Received: by 2002:a17:90a:1609:0:0:0:0 with SMTP id n9csp846950pja; Wed, 1 Apr 2020 09:45:52 -0700 (PDT) X-Google-Smtp-Source: ADFU+vsCAy1tQ32IhCmXhezo7f2+jo/gFxxuzVqVnljewnpQH6cdDie7Rm9Sob1k5Y8Vn2Unurfj X-Received: by 2002:a9d:b8f:: with SMTP id 15mr17418538oth.256.1585759552112; Wed, 01 Apr 2020 09:45:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1585759552; cv=none; d=google.com; s=arc-20160816; b=alMGB/PIlIIQCFU/7JRh6zq09ls3Umn9YFOlAsR4YSrKvxOAkMzwaw6WPVXgTROXRx 86Ah4ERnT2dNWvKc/WeD9VE6HOiuxpDJSQgBKMG5zQ9TogX1kk9TPy5ekGlP6G3x/Sbz omJam10D9tEJGUzUNpvRHF3M2CU3rBuOHNr+yFt1qGKEhyjCHDqr3gt9/68DGP6B+ovN zytDgaSJ9FvaCmLUKaJflmN8LojKZBWZvxn0PQJlfQI5zukXPb25iOrbjWfZ3jbSaWYK vrjc7EZD9Lwzrw+KNeWKNKq/pLj5svlpPc5cwWp/FQ6GcSZZXIaBakJuPMVVto76XbJA Vvsw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=fLJVxqDBjVVzdNifJusMQsc3PKB20KRiMKgLxnOjNE4=; b=b0n8SiM7ehICYgzQ9D6uNz/BES4K5QNHziiyOZ2hjjIsOyoKXyC1iK2irbrz+13jx+ wsTMYu3yfOkgChlLvsD3/T5yT2D/0DgXap43ixs7MLCpBvbEd3AJ996nI+/EWtZQSIAH XaM5FQRHuV/6S4VWoKs4dpKYZwxJLsxwQYJFJJpP5EZAKBSoWCRa/t/zXTXkMjdbYol/ n1o+ffKhWXdisce3YtQ+4Np96nOQpsm425Vc3/oXZAGXYVaLAQ4u2SzQGBeqEUJYBA8g HzlKGvK+6b5+s9efyDC6lhqjRUMGpBQBMS2mArjX45caE4hK7iyN1OMnlVlQ/xpVtaBw 4Eaw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=p3XBtCBj; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id v130si1080473oib.115.2020.04.01.09.45.39; Wed, 01 Apr 2020 09:45:52 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=p3XBtCBj; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389640AbgDAQng (ORCPT + 99 others); Wed, 1 Apr 2020 12:43:36 -0400 Received: from mail.kernel.org ([198.145.29.99]:44420 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389635AbgDAQnf (ORCPT ); Wed, 1 Apr 2020 12:43:35 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id DFEE920658; Wed, 1 Apr 2020 16:43:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759415; bh=iD/Yg04NJGZQEJnQ1j2Q+biPBPnJRwPGOuF1rcUv700=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=p3XBtCBj902yLqpZt5FtmgtWi/NPhldgBNf5ggwf0/FFlzCjsM1DDhjJUO1clHVFR XneunArc1DmUJO+bLyr8OofiheQcyhqRY8fl9FgFiP0TLD5MbQ6NlgAj0yeT7Dgfad yl3axqj/eyJN6WcK2z1wjfgAFjajk+XBfXoaIhrs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jann Horn , Linus Torvalds Subject: [PATCH 4.14 036/148] mm: slub: be more careful about the double cmpxchg of freelist Date: Wed, 1 Apr 2020 18:17:08 +0200 Message-Id: <20200401161556.158599169@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161552.245876366@linuxfoundation.org> References: <20200401161552.245876366@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Linus Torvalds commit 5076190daded2197f62fe92cf69674488be44175 upstream. This is just a cleanup addition to Jann's fix to properly update the transaction ID for the slub slowpath in commit fd4d9c7d0c71 ("mm: slub: add missing TID bump.."). The transaction ID is what protects us against any concurrent accesses, but we should really also make sure to make the 'freelist' comparison itself always use the same freelist value that we then used as the new next free pointer. Jann points out that if we do all of this carefully, we could skip the transaction ID update for all the paths that only remove entries from the lists, and only update the TID when adding entries (to avoid the ABA issue with cmpxchg and list handling re-adding a previously seen value). But this patch just does the "make sure to cmpxchg the same value we used" rather than then try to be clever. Acked-by: Jann Horn Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- mm/slub.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/mm/slub.c +++ b/mm/slub.c @@ -2943,11 +2943,13 @@ redo: barrier(); if (likely(page == c->page)) { - set_freepointer(s, tail_obj, c->freelist); + void **freelist = READ_ONCE(c->freelist); + + set_freepointer(s, tail_obj, freelist); if (unlikely(!this_cpu_cmpxchg_double( s->cpu_slab->freelist, s->cpu_slab->tid, - c->freelist, tid, + freelist, tid, head, next_tid(tid)))) { note_cmpxchg_failure("slab_free", s, tid);