[PATCH] debugobjects: skip activate fixup when disabled by a concurrent OOM

[PATCH] debugobjects: skip activate fixup when disabled by a concurrent OOM

[Jiayuan Chen]

When a tracking object cannot be allocated, lookup_object_or_alloc()
sets debug_objects_enabled = false and the caller runs
debug_objects_oom(), which wipes the whole hash. The flag is cleared
before the hash is wiped.

debug_object_activate() only tests debug_objects_enabled once on entry.
If another CPU hits OOM and wipes the hash after that test, the lookup
here misses and the object is taken as ODEBUG_STATE_NOTAVAILABLE.
fixup_activate() then "repairs" it; for timers that overwrites a live
timer's callback with stub_timer, which later fires a bogus WARN.

Re-check debug_objects_enabled while still holding the bucket lock,
before the fixup. The flag is cleared before the hash is wiped, and both
the wipe and the lookup are serialized by the bucket lock, so a
wipe-induced miss is guaranteed to observe the cleared flag and the
spurious fixup is skipped.

Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
 lib/debugobjects.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/lib/debugobjects.c b/lib/debugobjects.c
index b18a682fe3da..fcb7949cb2be 100644
--- a/lib/debugobjects.c
+++ b/lib/debugobjects.c
@@ -865,6 +865,16 @@ int debug_object_activate(void *addr, const struct debug_obj_descr *descr)
 		}
 	}
 
+	/*
+	 * A concurrent OOM teardown may have disabled debugobjects and
+	 * wiped the hash after the check at function entry. So we need
+	 * check it again here.
+	 */
+	if (!debug_objects_enabled) {
+		raw_spin_unlock_irqrestore(&db->lock, flags);
+		return 0;
+	}
+
 	raw_spin_unlock_irqrestore(&db->lock, flags);
 	debug_print_object(&o, "activate");
 
-- 
2.43.0