From: Steven Rostedt <rostedt@goodmis.org>
To: linux-kernel@vger.kernel.org,
linux-rt-users <linux-rt-users@vger.kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>,
Carsten Emde <C.Emde@osadl.org>,
Sebastian Andrzej Siewior <bigeasy@linutronix.de>,
John Kacur <jkacur@redhat.com>, Daniel Wagner <wagi@monom.org>,
Tom Zanussi <zanussi@kernel.org>,
"Srivatsa S. Bhat" <srivatsa@csail.mit.edu>,
Kevin Hao <haokexin@gmail.com>,
stable-rt@vger.kernel.org
Subject: [PATCH RT 5/8] mm: slub: Always flush the delayed empty slubs in flush_all()
Date: Fri, 05 Jun 2020 19:41:54 -0400 [thread overview]
Message-ID: <20200605234222.459959297@goodmis.org> (raw)
In-Reply-To: 20200605234149.965509211@goodmis.org
5.4.44-rt27-rc1 stable review patch.
If anyone has any objections, please let me know.
------------------
From: Kevin Hao <haokexin@gmail.com>
After commit f0b231101c94 ("mm/SLUB: delay giving back empty slubs to
IRQ enabled regions"), when the free_slab() is invoked with the IRQ
disabled, the empty slubs are moved to a per-CPU list and will be
freed after IRQ enabled later. But in the current codes, there is
a check to see if there really has the cpu slub on a specific cpu
before flushing the delayed empty slubs, this may cause a reference
of already released kmem_cache in a scenario like below:
cpu 0 cpu 1
kmem_cache_destroy()
flush_all()
--->IPI flush_cpu_slab()
flush_slab()
deactivate_slab()
discard_slab()
free_slab()
c->page = NULL;
for_each_online_cpu(cpu)
if (!has_cpu_slab(1, s))
continue
this skip to flush the delayed
empty slub released by cpu1
kmem_cache_free(kmem_cache, s)
kmalloc()
__slab_alloc()
free_delayed()
__free_slab()
reference to released kmem_cache
Fixes: f0b231101c94 ("mm/SLUB: delay giving back empty slubs to IRQ enabled regions")
Signed-off-by: Kevin Hao <haokexin@gmail.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: stable-rt@vger.kernel.org
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
---
mm/slub.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/mm/slub.c b/mm/slub.c
index bea18bbae247..b2809a9ca8f8 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2382,9 +2382,6 @@ static void flush_all(struct kmem_cache *s)
for_each_online_cpu(cpu) {
struct slub_free_list *f;
- if (!has_cpu_slab(cpu, s))
- continue;
-
f = &per_cpu(slub_free_list, cpu);
raw_spin_lock_irq(&f->lock);
list_splice_init(&f->list, &tofree);
--
2.26.2
next prev parent reply other threads:[~2020-06-05 23:42 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-05 23:41 [PATCH RT 0/8] Linux 5.4.44-rt27-rc1 Steven Rostedt
2020-06-05 23:41 ` [PATCH RT 1/8] printk: console must not schedule for drivers Steven Rostedt
2020-06-05 23:41 ` [PATCH RT 2/8] fs/dcache: Include swait.h header Steven Rostedt
2020-06-05 23:41 ` [PATCH RT 3/8] Revert "rt: Improve the serial console PASS_LIMIT" Steven Rostedt
2020-06-05 23:41 ` [PATCH RT 4/8] mm: Dont warn about atomic memory allocations during suspend Steven Rostedt
2020-06-05 23:41 ` Steven Rostedt [this message]
2020-06-05 23:41 ` [PATCH RT 7/8] mm/zswap: Use local lock to protect per-CPU data Steven Rostedt
2020-06-05 23:41 ` [PATCH RT 8/8] Linux 5.4.44-rt27-rc1 Steven Rostedt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200605234222.459959297@goodmis.org \
--to=rostedt@goodmis.org \
--cc=C.Emde@osadl.org \
--cc=bigeasy@linutronix.de \
--cc=haokexin@gmail.com \
--cc=jkacur@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rt-users@vger.kernel.org \
--cc=srivatsa@csail.mit.edu \
--cc=stable-rt@vger.kernel.org \
--cc=tglx@linutronix.de \
--cc=wagi@monom.org \
--cc=zanussi@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).