History

mm: shrinkers: fix race condition on debugfs cleanup

When something registers and unregisters many shrinkers, such as: for x in $(seq 10000); do unshare -Ui true; done Sometimes the following error is printed to the kernel log: debugfs: Directory '...' with parent 'shrinker' already present! This occurs since commit badc28d4924b ("mm: shrinkers: fix deadlock in shrinker debugfs") / v6.2: Since the call to `debugfs_remove_recursive` was moved outside the `shrinker_rwsem`/`shrinker_mutex` lock, but the call to `ida_free` stayed inside, a newly registered shrinker can be re-assigned that ID and attempt to create the debugfs directory before the directory from the previous shrinker has been removed. The locking changes in commit f95bdb700bc6 ("mm: vmscan: make global slab shrink lockless") made the race condition more likely, though it existed before then. Commit badc28d4924b ("mm: shrinkers: fix deadlock in shrinker debugfs") could be reverted since the issue is addressed should no longer occur since the count and scan operations are lockless since commit 20cd1892fcc3 ("mm: shrinkers: make count and scan in shrinker debugfs lockless"). However, since this is a contended lock, prefer instead moving `ida_free` outside the lock to avoid the race.

Joan Bruguera Micó committed 3 years ago

Commit 26e239b1 parent 0257d993 files · +24 −9Browse files

Showing the changes to include/linux (1 of 3 files). Show all

Unified · Split

include/linux/shrinker.h+11−2
@@ -107,7 +107,10 @@ extern void synchronize_shrinkers(void); · 106 unmodified lines
107107
108108 #ifdef CONFIG_SHRINKER_DEBUG
109109 extern int shrinker_debugfs_add(struct shrinker *shrinker);
110−extern struct dentry *shrinker_debugfs_remove(struct shrinker *shrinker);
110+extern struct dentry *shrinker_debugfs_detach(struct shrinker *shrinker,
111+ int *debugfs_id);
112+extern void shrinker_debugfs_remove(struct dentry *debugfs_entry,
113+ int debugfs_id);
111114 extern int __printf(2, 3) shrinker_debugfs_rename(struct shrinker *shrinker,
112115 const char *fmt, ...);
113116 #else /* CONFIG_SHRINKER_DEBUG */
@@ -115,10 +118,16 @@ static inline int shrinker_debugfs_add(struct shrinker *shrinker) · 1 unmodified line
115118 {
116119 return 0;
117120 }
118−static inline struct dentry *shrinker_debugfs_remove(struct shrinker *shrinker)
121+static inline struct dentry *shrinker_debugfs_detach(struct shrinker *shrinker,
122+ int *debugfs_id)
119123 {
124+ *debugfs_id = -1;
120125 return NULL;
121126 }
127+static inline void shrinker_debugfs_remove(struct dentry *debugfs_entry,
128+ int debugfs_id)
129+{
130+}
122131 static inline __printf(2, 3)
123132 int shrinker_debugfs_rename(struct shrinker *shrinker, const char *fmt, ...)
124133 {