In message: [linux-yocto rt v5.2&v5.4] mm: slub: Always flush the delayed empty
slubs in flush_all()
on 26/05/2020 Kevin Hao wrote:
> commit 23a2c31b19e99beaf5107071b0f32a596202cdae from
> git://git.kernel.org/pub/scm/linux/kernel/git/rt/linux-rt-devel.git
>
> After commit f0b231101c94 ("mm/SLUB: delay giving back empty slubs to
> IRQ enabled regions"), when the free_slab() is invoked with the IRQ
> disabled, the empty slubs are moved to a per-CPU list and will be
> freed after IRQ enabled later. But in the current codes, there is
> a check to see if there really has the cpu slub on a specific cpu
> before flushing the delayed empty slubs, this may cause a reference
> of already released kmem_cache in a scenario like below:
> cpu 0 cpu 1
> kmem_cache_destroy()
> flush_all()
> --->IPI flush_cpu_slab()
> flush_slab()
> deactivate_slab()
> discard_slab()
> free_slab()
> c->page = NULL;
> for_each_online_cpu(cpu)
> if (!has_cpu_slab(1, s))
> continue
> this skip to flush the delayed
> empty slub released by cpu1
> kmem_cache_free(kmem_cache, s)
>
> kmalloc()
> __slab_alloc()
> free_delayed()
> __free_slab()
> reference to released kmem_cache
>
> Fixes: f0b231101c94 ("mm/SLUB: delay giving back empty slubs to IRQ enabled
> regions")
> Signed-off-by: Kevin Hao <[email protected]>
> Signed-off-by: Sebastian Andrzej Siewior <[email protected]>
> Cc: [email protected]
> ---
> Hi Bruce,
>
> Please help me merge this into the following two branches:
> v5.2/standard/preempt-rt/base
> v5.4/standard/preempt-rt/base
I thought about waiting for this to loop through the rt 5.4-stable tree, but
who knows how long that would take!
I've merged the changes to both -rt branches now.
Bruce
>
> mm/slub.c | 3 ---
> 1 file changed, 3 deletions(-)
>
> diff --git a/mm/slub.c b/mm/slub.c
> index 05f176aa7f70..5c10491cd93a 100644
> --- a/mm/slub.c
> +++ b/mm/slub.c
> @@ -2382,9 +2382,6 @@ static void flush_all(struct kmem_cache *s)
> for_each_online_cpu(cpu) {
> struct slub_free_list *f;
>
> - if (!has_cpu_slab(cpu, s))
> - continue;
> -
> f = &per_cpu(slub_free_list, cpu);
> raw_spin_lock_irq(&f->lock);
> list_splice_init(&f->list, &tofree);
> --
> 2.26.2
>
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#8724):
https://lists.yoctoproject.org/g/linux-yocto/message/8724
Mute This Topic: https://lists.yoctoproject.org/mt/74470908/21656
Group Owner: [email protected]
Unsubscribe: https://lists.yoctoproject.org/g/linux-yocto/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
