On Tue, Jun 04, 2019 at 07:44:45PM -0700, Roman Gushchin wrote: > Johannes noticed that reading the memcg kmem_cache pointer in > cache_from_memcg_idx() is performed using READ_ONCE() macro, > which doesn't implement a SMP barrier, which is required > by the logic. > > Add a proper smp_rmb() to be paired with smp_wmb() in > memcg_create_kmem_cache(). > > The same applies to memcg_create_kmem_cache() itself, > which reads the same value without barriers and READ_ONCE(). > > Suggested-by: Johannes Weiner <[email protected]> > Signed-off-by: Roman Gushchin <[email protected]> > --- > mm/slab.h | 1 + > mm/slab_common.c | 3 ++- > 2 files changed, 3 insertions(+), 1 deletion(-) > > diff --git a/mm/slab.h b/mm/slab.h > index 739099af6cbb..1176b61bb8fc 100644 > --- a/mm/slab.h > +++ b/mm/slab.h > @@ -260,6 +260,7 @@ cache_from_memcg_idx(struct kmem_cache *s, int idx) > * memcg_caches issues a write barrier to match this (see > * memcg_create_kmem_cache()). > */ > + smp_rmb(); > cachep = READ_ONCE(arr->entries[idx]);
Hmm, we used to have lockless_dereference() here, but it was replaced with READ_ONCE some time ago. The commit message claims that READ_ONCE has an implicit read barrier in it. commit 506458efaf153c1ea480591c5602a5a3ba5a3b76 Author: Will Deacon <[email protected]> Date: Tue Oct 24 11:22:48 2017 +0100 locking/barriers: Convert users of lockless_dereference() to READ_ONCE() READ_ONCE() now has an implicit smp_read_barrier_depends() call, so it can be used instead of lockless_dereference() without any change in semantics. Signed-off-by: Will Deacon <[email protected]> Cc: Linus Torvalds <[email protected]> Cc: Paul E. McKenney <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Thomas Gleixner <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Ingo Molnar <[email protected]> commit 76ebbe78f7390aee075a7f3768af197ded1bdfbb Author: Will Deacon <[email protected]> Date: Tue Oct 24 11:22:47 2017 +0100 locking/barriers: Add implicit smp_read_barrier_depends() to READ_ONCE() In preparation for the removal of lockless_dereference(), which is the same as READ_ONCE() on all architectures other than Alpha, add an implicit smp_read_barrier_depends() to READ_ONCE() so that it can be used to head dependency chains on all architectures. Signed-off-by: Will Deacon <[email protected]> Cc: Linus Torvalds <[email protected]> Cc: Paul E. McKenney <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Thomas Gleixner <[email protected]> Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Ingo Molnar <[email protected]>
