Files
linux/include/linux
Greg Thelen f9fa1d919c kasan: drain quarantine of memcg slab objects
Per memcg slab accounting and kasan have a problem with kmem_cache
destruction.
 - kmem_cache_create() allocates a kmem_cache, which is used for
   allocations from processes running in root (top) memcg.
 - Processes running in non root memcg and allocating with either
   __GFP_ACCOUNT or from a SLAB_ACCOUNT cache use a per memcg
   kmem_cache.
 - Kasan catches use-after-free by having kfree() and kmem_cache_free()
   defer freeing of objects. Objects are placed in a quarantine.
 - kmem_cache_destroy() destroys root and non root kmem_caches. It takes
   care to drain the quarantine of objects from the root memcg's
   kmem_cache, but ignores objects associated with non root memcg. This
   causes leaks because quarantined per memcg objects refer to per memcg
   kmem cache being destroyed.

To see the problem:

 1) create a slab cache with kmem_cache_create(,,,SLAB_ACCOUNT,)
 2) from non root memcg, allocate and free a few objects from cache
 3) dispose of the cache with kmem_cache_destroy() kmem_cache_destroy()
    will trigger a "Slab cache still has objects" warning indicating
    that the per memcg kmem_cache structure was leaked.

Fix the leak by draining kasan quarantined objects allocated from non
root memcg.

Racing memcg deletion is tricky, but handled.  kmem_cache_destroy() =>
shutdown_memcg_caches() => __shutdown_memcg_cache() => shutdown_cache()
flushes per memcg quarantined objects, even if that memcg has been
rmdir'd and gone through memcg_deactivate_kmem_caches().

This leak only affects destroyed SLAB_ACCOUNT kmem caches when kasan is
enabled.  So I don't think it's worth patching stable kernels.

Link: http://lkml.kernel.org/r/1482257462-36948-1-git-send-email-gthelen@google.com
Signed-off-by: Greg Thelen <gthelen@google.com>
Reviewed-by: Vladimir Davydov <vdavydov.dev@gmail.com>
Acked-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2017-02-24 17:46:56 -08:00
..
2017-01-24 12:37:43 -08:00
2016-07-08 16:23:11 +02:00
2016-12-22 22:58:37 -05:00
2016-10-19 14:34:36 -04:00
2017-02-10 15:52:24 -05:00
2017-01-25 13:17:47 -05:00
2016-12-08 13:31:11 -05:00
2016-08-11 09:41:35 -06:00
2016-10-25 11:08:28 +08:00
2016-12-08 16:37:33 -08:00
2017-02-24 17:46:55 -08:00
2017-02-04 00:47:59 +01:00
2016-10-07 18:46:30 -07:00
2016-12-05 19:01:16 -05:00
2016-10-28 08:48:16 -06:00
2016-05-17 15:48:12 -04:00
2016-11-25 10:15:13 -08:00
2016-12-05 19:01:16 -05:00
2016-12-25 17:21:22 +01:00
2017-02-10 11:15:08 +01:00
2017-02-11 20:59:41 -05:00
2016-02-11 09:59:22 -05:00
2016-09-14 09:18:09 -06:00
2016-05-11 22:37:54 +02:00
2016-01-28 14:19:12 -08:00
2017-02-01 09:13:45 +01:00
2016-03-22 15:36:02 -07:00
2016-08-10 11:23:44 -04:00
2016-03-22 15:36:02 -07:00
2016-12-12 18:55:06 -08:00
2016-12-25 17:21:23 +01:00
2016-01-15 17:56:32 -08:00
2016-09-27 12:33:47 +02:00
2016-12-06 11:05:46 +01:00
2017-01-12 16:48:26 -05:00
2016-07-29 12:17:52 -07:00
2016-08-28 23:32:41 -04:00
2016-11-16 18:32:02 -05:00
2016-12-19 17:29:44 -05:00
2016-04-25 15:09:11 -04:00
2016-02-16 13:04:58 -05:00
2016-12-12 18:55:07 -08:00
2016-12-06 10:17:03 +02:00
2016-02-11 18:35:48 -08:00
2016-03-14 15:43:11 -04:00
2017-02-20 10:15:11 -05:00
2016-10-31 16:18:30 -04:00
2016-10-14 11:36:59 -07:00
2016-07-12 19:25:38 -07:00
2016-09-27 21:52:00 -04:00
2016-11-15 16:34:27 -08:00
2016-03-17 15:09:34 -07:00
2016-07-06 10:51:14 +01:00
2017-02-17 12:28:35 -05:00
2016-03-22 15:36:02 -07:00
2016-06-14 10:54:40 -07:00
2016-01-04 16:11:11 -05:00
2017-01-09 16:07:38 -05:00
2016-10-05 18:23:36 -04:00
2017-02-03 11:19:34 -05:00
2016-12-25 17:21:22 +01:00
2017-02-10 11:15:08 +01:00
2017-01-10 18:31:55 -08:00
2015-10-01 09:57:59 -07:00
2016-07-19 17:43:38 +03:00
2017-02-03 10:17:02 +01:00
2016-12-09 22:12:21 -05:00
2017-02-10 16:34:17 +00:00
2016-12-12 18:55:08 -08:00
2017-01-11 09:21:41 +01:00
2016-12-25 17:21:22 +01:00
2015-12-03 07:24:29 -08:00
2015-09-08 15:35:28 -07:00