From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6D1AC3546CB for ; Mon, 27 Jul 2026 18:24:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785176647; cv=none; b=hKMkUofYESdLdyx8JMvukppwKgPOkMnHCDU/nGyLwOP7N7Pu4FZh8VicmrKZxFuaQroIyHh4W63mWNlWDqW1fJfXyYESusJGHGyoWAbdRbOcitY9ubPWveBWlgrvjMVFAedlxjKYOe7tKC460lTysJZ3YnyHpEdIWJjiCOGfTO4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785176647; c=relaxed/simple; bh=OGTPpcRIC7l2nGoKwUGxOeux6wDGFBRSgCZFyDoPrmA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=Dwz4xEkvrfqMI8+yBCyc3fBSBUmzApFXpIFqgEJPd6wwQ2TWxMVeW9ePsAWTcbe1g1s21LYtzdzEdfk/TvJ7btfZJb552YNteOUPC6JxLZEvk7L9fg4VxNX8eVTNOKE84onMOLdsv/rRmb3lW7OF61Vl/0ne/+xN+Nj+Hb3e4AU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=S2wp686C; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="S2wp686C" Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66RIHkGC2995054; Mon, 27 Jul 2026 18:23:53 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:message-id :mime-version:subject:to; s=pp1; bh=FVKO8tqExPX1qWJSEH62JzvrZ5+g LCcMiohf1fmPJ4Q=; b=S2wp686CSO3TPTuGYz4m+3T8kpmXPvEXPdRsw7VQa91K CNcrujwcTPh4CNbynHz4V8n/HaJCZxkY4gPtr4OiCjlDIwWQ7fQsUKUfPJ4xjQ61 YQQ+EDrwJ7ppoFDerH+gxPZOg2mp2Zn1Gdm01k9gVLPLkzVRuzWAdKFVDc6OhjvD lB2qcMkN/rCdH9JIBzZ4wyhI9XJv6hY3FsjkpS+L0oN/1jS+aDju/6KZ1Y7LhqRe GpsNTwPvy9hKUbIxAtjUSWfQGwqJrDgtjS/cFnJY75E5Vwgp7kiJZ8zJepq9JLE5 2PCSkdAttRoTiidmVGiI5AeutN9Ot2twGnNSJxnuOw== Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4fmuwcs29p-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 27 Jul 2026 18:23:53 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66RIDvtH014164; Mon, 27 Jul 2026 18:23:52 GMT Received: from smtprelay02.fra02v.mail.ibm.com ([9.218.2.226]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4fn8yh6esg-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 27 Jul 2026 18:23:52 +0000 (GMT) Received: from smtpav05.fra02v.mail.ibm.com (smtpav05.fra02v.mail.ibm.com [10.20.54.104]) by smtprelay02.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66RINoYM51315006 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 27 Jul 2026 18:23:50 GMT Received: from smtpav05.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3A02F2018D; Mon, 27 Jul 2026 18:23:50 +0000 (GMT) Received: from smtpav05.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id BF27120188; Mon, 27 Jul 2026 18:23:47 +0000 (GMT) Received: from li-a84c74cc-2b13-11b2-a85c-acdd023f0674.ibm.com.com (unknown [9.43.97.190]) by smtpav05.fra02v.mail.ibm.com (Postfix) with ESMTP; Mon, 27 Jul 2026 18:23:47 +0000 (GMT) From: Nilay Shroff To: Peter Zijlstra , Ingo Molnar , Will Deacon , Boqun Feng , Waiman Long , Bart Van Assche , linux-kernel@vger.kernel.org Cc: Nilay Shroff , "Shin'ichiro Kawasaki" , Geliang Tang Subject: [PATCH v2] lockdep: Fix subclass resource leak in lockdep_unregister_key() Date: Mon, 27 Jul 2026 23:53:03 +0530 Message-ID: <20260727182312.3750145-1-nilay@linux.ibm.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: mnrJBZxKVK4XA2SIBKACJEt_WAYMvldZ X-Proofpoint-Spam-Info: AW1haW4tMjYwNzI3MDE2OSBTYWx0ZWRfXw/uH/IsiNajq 3WRKhUNw5k3mzq4vr6Cy6kWd0NIYtououlvxqHC6LRK6rGsN/cJrzutNMfPkqz8MmKwz8NNbEdZ 6cxmZJyeR1urgHx3iM4OFQYq9PgAkWM= X-Authority-Analysis: v=2.4 cv=E/z9Y6dl c=1 sm=1 tr=0 ts=6a67a239 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=JF9118EUAAAA:8 a=VwQbUJbxAAAA:8 a=20KFwNOVAAAA:8 a=VnNF1IyMAAAA:8 a=q9tL8JvT_fKMGbGa0EwA:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 a=xVlTc564ipvMDusKsbsT:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzI3MDE2OSBTYWx0ZWRfX5GApb+XueA74 Zpl1/AV8jA+mzifnX+z+f0X3u34U7TABBoTPrtmWjnhOLJH/N9zy7MSpt8EikQjhlk9YIXLLGhF q8hLzFQqZ8zizweawMB54dMzWp+ldsgdYYz5AUFlgjrZPvfhDOJ6IB3Ou51QaDtUvNm9dh6aXMN Dkrl+BVvdYFGR/hwtAFFcG5+qWvdZ33nEWmXpK1Ca+AOpTQQ/bhEbbquO2kFXxLsOK9G2Zyph+2 s75XnV0xqbqMR/pdOc66zDwkp8o9hUWR6AYi0N6ypbsn8R30WUbsF2pahIIyHVrlTktMA2uN/9f hYieN9+y2nzpuifeutKT9uolq/W4air//nt4QbDDMhxjnsV2FWV9O/0vjJ0QFCykpi3XYQau+Id CF/nGiRBzBtxbyVCC+7CnkskiiJm78FC8bV9250aUHWICQ1ejprx2dEPsc74AZ6rZ3PBCX2DyIe LdAWpzDvRfI0O6B+y3A== X-Proofpoint-GUID: mnrJBZxKVK4XA2SIBKACJEt_WAYMvldZ X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-27_05,2026-07-27_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 priorityscore=1501 spamscore=0 clxscore=1015 phishscore=0 lowpriorityscore=0 bulkscore=0 malwarescore=0 impostorscore=0 suspectscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607270169 When a dynamic lock key is unregistered using lockdep_unregister_key(), lockdep routes the cleanup sequence through __lockdep_free_key_range() with a hardcoded size of 1. This layout model assumes that a dynamic key only occupies its base registration address (subclass 0). However, when a lock utilizes nested acquisitions—either implicitly via networking paths (e.g., bh_lock_sock_nested() passing SINGLE_DEPTH_NESTING) or explicitly via mutex_lock_nested()—lockdep calculates virtual class tracking nodes using pointer math offsets: Virtual Class Pointer = Base Address of Key + Subclass Index Because the unregister range size is strictly constrained to 1, lockdep completely skips evaluating adjacent virtual subclass slots (key + 1 through key + 7). Consequently, when dynamic structures (such as per- queue network sockets) are repeatedly created, teardowned, and allocated at fresh memory blocks, the subclass /1 structures and their historical dependency chains are permanently orphaned in the global graph. Over prolonged runtime and frequent reconnect loops, this asymmetry leads to the absolute exhaustion of MAX_LOCKDEP_CHAIN_HLOCKS. Fix this by instructing lockdep_unregister_key() to look ahead across the entire valid subclass allocation block range (MAX_LOCKDEP_SUBCLASSES), ensuring that all related subclass matrix definitions are completely zapped alongside the primary key. Cc: Shin'ichiro Kawasaki Reported-by: Geliang Tang Tested-by: Geliang Tang Fixes: 108c14858b9e ("locking/lockdep: Add support for dynamic keys") Reviewed-by: Waiman Long Signed-off-by: Nilay Shroff --- Changes from v1: - added Fixes and RB tags --- kernel/locking/lockdep.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c index 2d4c5bab5af8..490904bee63e 100644 --- a/kernel/locking/lockdep.c +++ b/kernel/locking/lockdep.c @@ -6606,7 +6606,7 @@ void lockdep_unregister_key(struct lock_class_key *key) WARN_ON_ONCE(!found && debug_locks); if (found) { pf = get_pending_free(); - __lockdep_free_key_range(pf, key, 1); + __lockdep_free_key_range(pf, key, MAX_LOCKDEP_SUBCLASSES); need_callback = prepare_call_rcu_zapped(pf); nr_dynamic_keys--; } -- 2.53.0