr_pages) { stock->nr_pages -= nr_pages; ret = true; } @@ -2290,7 +2290,7 @@ static bool consume_stock(struct mem_cgr */ static void drain_stock(struct memcg_stock_pcp *stock) { - struct mem_cgroup *old = stock->cached; + struct mem_cgroup *old = READ_ONCE(stock->cached); if (!old) return; @@ -2303,7 +2303,7 @@ static void drain_stock(struct memcg_sto } css_put(&old->css); - stock->cached = NULL; + WRITE_ONCE(stock->cached, NULL); } static void drain_local_stock(struct work_struct *dummy) @@ -2338,10 +2338,10 @@ static void __refill_stock(struct mem_cg struct memcg_stock_pcp *stock; stock = this_cpu_ptr(&memcg_stock); - if (stock->cached != memcg) { /* reset if necessary */ + if (READ_ONCE(stock->cached) != memcg) { /* reset if necessary */ drain_stock(stock); css_get(&memcg->css); - stock->cached = memcg; + WRITE_ONCE(stock->cached, memcg); } stock->nr_pages += nr_pages; @@ -2383,7 +2383,7 @@ static void drain_all_stock(struct mem_c bool flush = false; rcu_read_lock(); - memcg = stock->cached; + memcg = READ_ONCE(stock->cached); if (memcg && stock->nr_pages && mem_cgroup_is_descendant(memcg, root_memcg)) flush = true; _ Patches currently in -mm which might be from roman.gushchin@linux.dev are mm-kmem-fix-a-null-pointer-dereference-in-obj_stock_flush_required.patch mm-memcg-use-read_once-write_once-to-access-stock-cached.patch