Commit c1bb2a899b5f5edc10cd5b5b9b0496cddb533565
Committed by
Greg Kroah-Hartman
1 parent
873f3b0ebb
Exists in
smarct4x-processor-sdk-04.01.00.06
and in
1 other branch
slub/memcg: cure the brainless abuse of sysfs attributes
commit 478fe3037b2278d276d4cd9cd0ab06c4cb2e9b32 upstream. memcg_propagate_slab_attrs() abuses the sysfs attribute file functions to propagate settings from the root kmem_cache to a newly created kmem_cache. It does that with: attr->show(root, buf); attr->store(new, buf, strlen(bug); Aside of being a lazy and absurd hackery this is broken because it does not check the return value of the show() function. Some of the show() functions return 0 w/o touching the buffer. That means in such a case the store function is called with the stale content of the previous show(). That causes nonsense like invoking kmem_cache_shrink() on a newly created kmem_cache. In the worst case it would cause handing in an uninitialized buffer. This should be rewritten proper by adding a propagate() callback to those slub_attributes which must be propagated and avoid that insane conversion to and from ASCII, but that's too large for a hot fix. Check at least the return value of the show() function, so calling store() with stale content is prevented. Steven said: "It can cause a deadlock with get_online_cpus() that has been uncovered by recent cpu hotplug and lockdep changes that Thomas and Peter have been doing. Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(cpu_hotplug.lock); lock(slab_mutex); lock(cpu_hotplug.lock); lock(slab_mutex); *** DEADLOCK ***" Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1705201244540.2255@nanos Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reported-by: Steven Rostedt <rostedt@goodmis.org> Acked-by: David Rientjes <rientjes@google.com> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: Michal Hocko <mhocko@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Christoph Lameter <cl@linux.com> Cc: Pekka Enberg <penberg@kernel.org> Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com> Cc: Christoph Hellwig <hch@infradead.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Showing 1 changed file with 4 additions and 2 deletions Side-by-side Diff
mm/slub.c
... | ... | @@ -5452,6 +5452,7 @@ |
5452 | 5452 | char mbuf[64]; |
5453 | 5453 | char *buf; |
5454 | 5454 | struct slab_attribute *attr = to_slab_attr(slab_attrs[i]); |
5455 | + ssize_t len; | |
5455 | 5456 | |
5456 | 5457 | if (!attr || !attr->store || !attr->show) |
5457 | 5458 | continue; |
... | ... | @@ -5476,8 +5477,9 @@ |
5476 | 5477 | buf = buffer; |
5477 | 5478 | } |
5478 | 5479 | |
5479 | - attr->show(root_cache, buf); | |
5480 | - attr->store(s, buf, strlen(buf)); | |
5480 | + len = attr->show(root_cache, buf); | |
5481 | + if (len > 0) | |
5482 | + attr->store(s, buf, len); | |
5481 | 5483 | } |
5482 | 5484 | |
5483 | 5485 | if (buffer) |