Re: alloc_skb cannot be called with GFP_DMA

[Manfred Spraul <manfred@colorfullife.com>]

[-- Attachment #1: Type: text/plain, Size: 2146 bytes --]

[ok, I admit that this doesn't qualify as a timely reply]

Andrea wrote on Sun, 5 Aug 2001 17:53:34 +0200
  >
 > I think it's good idea to apply this patch to mainline:
 >
 > --- 2.4.8pre4aa1/mm/slab.c.~1~ Sun Aug 5 16:46:58 2001
 > +++ 2.4.8pre4aa1/mm/slab.c Sun Aug 5 17:44:09 2001
 > @@ -1172,7 +1172,6 @@
 >
 > static inline void kmem_cache_alloc_head(kmem_cache_t *cachep, int flags)
 > {
 > -#if DEBUG
 > if (flags & SLAB_DMA) {
 > if (!(cachep->gfpflags & GFP_DMA))
 > BUG();
 > @@ -1180,7 +1179,6 @@
 > if (cachep->gfpflags & GFP_DMA)
 > BUG();
 > }
 > -#endif
 > }
 >
 > static inline void * kmem_cache_alloc_one_tail (kmem_cache_t *cachep,
 >
 > This will trap anybody trying calling alloc_skb using GFP_DMA, that
 > usage is illegal, it would work by luck only if _everybody_ calling
 > alloc_skb would be passing GFP_DMA too (because the gfp_mask is passed
 > to the GFP in order to get right things like GFP_WAIT) which is
 > obviously not the case as the skb cache is shared by everybody.

If someone calls alloc_skb(GFP_DMA), then he wants the data buffer in
DMA space, noone does DMA to/from the skb structure fields. The right
approach is to mask the GFP_DMA bit before calling
kmem_cache_alloc(skbuff_head_cache), and to forward the bit to the
kmalloc of the skb data buffer. This is in 2.4.20-pre5, the right fix.

The check was indended to catch a feature that is present in the 2.2
slab allocator, but missing in 2.4: In 2.2, it was possible to create a
custom cachep with kmem_cache_create(), and then allocate some objects
with GFP_DMA set, some without GFP_DMA set. The allocator in 2.4/5
doesn't support that anymore.

But something else is wrong in kmem_cache_alloc_head - the common error,
GFP_WAIT allocation from interrupt, is not checked - neither in DEBUG
nor without DEBUG.

What about the attached patch?
- put the GFP_DMA test again under DEBUG: GFP_DMA errors are virtually
impossible by design.
- add an in_interrupt() check into alloc_head()

I've put the in_interrupt() check under DEBUG, too: It's icache
pollution, and the second test in kmem_cache_grow() will catch abusers
sooner or later.

--
	Manfred


[-- Attachment #2: patch-slab-debug --]
[-- Type: text/plain, Size: 668 bytes --]

--- 2.5/mm/slab.c	Sun Sep 22 06:25:17 2002
+++ build-2.5/mm/slab.c	Thu Sep 26 23:02:40 2002
@@ -1259,6 +1259,13 @@
 
 static inline void kmem_cache_alloc_head(kmem_cache_t *cachep, int flags)
 {
+#if DEBUG
+	/* check if someone calls us from interrupt with GFP_WAIT set
+	 * With debug disabled, this only happens in kmem_cache_grow,
+	 * to reduce the critical path length.
+	 */
+	if (in_interrupt() && (flags & __GFP_WAIT))
+		BUG();
 	if (flags & SLAB_DMA) {
 		if (!(cachep->gfpflags & GFP_DMA))
 			BUG();
@@ -1266,6 +1273,7 @@
 		if (cachep->gfpflags & GFP_DMA)
 			BUG();
 	}
+#endif
 }
 
 static inline void * kmem_cache_alloc_one_tail (kmem_cache_t *cachep,