Subject: Re: [Bugme-new] [Bug 33502] New: Caught 64-bit read from uninitialized memory in __alloc_skb

From: Pekka Enberg <[email-masked]>
Date: Thu, 05 May 2011 09:22:49 +0300

On 5/5/11 9:18 AM, Eric Dumazet wrote:
> Le mercredi 20 avril 2011 à 17:01 +0200, Eric Dumazet a écrit :
>> Le mercredi 20 avril 2011 à 09:42 -0500, Christoph Lameter a écrit :
>>
>>> Avoiding the irq handling yields the savings that improve the fastpath. if
>>> you do both then there is only a regression left. So lets go with
>>> disabling the CMPXCHG_LOCAL.
>>
>> OK, let's do that then.
>>
>> Thanks
>>
>> [PATCH v4] slub: dont use cmpxchg_double if KMEMCHECK or DEBUG_PAGEALLOC
>>
>> Christian Casteyde reported a KMEMCHECK splat in slub code.
>>
>> Problem is now we are lockless and allow IRQ in slab_alloc(), the object
>> we manipulate from freelist can be allocated and freed right before we
>> try to read object->next.
>>
>> Same problem can happen with DEBUG_PAGEALLOC
>>
>> Just dont use cmpxchg_double() if either CONFIG_KMEMCHECK or
>> CONFIG_DEBUG_PAGEALLOC is defined.
>>
>> Reported-by: Christian Casteyde<[email-masked]>
>> Signed-off-by: Eric Dumazet<[email-masked]>
>> Cc: Andrew Morton<[email-masked]>
>> Cc: Pekka Enberg<[email-masked]>
>> Cc: Vegard Nossum<[email-masked]>
>> Cc: Christoph Lameter<[email-masked]>
>> ---
>>   mm/slub.c |   45 +++++++++++++++++++++++++--------------------
>>   1 files changed, 25 insertions(+), 20 deletions(-)
>>
>> diff --git a/mm/slub.c b/mm/slub.c
>> index 94d2a33..f31ab2c 100644
>> --- a/mm/slub.c
>> +++ b/mm/slub.c
>> @@ -1540,7 +1540,12 @@ static void unfreeze_slab(struct kmem_cache *s, struct page *page, int tail)
>>   	}
>>   }
>>
>> -#ifdef CONFIG_CMPXCHG_LOCAL
>> +#if defined(CONFIG_CMPXCHG_LOCAL)&&  !defined(CONFIG_KMEMCHECK)&&  \
>> +				     !defined(CONFIG_DEBUG_PAGEALLOC)
>> +#define SLUB_USE_CMPXCHG_DOUBLE
>> +#endif
>> +
>> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
>>   #ifdef CONFIG_PREEMPT
>>   /*
>>    * Calculate the next globally unique transaction for disambiguiation
>> @@ -1604,7 +1609,7 @@ static inline void note_cmpxchg_failure(const char *n,
>>
>>   void init_kmem_cache_cpus(struct kmem_cache *s)
>>   {
>> -#ifdef CONFIG_CMPXCHG_LOCAL
>> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
>>   	int cpu;
>>
>>   	for_each_possible_cpu(cpu)
>> @@ -1643,7 +1648,7 @@ static void deactivate_slab(struct kmem_cache *s, struct kmem_cache_cpu *c)
>>   		page->inuse--;
>>   	}
>>   	c->page = NULL;
>> -#ifdef CONFIG_CMPXCHG_LOCAL
>> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
>>   	c->tid = next_tid(c->tid);
>>   #endif
>>   	unfreeze_slab(s, page, tail);
>> @@ -1780,7 +1785,7 @@ static void *__slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node,
>>   {
>>   	void **object;
>>   	struct page *new;
>> -#ifdef CONFIG_CMPXCHG_LOCAL
>> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
>>   	unsigned long flags;
>>
>>   	local_irq_save(flags);
>> @@ -1819,7 +1824,7 @@ load_freelist:
>>   	c->node = page_to_nid(c->page);
>>   unlock_out:
>>   	slab_unlock(c->page);
>> -#ifdef CONFIG_CMPXCHG_LOCAL
>> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
>>   	c->tid = next_tid(c->tid);
>>   	local_irq_restore(flags);
>>   #endif
>> @@ -1858,7 +1863,7 @@ new_slab:
>>   	}
>>   	if (!(gfpflags&  __GFP_NOWARN)&&  printk_ratelimit())
>>   		slab_out_of_memory(s, gfpflags, node);
>> -#ifdef CONFIG_CMPXCHG_LOCAL
>> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
>>   	local_irq_restore(flags);
>>   #endif
>>   	return NULL;
>> @@ -1887,7 +1892,7 @@ static __always_inline void *slab_alloc(struct kmem_cache *s,
>>   {
>>   	void **object;
>>   	struct kmem_cache_cpu *c;
>> -#ifdef CONFIG_CMPXCHG_LOCAL
>> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
>>   	unsigned long tid;
>>   #else
>>   	unsigned long flags;
>> @@ -1896,7 +1901,7 @@ static __always_inline void *slab_alloc(struct kmem_cache *s,
>>   	if (slab_pre_alloc_hook(s, gfpflags))
>>   		return NULL;
>>
>> -#ifndef CONFIG_CMPXCHG_LOCAL
>> +#ifndef SLUB_USE_CMPXCHG_DOUBLE
>>   	local_irq_save(flags);
>>   #else
>>   redo:
>> @@ -1910,7 +1915,7 @@ redo:
>>   	 */
>>   	c = __this_cpu_ptr(s->cpu_slab);
>>
>> -#ifdef CONFIG_CMPXCHG_LOCAL
>> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
>>   	/*
>>   	 * The transaction ids are globally unique per cpu and per operation on
>>   	 * a per cpu queue. Thus they can be guarantee that the cmpxchg_double
>> @@ -1927,7 +1932,7 @@ redo:
>>   		object = __slab_alloc(s, gfpflags, node, addr, c);
>>
>>   	else {
>> -#ifdef CONFIG_CMPXCHG_LOCAL
>> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
>>   		/*
>>   		 * The cmpxchg will only match if there was no additional
>>   		 * operation and if we are on the right processor.
>> @@ -1954,7 +1959,7 @@ redo:
>>   		stat(s, ALLOC_FASTPATH);
>>   	}
>>
>> -#ifndef CONFIG_CMPXCHG_LOCAL
>> +#ifndef SLUB_USE_CMPXCHG_DOUBLE
>>   	local_irq_restore(flags);
>>   #endif
>>
>> @@ -2034,7 +2039,7 @@ static void __slab_free(struct kmem_cache *s, struct page *page,
>>   {
>>   	void *prior;
>>   	void **object = (void *)x;
>> -#ifdef CONFIG_CMPXCHG_LOCAL
>> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
>>   	unsigned long flags;
>>
>>   	local_irq_save(flags);
>> @@ -2070,7 +2075,7 @@ checks_ok:
>>
>>   out_unlock:
>>   	slab_unlock(page);
>> -#ifdef CONFIG_CMPXCHG_LOCAL
>> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
>>   	local_irq_restore(flags);
>>   #endif
>>   	return;
>> @@ -2084,7 +2089,7 @@ slab_empty:
>>   		stat(s, FREE_REMOVE_PARTIAL);
>>   	}
>>   	slab_unlock(page);
>> -#ifdef CONFIG_CMPXCHG_LOCAL
>> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
>>   	local_irq_restore(flags);
>>   #endif
>>   	stat(s, FREE_SLAB);
>> @@ -2113,7 +2118,7 @@ static __always_inline void slab_free(struct kmem_cache *s,
>>   {
>>   	void **object = (void *)x;
>>   	struct kmem_cache_cpu *c;
>> -#ifdef CONFIG_CMPXCHG_LOCAL
>> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
>>   	unsigned long tid;
>>   #else
>>   	unsigned long flags;
>> @@ -2121,7 +2126,7 @@ static __always_inline void slab_free(struct kmem_cache *s,
>>
>>   	slab_free_hook(s, x);
>>
>> -#ifndef CONFIG_CMPXCHG_LOCAL
>> +#ifndef SLUB_USE_CMPXCHG_DOUBLE
>>   	local_irq_save(flags);
>>
>>   #else
>> @@ -2136,7 +2141,7 @@ redo:
>>   	 */
>>   	c = __this_cpu_ptr(s->cpu_slab);
>>
>> -#ifdef CONFIG_CMPXCHG_LOCAL
>> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
>>   	tid = c->tid;
>>   	barrier();
>>   #endif
>> @@ -2144,7 +2149,7 @@ redo:
>>   	if (likely(page == c->page&&  c->node != NUMA_NO_NODE)) {
>>   		set_freepointer(s, object, c->freelist);
>>
>> -#ifdef CONFIG_CMPXCHG_LOCAL
>> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
>>   		if (unlikely(!this_cpu_cmpxchg_double(
>>   				s->cpu_slab->freelist, s->cpu_slab->tid,
>>   				c->freelist, tid,
>> @@ -2160,7 +2165,7 @@ redo:
>>   	} else
>>   		__slab_free(s, page, x, addr);
>>
>> -#ifndef CONFIG_CMPXCHG_LOCAL
>> +#ifndef SLUB_USE_CMPXCHG_DOUBLE
>>   	local_irq_restore(flags);
>>   #endif
>>   }
>> @@ -2354,7 +2359,7 @@ static inline int alloc_kmem_cache_cpus(struct kmem_cache *s)
>>   	BUILD_BUG_ON(PERCPU_DYNAMIC_EARLY_SIZE<
>>   			SLUB_PAGE_SHIFT * sizeof(struct kmem_cache_cpu));
>>
>> -#ifdef CONFIG_CMPXCHG_LOCAL
>> +#ifdef SLUB_USE_CMPXCHG_DOUBLE
>>   	/*
>>   	 * Must align to double word boundary for the double cmpxchg instructions
>>   	 * to work.
>>
>
>
> Is anybody taking the patch and sending it upstream ?

Oh, sorry, it got lost in my inbox. I can take care of it.

			Pekka