mm: Make it easier to catch NULL cache names

PATCH In review Benjamin Herrenschmidt 2 participants 3 messages Jul 28, 2009 – Jul 29, 2009

Subsystems (2)

Memory management Slab allocator

lore

Share & tools

lore

Benjamin Herrenschmidt

author

2009-07-28 04:11 UTC #0 lore raw

PATCH 1/1 mm: Make it easier to catch NULL cache names

Right now, if you inadvertently pass NULL to kmem_cache_create() at boot time, it crashes much later after boot somewhere deep inside sysfs which makes it very non obvious to figure out what's going on.

Signed-off-by Benjamin Herrenschmidt <[email protected]>

---

Yes, I did hit that :-) Something in ppc land using an array of caches and got the names array out of sync with changes to the list of indices.

 mm/slub.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

mm/slub.c +3 -0

index b9f1491..e31fbe6 100644
@@ -3292,6 +3292,9 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
 {
 	struct kmem_cache *s;
 
+	if (WARN_ON(!name))
+		return NULL;
+
 	down_write(&slub_lock);
 	s = find_mergeable(size, align, flags, name, ctor);
 	if (s) {

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>

Andrew Morton

maintainer

2009-07-29 00:07 UTC #1 lore raw

Quoted 3 lines · On Tue, 28 Jul 2009 14:11:29 +1000 Benjamin Herrenschmidt…

Right now, if you inadvertently pass NULL to kmem_cache_create() at boot time, it crashes much later after boot somewhere deep inside sysfs which makes it very non obvious to figure out what's going on.

That must have been a pretty dumb piece of kernel code. It's a bit questionable (IMO) whether we need to cater for really exceptional bugs. But whatever.

slab used to have a check (__get_user) to see whether the ->name field was still readable. This was to detect the case where the slab cache was created from a kernel module and the module forgot to remove the cache at rmmod-time. Subsequent reads of /proc/slabinfo would confusingly go splat. The check seems to have been removed (from slab.c, at least). If it is still there then it should be applied consistently and across all slab versions. In which case that check would make your patch arguably-unneeded. But it seems to have got itself zapped.

Quoted 14 lines

Signed-off-by Benjamin Herrenschmidt <[email protected]>
---
Yes, I did hit that :-) Something in ppc land using an array of caches and got the names array out of sync with changes to the list of indices.
 mm/slub.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)
mm/slub.c +0 -0
index b9f1491..e31fbe6 100644

mm/slub.c struct kmem_cache *kmem_cache_create(const char *name, size_t size, · line 3300

Quoted 9 lines

mm/slub.c +3 -0

@@ -3292,6 +3292,9 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
 {
 	struct kmem_cache *s;
 
+	if (WARN_ON(!name))
+		return NULL;
+
 	down_write(&slub_lock);
 	s = find_mergeable(size, align, flags, name, ctor);
 	if (s) {

Let's see:

slab.c: goes BUG
slob.c: will apparently go oops at some later time slqb.c: does dump_stack(), returns NULL from kmem_cache_create() slub.c: does WARN(), returns NULL from kmem_cache_create()

I think I'll apply the patch, cc Pekka then run away.

Benjamin Herrenschmidt

author

2009-07-29 05:55 UTC #2 lore raw

Quoted 10 lines · Andrew Morton

Quoted 3 lines · On Tue, 28 Jul 2009 14:11:29 +1000 Benjamin Herrenschmidt…
Right now, if you inadvertently pass NULL to kmem_cache_create() at boot time, it crashes much later after boot somewhere deep inside sysfs which makes it very non obvious to figure out what's going on.
That must have been a pretty dumb piece of kernel code. It's a bit questionable (IMO) whether we need to cater for really exceptional bugs. But whatever.

:-)

It was an array of caches created from something like an enum and the array of names got out of sync :-)

Quoted 9 lines

slab used to have a check (__get_user) to see whether the ->name field was still readable. This was to detect the case where the slab cache was created from a kernel module and the module forgot to remove the cache at rmmod-time. Subsequent reads of /proc/slabinfo would confusingly go splat. The check seems to have been removed (from slab.c, at least). If it is still there then it should be applied consistently and across all slab versions. In which case that check would make your patch arguably-unneeded. But it seems to have got itself zapped.

That sounds like a better idea. However, it looks like we create sysfs things and pass that pointer down to sysfs nowadays, so that's going to blow up somewhere in the guts of sysfs unless we duplicate the string.

The advantage of duplicating the string would also be that we could blow up right away if it's NULL :-)

Cheers,
Ben.

Quoted 32 lines

Quoted 14 lines
Signed-off-by Benjamin Herrenschmidt <[email protected]>
---
Yes, I did hit that :-) Something in ppc land using an array of caches and got the names array out of sync with changes to the list of indices.
 mm/slub.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)
mm/slub.c +0 -0
index b9f1491..e31fbe6 100644
mm/slub.c struct kmem_cache *kmem_cache_create(const char *name, size_t size, · line 3300
Quoted 9 lines
mm/slub.c +3 -0
@@ -3292,6 +3292,9 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
 {
 	struct kmem_cache *s;
 
+	if (WARN_ON(!name))
+		return NULL;
+
 	down_write(&slub_lock);
 	s = find_mergeable(size, align, flags, name, ctor);
 	if (s) {
Let's see:
slab.c: goes BUG
slob.c: will apparently go oops at some later time slqb.c: does dump_stack(), returns NULL from kmem_cache_create() slub.c: does WARN(), returns NULL from kmem_cache_create()

Quoted 7 lines

I think I'll apply the patch, cc Pekka then run away.
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>