From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-14.4 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 412FAC4727E for ; Fri, 25 Sep 2020 21:19:03 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id AE5F921D7F for ; Fri, 25 Sep 2020 21:19:02 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="eNZv88uT" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org AE5F921D7F Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 238926B0062; Fri, 25 Sep 2020 17:19:02 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 1E7E06B0070; Fri, 25 Sep 2020 17:19:02 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 126806B0074; Fri, 25 Sep 2020 17:19:02 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0035.hostedemail.com [216.40.44.35]) by kanga.kvack.org (Postfix) with ESMTP id F04A26B0062 for ; Fri, 25 Sep 2020 17:19:01 -0400 (EDT) Received: from smtpin20.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id B6938180AD801 for ; Fri, 25 Sep 2020 21:19:01 +0000 (UTC) X-FDA: 77302848882.20.food89_591405b2716a Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin20.hostedemail.com (Postfix) with ESMTP id A06C6180C07A3 for ; Fri, 25 Sep 2020 21:19:01 +0000 (UTC) X-HE-Tag: food89_591405b2716a X-Filterd-Recvd-Size: 5392 Received: from mail-lf1-f66.google.com (mail-lf1-f66.google.com [209.85.167.66]) by imf26.hostedemail.com (Postfix) with ESMTP for ; Fri, 25 Sep 2020 21:19:01 +0000 (UTC) Received: by mail-lf1-f66.google.com with SMTP id d15so4304694lfq.11 for ; Fri, 25 Sep 2020 14:19:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=BAZC5WdsihBei8ZEYFA5ibD70o4Yn/tMBPfbhpwMzrw=; b=eNZv88uTD+H0687sCNUjErQN0ou7Br7/82NHVBB4WbSsMLa6Xv+b6Py7dIwago8+oV LVTgsWVWUV0AfVW3zTJ2+BPeF/2CRbdZ5mh6o59MNoQ8Os2KF2lKb1rUuBeXIczq23h9 gAwf6yQbAUadJ4ve7LCZdZFcw2mMfQTUgRC19MgdwFfnqyYGhRVeG5L6ZpEdPBplhIsF kZZvxrpjdnCLAqObXL+OsCdWoPpV1aD42X9YJXAQN3Y/byVqUSwl7dhz+C1N/NGxqKve UFJ+q2IfH/66yw4Iib1An5JHeYd5cCNdqIuigSrwMSdO6gjXfmKxrulbrZdU03sEjUkF Q3Og== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=BAZC5WdsihBei8ZEYFA5ibD70o4Yn/tMBPfbhpwMzrw=; b=qkWTNw8NeJFozgH1M1JSqLRDjpK8jNCuTQ0zHYUH0qf+Ugw+HQ1h8H27yc9U0xTk1X fQoumJ7+jdsGk0I+71l6bLOXRy4+qqr9XkAfXCM1sGeMW26qga+u6ihl9jGgpRswgdjM hsHgM6G4Zqnf3eUGgkf+fEDEMHoHW0mnfgr26UqGj3clkxEjNG3cPkPcQCn9uZAaG847 GmRXkCP1fu+VguFKjHutD0I4YhrLrAmiZ1J946ZIqj0CwWIHubC/3Vfj3f6qKilZui0L 6VK4AYsox94J96L1wwArLUzou7ga0LfcBSc/mxLi+L/yAZrjU7LZuR/bTXahVImEazQM +kgg== X-Gm-Message-State: AOAM533A8gUVu5N+RSHP6Tamzgx9La1EchnzgGnMzvJeS9KOgKvUMuHb yXwYKPn9id7wTo9RhTB2cxV5b4nzDDqvWTG1AUDihA== X-Google-Smtp-Source: ABdhPJxUEE37WPkdJrc9HedFYru6tI6b/9DtnLDZsC2ZOqMgNlXO3m98KYOozN9brJWAwI+Hjol/pci4CGZ7tcktK4w= X-Received: by 2002:ac2:4315:: with SMTP id l21mr254323lfh.494.1601068739382; Fri, 25 Sep 2020 14:18:59 -0700 (PDT) MIME-Version: 1.0 References: <20200925191902.543953-1-shakeelb@google.com> <20200925205604.GA2228989@carbon.dhcp.thefacebook.com> In-Reply-To: <20200925205604.GA2228989@carbon.dhcp.thefacebook.com> From: Shakeel Butt Date: Fri, 25 Sep 2020 14:18:48 -0700 Message-ID: Subject: Re: REGRESSION: 37f4a24c2469: blk-mq: centralise related handling into blk_mq_get_driver_tag To: Roman Gushchin Cc: Ming Lei , Johannes Weiner , Andrew Morton , Linus Torvalds , "Theodore Y . Ts'o" , Jens Axboe , Ext4 Developers List , linux-block , Vlastimil Babka , Linux MM , LKML Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000027, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Fri, Sep 25, 2020 at 1:56 PM Roman Gushchin wrote: > > On Fri, Sep 25, 2020 at 12:19:02PM -0700, Shakeel Butt wrote: > > On Fri, Sep 25, 2020 at 10:58 AM Shakeel Butt > > wrote: > > > > > [snip] > > > > > > I don't think you can ignore the flushing. The __free_once() in > > > ___cache_free() assumes there is a space available. > > > > > > BTW do_drain() also have the same issue. > > > > > > Why not move slabs_destroy() after we update ac->avail and memmove()? > > > > Ming, can you please try the following patch? > > > > > > From: Shakeel Butt > > > > [PATCH] mm: slab: fix potential infinite recursion in ___cache_free > > > > With the commit 10befea91b61 ("mm: memcg/slab: use a single set of > > kmem_caches for all allocations"), it becomes possible to call kfree() > > from the slabs_destroy(). However if slabs_destroy() is being called for > > the array_cache of the local CPU then this opens the potential scenario > > of infinite recursion because kfree() called from slabs_destroy() can > > call slabs_destroy() with the same array_cache of the local CPU. Since > > the array_cache of the local CPU is not updated before calling > > slabs_destroy(), it will try to free the same pages. > > > > To fix the issue, simply update the cache before calling > > slabs_destroy(). > > > > Signed-off-by: Shakeel Butt > > I like the patch and I think it should fix the problem. > > However the description above should be likely asjusted a bit. > It seems that the problem is not necessary caused by an infinite recursion, > it can be even simpler. > > In cache_flusharray() we rely on the state of ac, which is described > by ac->avail. In particular we rely on batchcount < ac->avail, > as we shift the batchcount number of pointers by memmove. > But if slabs_destroy() is called before and leaded to a change of the > ac state, it can lead to a memory corruption. > > Also, unconditionally resetting ac->avail to 0 in do_drain() after calling > to slab_destroy() seems to be wrong. > It explains double free BUGs we've seen in stacktraces. > Yes, you are right. Let's first get this patch tested and after confirmation we can update the commit message.