Re: [PATCH v3 17/24] locking/lockdep: Free lock classes that are no longer in use

[Bart Van Assche]

On Fri, 2018-12-07 at 13:14 +-0100, Peter Zijlstra wrote:
+AD4 On Thu, Dec 06, 2018 at 05:11:41PM -0800, Bart Van Assche wrote:
+AD4 +AD4 +-	if (WARN+AF8-ON+AF8-ONCE(+ACE-hlock+AF8-class(prev)-+AD4-hash+AF8-entry.pprev) +AHwAfA
+AD4 +AD4 +-	    WARN+AF8-ONCE(+ACE-hlock+AF8-class(next)-+AD4-hash+AF8-entry.pprev,
+AD4 +AD4 +-		      KERN+AF8-INFO +ACI-Detected use-after-free of lock class +ACU-s+AFw-n+ACI,
+AD4 +AD4 +-		      hlock+AF8-class(next)-+AD4-name)) +AHs
+AD4 +AD4 +-		return 2+ADs
+AD4 +AD4 +-	+AH0
+AD4 
+AD4 Ah, this is that UaF on -+AD4-name, but it only happens when there's already
+AD4 been a UaF, so that's fine I suppose. Still a note on that earlier
+AD4 Changelog would've been nice I suppose.

How about reporting the class pointer only as is done elsewhere in the
lockdep code?

+AD4 +AD4 +-/+ACo Must be called with the graph lock held. +ACo-/
+AD4 +AD4 +-static void remove+AF8-class+AF8-from+AF8-lock+AF8-chain(struct lock+AF8-chain +ACo-chain,
+AD4 +AD4 +-					 struct lock+AF8-class +ACo-class)
+AD4 +AD4 +-+AHs
+AD4 +AD4 +-	u64 chain+AF8-key+ADs
+AD4 +AD4 +-	int i+ADs
+AD4 +AD4 +-
+AD4 +AD4 +-+ACM-ifdef CONFIG+AF8-PROVE+AF8-LOCKING
+AD4 +AD4 +-	for (i +AD0 chain-+AD4-base+ADs i +ADw chain-+AD4-base +- chain-+AD4-depth+ADs i+-+-) +AHs
+AD4 +AD4 +-		if (chain+AF8-hlocks+AFs-i+AF0 +ACEAPQ class - lock+AF8-classes)
+AD4 +AD4 +-			continue+ADs
+AD4 +AD4 +-		if (--chain-+AD4-depth +AD4 0)
+AD4 
+AD4  +AHs
+AD4 +AD4 +-			memmove(+ACY-chain+AF8-hlocks+AFs-i+AF0, +ACY-chain+AF8-hlocks+AFs-i +- 1+AF0,
+AD4 +AD4 +-				(chain-+AD4-base +- chain-+AD4-depth - i) +ACo
+AD4 +AD4 +-				sizeof(chain+AF8-hlocks+AFs-0+AF0))+ADs
+AD4 
+AD4  +AH0
+AD4 
+AD4 Also, I suppose a comment here that notes we 'leak' chain+AF8-hlock+AFsAXQ
+AD4 entries would be appropriate here.

OK, I will add such a comment.

+AD4 If Waiman cares, it is possible to reclaim then by extending the above
+AD4 memmove() to cover the +AF8-entire+AF8 tail of the array and then going around
+AD4 and fixing up all the chain-+AD4-base 'pointers' that are in the moved part.

Since that change is outside the scope of what I want to realize I will leave
this to Waiman.

Bart.