1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
|
From: Kevin Hao <haokexin@gmail.com>
Date: Mon, 4 May 2020 11:34:07 +0800
Subject: [PATCH 326/353] mm: slub: Always flush the delayed empty slubs in
flush_all()
Origin: https://git.kernel.org/cgit/linux/kernel/git/rt/linux-stable-rt.git/commit?id=6b445fe16bd98d9edf5f1d4f1c822149fa84f649
[ Upstream commit 23a2c31b19e99beaf5107071b0f32a596202cdae ]
After commit f0b231101c94 ("mm/SLUB: delay giving back empty slubs to
IRQ enabled regions"), when the free_slab() is invoked with the IRQ
disabled, the empty slubs are moved to a per-CPU list and will be
freed after IRQ enabled later. But in the current codes, there is
a check to see if there really has the cpu slub on a specific cpu
before flushing the delayed empty slubs, this may cause a reference
of already released kmem_cache in a scenario like below:
cpu 0 cpu 1
kmem_cache_destroy()
flush_all()
--->IPI flush_cpu_slab()
flush_slab()
deactivate_slab()
discard_slab()
free_slab()
c->page = NULL;
for_each_online_cpu(cpu)
if (!has_cpu_slab(1, s))
continue
this skip to flush the delayed
empty slub released by cpu1
kmem_cache_free(kmem_cache, s)
kmalloc()
__slab_alloc()
free_delayed()
__free_slab()
reference to released kmem_cache
Fixes: f0b231101c94 ("mm/SLUB: delay giving back empty slubs to IRQ enabled regions")
Signed-off-by: Kevin Hao <haokexin@gmail.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: stable-rt@vger.kernel.org
Signed-off-by: Tom Zanussi <zanussi@kernel.org>
---
mm/slub.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/mm/slub.c b/mm/slub.c
index 197bab70a05d..d16d390df21e 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2375,9 +2375,6 @@ static void flush_all(struct kmem_cache *s)
for_each_online_cpu(cpu) {
struct slub_free_list *f;
- if (!has_cpu_slab(cpu, s))
- continue;
-
f = &per_cpu(slub_free_list, cpu);
raw_spin_lock_irq(&f->lock);
list_splice_init(&f->list, &tofree);
|
