mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-10-29 11:11:45 -04:00
memcg, slab: RCU protect memcg_params for root caches
We relocate root cache's memcg_params whenever we need to grow the memcg_caches array to accommodate all kmem-active memory cgroups. Currently on relocation we free the old version immediately, which can lead to use-after-free, because the memcg_caches array is accessed lock-free (see cache_from_memcg_idx()). This patch fixes this by making memcg_params RCU-protected for root caches. Signed-off-by: Vladimir Davydov <[email protected]> Cc: Michal Hocko <[email protected]> Cc: Glauber Costa <[email protected]> Cc: Johannes Weiner <[email protected]> Cc: Balbir Singh <[email protected]> Cc: KAMEZAWA Hiroyuki <[email protected]> Cc: Pekka Enberg <[email protected]> Cc: Christoph Lameter <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
This commit is contained in:
parent
f717eb3abb
commit
f8570263ee
3 changed files with 30 additions and 10 deletions
16
mm/slab.h
16
mm/slab.h
|
|
@ -160,14 +160,28 @@ static inline const char *cache_name(struct kmem_cache *s)
|
|||
return s->name;
|
||||
}
|
||||
|
||||
/*
|
||||
* Note, we protect with RCU only the memcg_caches array, not per-memcg caches.
|
||||
* That said the caller must assure the memcg's cache won't go away. Since once
|
||||
* created a memcg's cache is destroyed only along with the root cache, it is
|
||||
* true if we are going to allocate from the cache or hold a reference to the
|
||||
* root cache by other means. Otherwise, we should hold either the slab_mutex
|
||||
* or the memcg's slab_caches_mutex while calling this function and accessing
|
||||
* the returned value.
|
||||
*/
|
||||
static inline struct kmem_cache *
|
||||
cache_from_memcg_idx(struct kmem_cache *s, int idx)
|
||||
{
|
||||
struct kmem_cache *cachep;
|
||||
struct memcg_cache_params *params;
|
||||
|
||||
if (!s->memcg_params)
|
||||
return NULL;
|
||||
cachep = s->memcg_params->memcg_caches[idx];
|
||||
|
||||
rcu_read_lock();
|
||||
params = rcu_dereference(s->memcg_params);
|
||||
cachep = params->memcg_caches[idx];
|
||||
rcu_read_unlock();
|
||||
|
||||
/*
|
||||
* Make sure we will access the up-to-date value. The code updating
|
||||
|
|
|
|||
Loading…
Reference in a new issue