From: zanussi@kernel.org
To: LKML <linux-kernel@vger.kernel.org>,
linux-rt-users <linux-rt-users@vger.kernel.org>,
Steven Rostedt <rostedt@goodmis.org>,
Thomas Gleixner <tglx@linutronix.de>,
Carsten Emde <C.Emde@osadl.org>, John Kacur <jkacur@redhat.com>,
Sebastian Andrzej Siewior <bigeasy@linutronix.de>,
Daniel Wagner <wagi@monom.org>,
Clark Williams <williams@redhat.com>,
Pavel Machek <pavel@denx.de>, Tom Zanussi <zanussi@kernel.org>
Cc: Kevin Hao <haokexin@gmail.com>, stable-rt@vger.kernel.org
Subject: [PATCH RT 2/4] mm: slub: Always flush the delayed empty slubs in flush_all()
Date: Thu, 11 Jun 2020 13:10:15 -0500 [thread overview]
Message-ID: <7f22ccf72a55f87d771a9dd0ea0c5e227b6b7b5c.1591898986.git.zanussi@kernel.org> (raw)
In-Reply-To: <cover.1591898986.git.zanussi@kernel.org>
In-Reply-To: <cover.1591898986.git.zanussi@kernel.org>
From: Kevin Hao <haokexin@gmail.com>
v4.19.127-rt55-rc1 stable review patch.
If anyone has any objections, please let me know.
-----------
[ Upstream commit 23a2c31b19e99beaf5107071b0f32a596202cdae ]
After commit f0b231101c94 ("mm/SLUB: delay giving back empty slubs to
IRQ enabled regions"), when the free_slab() is invoked with the IRQ
disabled, the empty slubs are moved to a per-CPU list and will be
freed after IRQ enabled later. But in the current codes, there is
a check to see if there really has the cpu slub on a specific cpu
before flushing the delayed empty slubs, this may cause a reference
of already released kmem_cache in a scenario like below:
cpu 0 cpu 1
kmem_cache_destroy()
flush_all()
--->IPI flush_cpu_slab()
flush_slab()
deactivate_slab()
discard_slab()
free_slab()
c->page = NULL;
for_each_online_cpu(cpu)
if (!has_cpu_slab(1, s))
continue
this skip to flush the delayed
empty slub released by cpu1
kmem_cache_free(kmem_cache, s)
kmalloc()
__slab_alloc()
free_delayed()
__free_slab()
reference to released kmem_cache
Fixes: f0b231101c94 ("mm/SLUB: delay giving back empty slubs to IRQ enabled regions")
Signed-off-by: Kevin Hao <haokexin@gmail.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: stable-rt@vger.kernel.org
Signed-off-by: Tom Zanussi <zanussi@kernel.org>
---
mm/slub.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/mm/slub.c b/mm/slub.c
index d243c6ef7fc9..a9473bbb1338 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2341,9 +2341,6 @@ static void flush_all(struct kmem_cache *s)
for_each_online_cpu(cpu) {
struct slub_free_list *f;
- if (!has_cpu_slab(cpu, s))
- continue;
-
f = &per_cpu(slub_free_list, cpu);
raw_spin_lock_irq(&f->lock);
list_splice_init(&f->list, &tofree);
--
2.17.1
next prev parent reply other threads:[~2020-06-11 18:10 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-11 18:10 [PATCH RT 0/4] Linux v4.19.127-rt55-rc1 zanussi
2020-06-11 18:10 ` [PATCH RT 1/4] fs/dcache: Include swait.h header zanussi
2020-06-11 18:10 ` zanussi [this message]
2020-06-11 18:10 ` [PATCH RT 3/4] tasklet: Fix UP case for tasklet CHAINED state zanussi
2020-06-12 13:09 ` Sebastian Andrzej Siewior
2020-06-11 18:10 ` [PATCH RT 4/4] Linux 4.19.127-rt55-rc1 zanussi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7f22ccf72a55f87d771a9dd0ea0c5e227b6b7b5c.1591898986.git.zanussi@kernel.org \
--to=zanussi@kernel.org \
--cc=C.Emde@osadl.org \
--cc=bigeasy@linutronix.de \
--cc=haokexin@gmail.com \
--cc=jkacur@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rt-users@vger.kernel.org \
--cc=pavel@denx.de \
--cc=rostedt@goodmis.org \
--cc=stable-rt@vger.kernel.org \
--cc=tglx@linutronix.de \
--cc=wagi@monom.org \
--cc=williams@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).