Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
In-Reply-To: <1511841842-3786-1-git-send-email-zhouzhouyi@gmail.com>
References: <1511841842-3786-1-git-send-email-zhouzhouyi@gmail.com>
From:   Zhouyi Zhou <zhouzhouyi@gmail.com>
Date:   Tue, 28 Nov 2017 12:05:56 +0800
Message-ID: <CAABZP2zEup53ZcNKOEUEMx_aRMLONZdYCLd7s5J4DLTccPxC-A@mail.gmail.com>
Subject: Re: [PATCH 1/1] kasan: fix livelock in qlist_move_cache
To:     aryabinin@virtuozzo.com, Alexander Potapenko <glider@google.com>,
        Dmitry Vyukov <dvyukov@google.com>, kasan-dev@googlegroups.com,
        linux-mm@kvack.org,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Cc:     Zhouyi Zhou <zhouzhouyi@gmail.com>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

When there are huge amount of quarantined cache allocates in system,
number of entries in global_quarantine[i] will be great. Meanwhile,
there is no relax in while loop in function qlist_move_cache which
hold quarantine_lock. As a result, some userspace programs for example
libvirt will complain.

On Tue, Nov 28, 2017 at 12:04 PM,  <zhouzhouyi@gmail.com> wrote:
> From: Zhouyi Zhou <zhouzhouyi@gmail.com>
>
> This patch fix livelock by conditionally release cpu to let others
> has a chance to run.
>
> Tested on x86_64.
> Signed-off-by: Zhouyi Zhou <zhouzhouyi@gmail.com>
> ---
>  mm/kasan/quarantine.c | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)
>
> diff --git a/mm/kasan/quarantine.c b/mm/kasan/quarantine.c
> index 3a8ddf8..33eeff4 100644
> --- a/mm/kasan/quarantine.c
> +++ b/mm/kasan/quarantine.c
> @@ -265,10 +265,13 @@ static void qlist_move_cache(struct qlist_head *from,
>                                    struct kmem_cache *cache)
>  {
>         struct qlist_node *curr;
> +       struct qlist_head tmp_head;
> +       unsigned long flags;
>
>         if (unlikely(qlist_empty(from)))
>                 return;
>
> +       qlist_init(&tmp_head);
>         curr = from->head;
>         qlist_init(from);
>         while (curr) {
> @@ -278,10 +281,17 @@ static void qlist_move_cache(struct qlist_head *from,
>                 if (obj_cache == cache)
>                         qlist_put(to, curr, obj_cache->size);
>                 else
> -                       qlist_put(from, curr, obj_cache->size);
> +                       qlist_put(&tmp_head, curr, obj_cache->size);
>
>                 curr = next;
> +
> +               if (need_resched()) {
> +                       spin_unlock_irqrestore(&quarantine_lock, flags);
> +                       cond_resched();
> +                       spin_lock_irqsave(&quarantine_lock, flags);
> +               }
>         }
> +       qlist_move_all(&tmp_head, from);
>  }
>
>  static void per_cpu_remove_cache(void *arg)
> --
> 2.1.4
>

From 1585281151451498932@xxx Tue Nov 28 04:05:18 +0000 2017
X-GM-THRID: 1585281151451498932
X-Gmail-Labels: Inbox,Category Forums,HistoricalUnread