Commit 4ec10268 authored by Vlastimil Babka's avatar Vlastimil Babka
Browse files

mm, slab: unlink slabinfo, sysfs and debugfs immediately 



kmem_cache_destroy() includes removing the associated sysfs and debugfs
directories, and the cache from the list of caches that appears in
/proc/slabinfo. Currently this might not happen immediately when:

- the cache is SLAB_TYPESAFE_BY_RCU and the cleanup is delayed,
  including the directores removal
- __kmem_cache_shutdown() fails due to outstanding objects - the
  directories remain indefinitely

When a cache is recreated with the same name, such as due to module
unload followed by a load, the directories will fail to be recreated for
the new instance of the cache due to the old directories being present.
The cache will also appear twice in /proc/slabinfo.

While we want to convert the SLAB_TYPESAFE_BY_RCU cleanup to be
synchronous again, the second point remains. So let's fix this first and
have the directories and slabinfo removed immediately in
kmem_cache_destroy() and regardless of __kmem_cache_shutdown() success.

This should not make debugging harder if __kmem_cache_shutdown() fails,
because a detailed report of outstanding objects is printed into dmesg
already due to the failure.

Also simplify kmem_cache_release() sysfs handling by using
__is_defined(SLAB_SUPPORTS_SYSFS).

Note the resulting code in kmem_cache_destroy() is a bit ugly but will
be further simplified - this is in order to make small bisectable steps.

Reviewed-by: default avatarJann Horn <jannh@google.com>
Signed-off-by: default avatarVlastimil Babka <vbabka@suse.cz>
parent b5959789

mm/slab_common.c

+26 −31
Original line number Diff line number Diff line
@@ -484,31 +484,19 @@ kmem_buckets *kmem_buckets_create(const char *name, slab_flags_t flags, 
}

EXPORT_SYMBOL(kmem_buckets_create);



#ifdef SLAB_SUPPORTS_SYSFS

/*

 * For a given kmem_cache, kmem_cache_destroy() should only be called

 * once or there will be a use-after-free problem. The actual deletion

 * and release of the kobject does not need slab_mutex or cpu_hotplug_lock

 * protection. So they are now done without holding those locks.

 *

 * Note that there will be a slight delay in the deletion of sysfs files

 * if kmem_cache_release() is called indrectly from a work function.

 */

static void kmem_cache_release(struct kmem_cache *s)

{

	if (slab_state >= FULL) {

		sysfs_slab_unlink(s);

	if (__is_defined(SLAB_SUPPORTS_SYSFS) && slab_state >= FULL)

		sysfs_slab_release(s);

	} else {

		slab_kmem_cache_release(s);

	}

}

#else

static void kmem_cache_release(struct kmem_cache *s)

{

	else

		slab_kmem_cache_release(s);

}

#endif



static void slab_caches_to_rcu_destroy_workfn(struct work_struct *work)

{
@@ -534,7 +522,6 @@ static void slab_caches_to_rcu_destroy_workfn(struct work_struct *work) 
	rcu_barrier();



	list_for_each_entry_safe(s, s2, &to_destroy, list) {

		debugfs_slab_release(s);

		kfence_shutdown_cache(s);

		kmem_cache_release(s);

	}
@@ -549,8 +536,8 @@ void slab_kmem_cache_release(struct kmem_cache *s) 


void kmem_cache_destroy(struct kmem_cache *s)

{

	int err = -EBUSY;

	bool rcu_set;

	int err;



	if (unlikely(!s) || !kasan_check_byte(s))

		return;
@@ -558,11 +545,14 @@ void kmem_cache_destroy(struct kmem_cache *s) 
	cpus_read_lock();

	mutex_lock(&slab_mutex);



	rcu_set = s->flags & SLAB_TYPESAFE_BY_RCU;



	s->refcount--;

	if (s->refcount)

		goto out_unlock;

	if (s->refcount) {

		mutex_unlock(&slab_mutex);

		cpus_read_unlock();

		return;

	}



	rcu_set = s->flags & SLAB_TYPESAFE_BY_RCU;



	/* free asan quarantined objects */

	kasan_cache_shutdown(s);
@@ -571,25 +561,30 @@ void kmem_cache_destroy(struct kmem_cache *s) 
	WARN(err, "%s %s: Slab cache still has objects when called from %pS",

	     __func__, s->name, (void *)_RET_IP_);



	if (err)

		goto out_unlock;



	list_del(&s->list);



	if (rcu_set) {

		list_add_tail(&s->list, &slab_caches_to_rcu_destroy);

		schedule_work(&slab_caches_to_rcu_destroy_work);

	} else {

	if (!err && !rcu_set)

		kfence_shutdown_cache(s);

		debugfs_slab_release(s);

	}



out_unlock:

	mutex_unlock(&slab_mutex);

	cpus_read_unlock();

	if (!err && !rcu_set)



	if (slab_state >= FULL)

		sysfs_slab_unlink(s);

	debugfs_slab_release(s);



	if (err)

		return;



	if (rcu_set) {

		mutex_lock(&slab_mutex);

		list_add_tail(&s->list, &slab_caches_to_rcu_destroy);

		schedule_work(&slab_caches_to_rcu_destroy_work);

		mutex_unlock(&slab_mutex);

	} else {

		kmem_cache_release(s);

	}

}

EXPORT_SYMBOL(kmem_cache_destroy);



/**