[5.15,14/33] mm: kfence: fix objcgs vector allocation

Message ID	20220429104052.756801254@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Muchun Song <songmuchun@bytedance.com>, Marco Elver <elver@google.com>, Roman Gushchin <roman.gushchin@linux.dev>, Alexander Potapenko <glider@google.com>, Dmitry Vyukov <dvyukov@google.com>, Xiongchun Duan <duanxiongchun@bytedance.com>, Andrew Morton <akpm@linux-foundation.org>, Linus Torvalds <torvalds@linux-foundation.org> Subject: [PATCH 5.15 14/33] mm: kfence: fix objcgs vector allocation Date: Fri, 29 Apr 2022 12:42:01 +0200 Message-Id: <20220429104052.756801254@linuxfoundation.org> In-Reply-To: <20220429104052.345760505@linuxfoundation.org> References: <20220429104052.345760505@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.15,02/33] bpf: Introduce composable reg, ret and arg types. [5.15,03/33] bpf: Replace ARG_XXX_OR_NULL with ARG_XXX \| PTR_MAYBE_NULL [5.15,04/33] bpf: Replace RET_XXX_OR_NULL with RET_XXX \| PTR_MAYBE_NULL [5.15,05/33] bpf: Replace PTR_TO_XXX_OR_NULL with PTR_TO_XXX \| PTR_MAYBE_NULL [5.15,06/33] bpf: Introduce MEM_RDONLY flag [5.15,07/33] bpf: Convert PTR_TO_MEM_OR_NULL to composable types. [5.15,08/33] bpf: Make per_cpu_ptr return rdonly PTR_TO_MEM. [5.15,09/33] bpf: Add MEM_RDONLY for helper args that are pointers to rdonly mem. [5.15,10/33] bpf/selftests: Test PTR_TO_RDONLY_MEM [5.15,11/33] bpf: Fix crash due to out of bounds access into reg2btf_ids. [5.15,12/33] spi: cadence-quadspi: fix write completion support [5.15,13/33] ARM: dts: socfpga: change qspi to "intel,socfpga-qspi" [5.15,14/33] mm: kfence: fix objcgs vector allocation [5.15,15/33] gup: Turn fault_in_pages_{readable,writeable} into fault_in_{readable,writeable} [5.15,16/33] iov_iter: Turn iov_iter_fault_in_readable into fault_in_iov_iter_readable [5.15,17/33] iov_iter: Introduce fault_in_iov_iter_writeable [5.15,18/33] gfs2: Add wrapper for iomap_file_buffered_write [5.15,19/33] gfs2: Clean up function may_grant [5.15,20/33] gfs2: Introduce flag for glock holder auto-demotion [5.15,21/33] gfs2: Move the inode glock locking to gfs2_file_buffered_write [5.15,22/33] gfs2: Eliminate ip->i_gh [5.15,23/33] gfs2: Fix mmap + page fault deadlocks for buffered I/O [5.15,24/33] iomap: Fix iomap_dio_rw return value for user copies [5.15,25/33] iomap: Support partial direct I/O on user copy failures [5.15,26/33] iomap: Add done_before argument to iomap_dio_rw [5.15,27/33] gup: Introduce FOLL_NOFAULT flag to disable page faults [5.15,28/33] iov_iter: Introduce nofault flag to disable page faults [5.15,29/33] gfs2: Fix mmap + page fault deadlocks for direct I/O [5.15,30/33] btrfs: fix deadlock due to page faults during direct IO reads and writes [5.15,31/33] btrfs: fallback to blocking mode when doing async dio over multiple extents [5.15,32/33] mm: gup: make fault_in_safe_writeable() use fixup_user_fault() [5.15,33/33] selftests/bpf: Add test for reg2btf_ids out of bounds access

Message ID

20220429104052.756801254@linuxfoundation.org

State

New

Headers

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        stable@vger.kernel.org, Muchun Song <songmuchun@bytedance.com>,
        Marco Elver <elver@google.com>,
        Roman Gushchin <roman.gushchin@linux.dev>,
        Alexander Potapenko <glider@google.com>,
        Dmitry Vyukov <dvyukov@google.com>,
        Xiongchun Duan <duanxiongchun@bytedance.com>,
        Andrew Morton <akpm@linux-foundation.org>,
        Linus Torvalds <torvalds@linux-foundation.org>
Subject: [PATCH 5.15 14/33] mm: kfence: fix objcgs vector allocation
Date: Fri, 29 Apr 2022 12:42:01 +0200
Message-Id: <20220429104052.756801254@linuxfoundation.org>
In-Reply-To: <20220429104052.345760505@linuxfoundation.org>
References: <20220429104052.345760505@linuxfoundation.org>
User-Agent: quilt/0.66
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Precedence: bulk

Series

None | expand

Commit Message

Greg Kroah-Hartman April 29, 2022, 10:42 a.m. UTC

From: Muchun Song <songmuchun@bytedance.com>

commit 8f0b36497303487d5a32c75789c77859cc2ee895 upstream.

If the kfence object is allocated to be used for objects vector, then
this slot of the pool eventually being occupied permanently since the
vector is never freed.  The solutions could be (1) freeing vector when
the kfence object is freed or (2) allocating all vectors statically.

Since the memory consumption of object vectors is low, it is better to
chose (2) to fix the issue and it is also can reduce overhead of vectors
allocating in the future.

Link: https://lkml.kernel.org/r/20220328132843.16624-1-songmuchun@bytedance.com
Fixes: d3fb45f370d9 ("mm, kfence: insert KFENCE hooks for SLAB")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Reviewed-by: Marco Elver <elver@google.com>
Reviewed-by: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Alexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Xiongchun Duan <duanxiongchun@bytedance.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/kfence/core.c   |   11 ++++++++++-
 mm/kfence/kfence.h |    3 +++
 2 files changed, 13 insertions(+), 1 deletion(-)

--- a/mm/kfence/core.c
+++ b/mm/kfence/core.c
@@ -528,6 +528,8 @@  static bool __init kfence_init_pool(void
 	 * enters __slab_free() slow-path.
 	 */
 	for (i = 0; i < KFENCE_POOL_SIZE / PAGE_SIZE; i++) {
+		struct page *page = &pages[i];
+
 		if (!i || (i % 2))
 			continue;
 
@@ -535,7 +537,11 @@  static bool __init kfence_init_pool(void
 		if (WARN_ON(compound_head(&pages[i]) != &pages[i]))
 			goto err;
 
-		__SetPageSlab(&pages[i]);
+		__SetPageSlab(page);
+#ifdef CONFIG_MEMCG
+		page->memcg_data = (unsigned long)&kfence_metadata[i / 2 - 1].objcg |
+				   MEMCG_DATA_OBJCGS;
+#endif
 	}
 
 	/*
@@ -911,6 +917,9 @@  void __kfence_free(void *addr)
 {
 	struct kfence_metadata *meta = addr_to_metadata((unsigned long)addr);
 
+#ifdef CONFIG_MEMCG
+	KFENCE_WARN_ON(meta->objcg);
+#endif
 	/*
 	 * If the objects of the cache are SLAB_TYPESAFE_BY_RCU, defer freeing
 	 * the object, as the object page may be recycled for other-typed
--- a/mm/kfence/kfence.h
+++ b/mm/kfence/kfence.h
@@ -89,6 +89,9 @@  struct kfence_metadata {
 	struct kfence_track free_track;
 	/* For updating alloc_covered on frees. */
 	u32 alloc_stack_hash;
+#ifdef CONFIG_MEMCG
+	struct obj_cgroup *objcg;
+#endif
 };
 
 extern struct kfence_metadata kfence_metadata[CONFIG_KFENCE_NUM_OBJECTS];

[5.15,14/33] mm: kfence: fix objcgs vector allocation

Commit Message

Patch