History

mm: shrinkers: fix race condition on debugfs cleanup

When something registers and unregisters many shrinkers, such as: for x in $(seq 10000); do unshare -Ui true; done Sometimes the following error is printed to the kernel log: debugfs: Directory '...' with parent 'shrinker' already present! This occurs since commit badc28d4924b ("mm: shrinkers: fix deadlock in shrinker debugfs") / v6.2: Since the call to `debugfs_remove_recursive` was moved outside the `shrinker_rwsem`/`shrinker_mutex` lock, but the call to `ida_free` stayed inside, a newly registered shrinker can be re-assigned that ID and attempt to create the debugfs directory before the directory from the previous shrinker has been removed. The locking changes in commit f95bdb700bc6 ("mm: vmscan: make global slab shrink lockless") made the race condition more likely, though it existed before then. Commit badc28d4924b ("mm: shrinkers: fix deadlock in shrinker debugfs") could be reverted since the issue is addressed should no longer occur since the count and scan operations are lockless since commit 20cd1892fcc3 ("mm: shrinkers: make count and scan in shrinker debugfs lockless"). However, since this is a contended lock, prefer instead moving `ida_free` outside the lock to avoid the race.

Joan Bruguera Micó committed 3 years ago

Commit 26e239b1 parent 0257d993 files · +24 −9Browse files

Unified · Split

3 files
  1. include/linux/shrinker.h +11 −2
  2. mm/shrinker_debug.c +10 −5
  3. mm/vmscan.c +3 −2
include/linux/shrinker.h+11−2
@@ -107,7 +107,10 @@ extern void synchronize_shrinkers(void); · 106 unmodified lines
107 107
108#ifdef CONFIG_SHRINKER_DEBUG108#ifdef CONFIG_SHRINKER_DEBUG
109extern int shrinker_debugfs_add(struct shrinker *shrinker);109extern int shrinker_debugfs_add(struct shrinker *shrinker);
110extern struct dentry *shrinker_debugfs_remove(struct shrinker *shrinker);110extern struct dentry *shrinker_debugfs_detach(struct shrinker *shrinker,
111 int *debugfs_id);
112extern void shrinker_debugfs_remove(struct dentry *debugfs_entry,
113 int debugfs_id);
111extern int __printf(2, 3) shrinker_debugfs_rename(struct shrinker *shrinker,114extern int __printf(2, 3) shrinker_debugfs_rename(struct shrinker *shrinker,
112 const char *fmt, ...);115 const char *fmt, ...);
113#else /* CONFIG_SHRINKER_DEBUG */116#else /* CONFIG_SHRINKER_DEBUG */
@@ -115,10 +118,16 @@ static inline int shrinker_debugfs_add(struct shrinker *shrinker) · 1 unmodified line
115{118{
116 return 0;119 return 0;
117}120}
118static inline struct dentry *shrinker_debugfs_remove(struct shrinker *shrinker)121static inline struct dentry *shrinker_debugfs_detach(struct shrinker *shrinker,
122 int *debugfs_id)
119{123{
124 *debugfs_id = -1;
120 return NULL;125 return NULL;
121}126}
127static inline void shrinker_debugfs_remove(struct dentry *debugfs_entry,
128 int debugfs_id)
129{
130}
122static inline __printf(2, 3)131static inline __printf(2, 3)
123int shrinker_debugfs_rename(struct shrinker *shrinker, const char *fmt, ...)132int shrinker_debugfs_rename(struct shrinker *shrinker, const char *fmt, ...)
124{133{
mm/shrinker_debug.c+10−5
@@ -237,7 +237,8 @@ int shrinker_debugfs_rename(struct shrinker *shrinker, const char *fmt, ...) · 236 unmodified lines
237}237}
238EXPORT_SYMBOL(shrinker_debugfs_rename);238EXPORT_SYMBOL(shrinker_debugfs_rename);
239 239
240struct dentry *shrinker_debugfs_remove(struct shrinker *shrinker)240struct dentry *shrinker_debugfs_detach(struct shrinker *shrinker,
241 int *debugfs_id)
241{242{
242 struct dentry *entry = shrinker->debugfs_entry;243 struct dentry *entry = shrinker->debugfs_entry;
243 244
@@ -246,14 +247,18 @@ struct dentry *shrinker_debugfs_remove(struct shrinker *shrinker) · 2 unmodified lines
246 kfree_const(shrinker->name);247 kfree_const(shrinker->name);
247 shrinker->name = NULL;248 shrinker->name = NULL;
248 249
249 if (entry) {250 *debugfs_id = entry ? shrinker->debugfs_id : -1;
250 ida_free(&shrinker_debugfs_ida, shrinker->debugfs_id);251 shrinker->debugfs_entry = NULL;
251 shrinker->debugfs_entry = NULL;
252 }
253 252
254 return entry;253 return entry;
255}254}
256 255
256void shrinker_debugfs_remove(struct dentry *debugfs_entry, int debugfs_id)
257{
258 debugfs_remove_recursive(debugfs_entry);
259 ida_free(&shrinker_debugfs_ida, debugfs_id);
260}
261
257static int __init shrinker_debugfs_init(void)262static int __init shrinker_debugfs_init(void)
258{263{
259 struct shrinker *shrinker;264 struct shrinker *shrinker;
mm/vmscan.c+3−2
@@ -805,6 +805,7 @@ EXPORT_SYMBOL(register_shrinker); · 804 unmodified lines
805void unregister_shrinker(struct shrinker *shrinker)805void unregister_shrinker(struct shrinker *shrinker)
806{806{
807 struct dentry *debugfs_entry;807 struct dentry *debugfs_entry;
808 int debugfs_id;
808 809
809 if (!(shrinker->flags & SHRINKER_REGISTERED))810 if (!(shrinker->flags & SHRINKER_REGISTERED))
810 return;811 return;
@@ -814,13 +815,13 @@ void unregister_shrinker(struct shrinker *shrinker) · 3 unmodified lines
814 shrinker->flags &= ~SHRINKER_REGISTERED;815 shrinker->flags &= ~SHRINKER_REGISTERED;
815 if (shrinker->flags & SHRINKER_MEMCG_AWARE)816 if (shrinker->flags & SHRINKER_MEMCG_AWARE)
816 unregister_memcg_shrinker(shrinker);817 unregister_memcg_shrinker(shrinker);
817 debugfs_entry = shrinker_debugfs_remove(shrinker);818 debugfs_entry = shrinker_debugfs_detach(shrinker, &debugfs_id);
818 mutex_unlock(&shrinker_mutex);819 mutex_unlock(&shrinker_mutex);
819 820
820 atomic_inc(&shrinker_srcu_generation);821 atomic_inc(&shrinker_srcu_generation);
821 synchronize_srcu(&shrinker_srcu);822 synchronize_srcu(&shrinker_srcu);
822 823
823 debugfs_remove_recursive(debugfs_entry);824 shrinker_debugfs_remove(debugfs_entry, debugfs_id);
824 825
825 kfree(shrinker->nr_deferred);826 kfree(shrinker->nr_deferred);
826 shrinker->nr_deferred = NULL;827 shrinker->nr_deferred = NULL;