From patchwork Wed Feb 28 19:14:44 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Waiman Long X-Patchwork-Id: 207977 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7300:a81b:b0:108:e6aa:91d0 with SMTP id bq27csp3561343dyb; Wed, 28 Feb 2024 11:24:39 -0800 (PST) X-Forwarded-Encrypted: i=3; AJvYcCVpwF4Hi1HoHZTinmD6WIEn1U5vvybyHyJqwNg/Bk420CtEKmLclhTFzUn4CwdBlx4SkZhAH5Wf7Y1Z/+RPsYy8BJpTqA== X-Google-Smtp-Source: AGHT+IEF/f7bhCyiALBhsKMk5qY5YuobdXjNVI2LOaRO4+f47tWMHjIIF77NnGUnbFqhwvMw2e08 X-Received: by 2002:a17:902:ecd2:b0:1dc:a82a:2316 with SMTP id a18-20020a170902ecd200b001dca82a2316mr508314plh.35.1709148279643; Wed, 28 Feb 2024 11:24:39 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1709148279; cv=pass; d=google.com; s=arc-20160816; b=MFAKv0Eu7hKeXCR1R+OE4huKwTh2JkNvuw8FQ2ueHllUJsDt5EB6cimKczhNyAkasz hduLE3YKi1HQqiD+cCwROOqxnzql11QqNDdFZnMhuy/ZuFytk4QZ93eVkX8aLI0s6vnh iw2IeLurz2CmpwtuWz/juE1fZjZu6ULgyQd3QSmckAviHEseufmykiwwjtICYoGW8Yvu wmllIrt3Ty9lTVLyiXvp3m6F1DXgIwKB2pVIlbDCb8zzPVVW593YTpxlpnHisRHOXXVj NINqsJ+YEwF4WA/AgYPDvIApavAirvQf9LUW3Ou+XBsGWFF0+tKJTfPJ0+5he60HEgqL mIgg== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:message-id:date:subject:cc:to :from:dkim-signature; bh=MljlOyunqu2jlYMmKl9aQOW/JRFU3MLIYOB1XnVuGaw=; fh=0LEh/EXMDQ+R2xXa4SLo5uCg727UDg8icsDQcV+q8WY=; b=Y9+CEYa++Nd+PsxZa54K0twFF9fmHENyh/+RuPkKMv8vMHEDiSwToaL1x7GOQ3WKRN yUDJ1+owaHSwX7gogKff2oYGW/NaaOqKlSkc6L2//N2Qq7jsnP/Gzveenhnx5dKMxnuL O9q8gM5DUbyHNIAAfK5U9Um8ovLVsAVFsg02vyFlBtvkNqfRI6lxrwjvVG1z3nHPocOh aTVO6HoKr4eTJRlDsdmfxqeKEHwkuuwzrYEt9NMAbQhqG1gLfdBRXjn66u9QZII78NM4 owF3tVWSo+32242lQLPoMy8XvfHHmSeLO3RkPoDFRkD0ZAa6IqHzsm8wAkMRMN0hm2Xb K63g==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=hyY2jmKB; arc=pass (i=1 spf=pass spfdomain=redhat.com dkim=pass dkdomain=redhat.com dmarc=pass fromdomain=redhat.com); spf=pass (google.com: domain of linux-kernel+bounces-85581-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-85581-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from sy.mirrors.kernel.org (sy.mirrors.kernel.org. [2604:1380:40f1:3f00::1]) by mx.google.com with ESMTPS id p16-20020a170902e75000b001dc76797a4esi3883651plf.375.2024.02.28.11.24.39 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 28 Feb 2024 11:24:39 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-85581-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1; Authentication-Results: mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=hyY2jmKB; arc=pass (i=1 spf=pass spfdomain=redhat.com dkim=pass dkdomain=redhat.com dmarc=pass fromdomain=redhat.com); spf=pass (google.com: domain of linux-kernel+bounces-85581-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-85581-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sy.mirrors.kernel.org (Postfix) with ESMTPS id 2CB4DB23E65 for ; Wed, 28 Feb 2024 19:16:04 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 59FF515D5CC; Wed, 28 Feb 2024 19:15:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="hyY2jmKB" Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4142240849 for ; Wed, 28 Feb 2024 19:15:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709147713; cv=none; b=hB53CM/qap9k3TovHIuNznQwRi3h9wcGgDzuAsrHkr+P5a/vMI2jLGGTrcGJb+jnyXPYVrIPRgAorv0Oe5VBCpYfH1ljM2NkwVfcVGwSTQ+ZeDRWDEIO0nhYxgqcUFed01AomepJWBrukLR2zrMh9crhsVGz+42aHahpWZA/tJI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709147713; c=relaxed/simple; bh=SowfoK/PmICKWh7EUg5Z1noipNIU58W8LZzQ1HeePlY=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=NFH1mXc6NFFUX2e1mIQ2tVQRReQODDo1nDNS6rTLptN6IU30O36Tg51nIFBPvDLbAquTwc+Ar0mYZBaBtXFWJsLUKEhP/+p7C5mCazV602I83+dfJ6UzhW8L7HmYQvrTq1QWE2eJ/7IPNeANH6jzs2hhIr2OTQ+0dfhQ+sVdpGw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=hyY2jmKB; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1709147709; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=MljlOyunqu2jlYMmKl9aQOW/JRFU3MLIYOB1XnVuGaw=; b=hyY2jmKB4bDz3sHOPIAlGuGbmKiT9FyOd2qLO+C8AG9KPM2rlbktYhfd5a1jP7UCzNCGDY uIQjsFy/Q3ffXvSp8dgxh6pjyCJBD++5XjC/070ZXTI9b2hmQHv7tp1qH0JsF9CyemuLG0 MNBsXw07tB93qcHTshEwEKrFiwhP4gQ= Received: from mimecast-mx02.redhat.com (mx-ext.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-333-nZC1LXXDMsqMC0i9D60IlA-1; Wed, 28 Feb 2024 14:15:06 -0500 X-MC-Unique: nZC1LXXDMsqMC0i9D60IlA-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 91FC71C592A2; Wed, 28 Feb 2024 19:15:04 +0000 (UTC) Received: from llong.com (unknown [10.22.9.68]) by smtp.corp.redhat.com (Postfix) with ESMTP id 6548A40C94AB; Wed, 28 Feb 2024 19:15:03 +0000 (UTC) From: Waiman Long To: Catalin Marinas , Andrew Morton Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Audra Mitchell , Waiman Long Subject: [PATCH] mm/kmemleak: Don't hold kmemleak_lock when calling printk() Date: Wed, 28 Feb 2024 14:14:44 -0500 Message-Id: <20240228191444.481048-1-longman@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.2 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1792171866171243083 X-GMAIL-MSGID: 1792171866171243083 When some error conditions happen (like OOM), some kmemleak functions call printk() to dump out some useful debugging information while holding the kmemleak_lock. This may cause deadlock as the printk() function may need to allocate additional memory leading to a create_object() call acquiring kmemleak_lock again. Fix this deadlock issue by making sure that printk() is only called after releasing the kmemleak_lock. Signed-off-by: Waiman Long --- mm/kmemleak.c | 64 ++++++++++++++++++++++++++++++++++++--------------- 1 file changed, 46 insertions(+), 18 deletions(-) diff --git a/mm/kmemleak.c b/mm/kmemleak.c index 6a540c2b27c5..acd8742c80b5 100644 --- a/mm/kmemleak.c +++ b/mm/kmemleak.c @@ -401,6 +401,19 @@ static struct rb_root *object_tree(unsigned long objflags) return &object_tree_root; } +/* + * Increment the object use_count. Return 1 if successful or 0 otherwise. Note + * that once an object's use_count reached 0, the RCU freeing was already + * registered and the object should no longer be used. This function must be + * called under the protection of rcu_read_lock(). + */ +static int get_object(struct kmemleak_object *object) +{ + return atomic_inc_not_zero(&object->use_count); +} + +static void put_object(struct kmemleak_object *object); + /* * Look-up a memory block metadata (kmemleak_object) in the object search * tree based on a pointer value. If alias is 0, only values pointing to the @@ -413,6 +426,8 @@ static struct kmemleak_object *__lookup_object(unsigned long ptr, int alias, struct rb_node *rb = object_tree(objflags)->rb_node; unsigned long untagged_ptr = (unsigned long)kasan_reset_tag((void *)ptr); + lockdep_assert_held(&kmemleak_lock); + while (rb) { struct kmemleak_object *object; unsigned long untagged_objp; @@ -427,9 +442,20 @@ static struct kmemleak_object *__lookup_object(unsigned long ptr, int alias, else if (untagged_objp == untagged_ptr || alias) return object; else { + if (!get_object(object)) + break; + /* + * Release kmemleak_lock and acquire object->lock + * temporarily to avoid deadlock in printk(). + */ + raw_spin_unlock(&kmemleak_lock); kmemleak_warn("Found object by alias at 0x%08lx\n", ptr); + raw_spin_lock(&object->lock); dump_object_info(object); + raw_spin_unlock(&object->lock); + put_object(object); + raw_spin_lock(&kmemleak_lock); break; } } @@ -442,22 +468,12 @@ static struct kmemleak_object *lookup_object(unsigned long ptr, int alias) return __lookup_object(ptr, alias, 0); } -/* - * Increment the object use_count. Return 1 if successful or 0 otherwise. Note - * that once an object's use_count reached 0, the RCU freeing was already - * registered and the object should no longer be used. This function must be - * called under the protection of rcu_read_lock(). - */ -static int get_object(struct kmemleak_object *object) -{ - return atomic_inc_not_zero(&object->use_count); -} - /* * Memory pool allocation and freeing. kmemleak_lock must not be held. */ static struct kmemleak_object *mem_pool_alloc(gfp_t gfp) { + bool warn = false; unsigned long flags; struct kmemleak_object *object; @@ -477,9 +493,11 @@ static struct kmemleak_object *mem_pool_alloc(gfp_t gfp) else if (mem_pool_free_count) object = &mem_pool[--mem_pool_free_count]; else - pr_warn_once("Memory pool empty, consider increasing CONFIG_DEBUG_KMEMLEAK_MEM_POOL_SIZE\n"); + warn = true; raw_spin_unlock_irqrestore(&kmemleak_lock, flags); + if (unlikely(warn)) + pr_warn_once("Memory pool empty, consider increasing CONFIG_DEBUG_KMEMLEAK_MEM_POOL_SIZE\n"); return object; } @@ -692,6 +710,8 @@ static int __link_object(struct kmemleak_object *object, unsigned long ptr, unsigned long untagged_ptr; unsigned long untagged_objp; + lockdep_assert_held(&kmemleak_lock); + object->flags = OBJECT_ALLOCATED | objflags; object->pointer = ptr; object->size = kfence_ksize((void *)ptr) ?: size; @@ -718,13 +738,21 @@ static int __link_object(struct kmemleak_object *object, unsigned long ptr, else if (untagged_objp + parent->size <= untagged_ptr) link = &parent->rb_node.rb_right; else { - kmemleak_stop("Cannot insert 0x%lx into the object search tree (overlaps existing)\n", - ptr); + if (!get_object(parent)) + return -EEXIST; /* - * No need for parent->lock here since "parent" cannot - * be freed while the kmemleak_lock is held. + * Release kmemleak_lock & acquire parent->lock + * temporarily to avoid deadlock in printk(). */ + raw_spin_unlock(&kmemleak_lock); + + kmemleak_stop("Cannot insert 0x%lx into the object search tree (overlaps existing)\n", + ptr); + raw_spin_lock(&parent->lock); dump_object_info(parent); + raw_spin_unlock(&parent->lock); + put_object(parent); + raw_spin_lock(&kmemleak_lock); return -EEXIST; } } @@ -839,11 +867,12 @@ static void delete_object_part(unsigned long ptr, size_t size, raw_spin_lock_irqsave(&kmemleak_lock, flags); object = __find_and_remove_object(ptr, 1, objflags); if (!object) { + raw_spin_unlock_irqrestore(&kmemleak_lock, flags); #ifdef DEBUG kmemleak_warn("Partially freeing unknown object at 0x%08lx (size %zu)\n", ptr, size); #endif - goto unlock; + goto out; } /* @@ -862,7 +891,6 @@ static void delete_object_part(unsigned long ptr, size_t size, object->min_count, objflags)) object_r = NULL; -unlock: raw_spin_unlock_irqrestore(&kmemleak_lock, flags); if (object) __delete_object(object);