From patchwork Mon Feb 26 03:01:40 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gong Ruiqi X-Patchwork-Id: 13571181 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id CC38FC47DD9 for ; Mon, 26 Feb 2024 02:55:51 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 5D7A394000D; Sun, 25 Feb 2024 21:55:51 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 56068940008; Sun, 25 Feb 2024 21:55:51 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 4015394000D; Sun, 25 Feb 2024 21:55:51 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id 2A03F940008 for ; Sun, 25 Feb 2024 21:55:51 -0500 (EST) Received: from smtpin24.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id F00881C0124 for ; Mon, 26 Feb 2024 02:55:50 +0000 (UTC) X-FDA: 81832440060.24.390AFB5 Received: from szxga05-in.huawei.com (szxga05-in.huawei.com [45.249.212.191]) by imf15.hostedemail.com (Postfix) with ESMTP id CFDA9A0006 for ; Mon, 26 Feb 2024 02:55:47 +0000 (UTC) Authentication-Results: imf15.hostedemail.com; dkim=none; spf=pass (imf15.hostedemail.com: domain of gongruiqi1@huawei.com designates 45.249.212.191 as permitted sender) smtp.mailfrom=gongruiqi1@huawei.com; dmarc=pass (policy=quarantine) header.from=huawei.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1708916149; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references; bh=nzvPsEMF5sxWzAbTnFw5G/Le4pQ9yE411XXMef0XdVg=; b=n1me8APvt5MGO93yWk+PxQQoVh1Ae0M7Lc3KqN73C2Q5Dzq/usr7c3pDyoNF/jN6WhU6vT E+k2nGjUZSTnehJWsDmGUVkrbqGXHk3Jj6HNWNVsTy3aatBlGRsiUcyC9hNOt7aas0fUX2 ZZfSLDGutJzmz7SCSBKV2uY3MJGCKHg= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1708916149; a=rsa-sha256; cv=none; b=f024QEekYIxh4kYfCeaANCT9KvwNr1dyiGOYq86GqffbdpLjUaMORotdac8NW0S9z1mn4z JZ7vUp46f83012r37luU9MMI5P66X0Nlm0uizssPNT9Aeq5dslPzmw7VWTQq97/cCRV/Ji aFfialNdviEYMLKDjViYFKzr9JxSiAs= ARC-Authentication-Results: i=1; imf15.hostedemail.com; dkim=none; spf=pass (imf15.hostedemail.com: domain of gongruiqi1@huawei.com designates 45.249.212.191 as permitted sender) smtp.mailfrom=gongruiqi1@huawei.com; dmarc=pass (policy=quarantine) header.from=huawei.com Received: from mail.maildlp.com (unknown [172.19.163.44]) by szxga05-in.huawei.com (SkyGuard) with ESMTP id 4TjlVH01YSz1S5HP; Mon, 26 Feb 2024 10:50:46 +0800 (CST) Received: from dggpemd100002.china.huawei.com (unknown [7.185.36.164]) by mail.maildlp.com (Postfix) with ESMTPS id BE15A1400D4; Mon, 26 Feb 2024 10:55:43 +0800 (CST) Received: from huawei.com (10.67.174.33) by dggpemd100002.china.huawei.com (7.185.36.164) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.2.1258.28; Mon, 26 Feb 2024 10:55:43 +0800 From: "GONG, Ruiqi" To: , , Johannes Weiner , Michal Hocko , Roman Gushchin , Shakeel Butt , Muchun Song , Greg KH CC: , , Wang Weiyang , Xiu Jianfeng Subject: [PATCH stable 4.19] mm: memcontrol: switch to rcu protection in drain_all_stock() Date: Mon, 26 Feb 2024 11:01:40 +0800 Message-ID: <20240226030140.129822-1-gongruiqi1@huawei.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-Originating-IP: [10.67.174.33] X-ClientProxiedBy: dggems703-chm.china.huawei.com (10.3.19.180) To dggpemd100002.china.huawei.com (7.185.36.164) X-Rspamd-Queue-Id: CFDA9A0006 X-Rspam-User: X-Stat-Signature: fr9jma6e675j31jt9nngp3w6gjqmwscs X-Rspamd-Server: rspam03 X-HE-Tag: 1708916147-812503 X-HE-Meta: U2FsdGVkX18+Yy+XUt3yTTGHfUAluZpAXD3VoFVNk6TX1s4cBmlB8ksOBI7zW0HSjfOz5wlSLPX5ANyEUP68wMgoex0ELmbFNVM5UW0dxD+ZXACtTqMVTGnpnv2r3ri02HwhzK+wuxSBtddw6sXBq/8LqRNdQYuBlM1RHIfHsKLs9KF3q8A3D+jlu/ntydutoVEmA84YyOBTStZ1ojp8gD1hLF9GvD87nkobhcp8Ka2vDawP6VkmWAIXCHhylPbGIz/j+AQK3xeg5VFfcQN5aRVQSBpvm1mSNAJRxhh+204SNuTTJG8PtcBaVvg0j9TvuLbg55uUO2PzoEcY8cQd6hOMV5jcxjHeEiBx6O9nAHJujzv3XRD9u5n5PneCyvBqG70yYrKc6pzJ+g1KKkK8GTavSwVFz9LpNf0yNEGJ/XhYTNF4xidMrWbVrBA20OE45UwpqFjt4l9ZsteEAHzXDMHYYtc2YMX0NR1KN6d32XmEtYPUra9tWFJIEEwosyRC7tuxdf8DH0utYPGks8ivTyhUwb4Raf9cGVng/2TU6TMBuB5gq3LXcX5tonNAW9DyF4hvC1aAnZarh0hI6p7cQwmYj7zgvDoNyN/zxR/5FyN04btcuaT328j+0LpXIRXUyPxKqiJtQ8RRUqt288b/ParqNo7jJ7Knz8RooRzdbcbmqeb2/r1AHcoFmqbotU+IhNvHO4B/T9lxyZrODD2t4scavHmE7aMoZhIndsLGRMWSjlnoCRih2OjprTWLFuiAsPGrWBuZL9dQisRvwP8o8m7dmgHsXHNlDkDBcM/QlVYez7LsajovOUY0DQiLncmzMDCUjM4VgmTjmJC6kTI0C1WH9uFYg497LRcpKtTjWsjnBgF2MTAhrRvzp2yzssSbVEiLPwaAh68= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Roman Gushchin commit e1a366be5cb4f849ec4de170d50eebc08bb0af20 upstream. Commit 72f0184c8a00 ("mm, memcg: remove hotplug locking from try_charge") introduced css_tryget()/css_put() calls in drain_all_stock(), which are supposed to protect the target memory cgroup from being released during the mem_cgroup_is_descendant() call. However, it's not completely safe. In theory, memcg can go away between reading stock->cached pointer and calling css_tryget(). This can happen if drain_all_stock() races with drain_local_stock() performed on the remote cpu as a result of a work, scheduled by the previous invocation of drain_all_stock(). The race is a bit theoretical and there are few chances to trigger it, but the current code looks a bit confusing, so it makes sense to fix it anyway. The code looks like as if css_tryget() and css_put() are used to protect stocks drainage. It's not necessary because stocked pages are holding references to the cached cgroup. And it obviously won't work for works, scheduled on other cpus. So, let's read the stock->cached pointer and evaluate the memory cgroup inside a rcu read section, and get rid of css_tryget()/css_put() calls. Link: http://lkml.kernel.org/r/20190802192241.3253165-1-guro@fb.com Signed-off-by: Roman Gushchin Acked-by: Michal Hocko Cc: Hillf Danton Cc: Johannes Weiner Cc: Vladimir Davydov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Cc: stable@vger.kernel.org # 4.19 Fixes: cdec2e4265df ("memcg: coalesce charging via percpu storage") Signed-off-by: GONG, Ruiqi --- This patch [1] fixed a UAF problem in drain_all_stock() existed prior to 5.9, and following discussions [2] mentioned that the fix depends on an RCU read protection to stock->cached (introduced in 5.4), which doesn't existed in 4.19. So backport this part to 4.19 as well. [1]: https://lore.kernel.org/all/20240221081801.69764-1-gongruiqi1@huawei.com/ [2]: https://lore.kernel.org/all/ZdXLgjpUfpwEwAe0@tiehlicka/ mm/memcontrol.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 8c04296df1c7..d187bfb43b1f 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -2094,21 +2094,22 @@ static void drain_all_stock(struct mem_cgroup *root_memcg) for_each_online_cpu(cpu) { struct memcg_stock_pcp *stock = &per_cpu(memcg_stock, cpu); struct mem_cgroup *memcg; + bool flush = false; + rcu_read_lock(); memcg = stock->cached; - if (!memcg || !stock->nr_pages || !css_tryget(&memcg->css)) - continue; - if (!mem_cgroup_is_descendant(memcg, root_memcg)) { - css_put(&memcg->css); - continue; - } - if (!test_and_set_bit(FLUSHING_CACHED_CHARGE, &stock->flags)) { + if (memcg && stock->nr_pages && + mem_cgroup_is_descendant(memcg, root_memcg)) + flush = true; + rcu_read_unlock(); + + if (flush && + !test_and_set_bit(FLUSHING_CACHED_CHARGE, &stock->flags)) { if (cpu == curcpu) drain_local_stock(&stock->work); else schedule_work_on(cpu, &stock->work); } - css_put(&memcg->css); } put_cpu(); mutex_unlock(&percpu_charge_mutex);