summaryrefslogtreecommitdiffstats
path: root/debian/patches-rt/0200-mm-slub-Always-flush-the-delayed-empty-slubs-in-flus.patch
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--debian/patches-rt/0200-mm-slub-Always-flush-the-delayed-empty-slubs-in-flus.patch61
1 files changed, 61 insertions, 0 deletions
diff --git a/debian/patches-rt/0200-mm-slub-Always-flush-the-delayed-empty-slubs-in-flus.patch b/debian/patches-rt/0200-mm-slub-Always-flush-the-delayed-empty-slubs-in-flus.patch
new file mode 100644
index 000000000..0fd8180bd
--- /dev/null
+++ b/debian/patches-rt/0200-mm-slub-Always-flush-the-delayed-empty-slubs-in-flus.patch
@@ -0,0 +1,61 @@
+From d903b2377e443ae1df59e15824b683d326e7c24b Mon Sep 17 00:00:00 2001
+From: Kevin Hao <haokexin@gmail.com>
+Date: Mon, 4 May 2020 11:34:07 +0800
+Subject: [PATCH 200/323] mm: slub: Always flush the delayed empty slubs in
+ flush_all()
+Origin: https://www.kernel.org/pub/linux/kernel/projects/rt/5.10/older/patches-5.10.204-rt100.tar.xz
+
+After commit f0b231101c94 ("mm/SLUB: delay giving back empty slubs to
+IRQ enabled regions"), when the free_slab() is invoked with the IRQ
+disabled, the empty slubs are moved to a per-CPU list and will be
+freed after IRQ enabled later. But in the current codes, there is
+a check to see if there really has the cpu slub on a specific cpu
+before flushing the delayed empty slubs, this may cause a reference
+of already released kmem_cache in a scenario like below:
+ cpu 0 cpu 1
+ kmem_cache_destroy()
+ flush_all()
+ --->IPI flush_cpu_slab()
+ flush_slab()
+ deactivate_slab()
+ discard_slab()
+ free_slab()
+ c->page = NULL;
+ for_each_online_cpu(cpu)
+ if (!has_cpu_slab(1, s))
+ continue
+ this skip to flush the delayed
+ empty slub released by cpu1
+ kmem_cache_free(kmem_cache, s)
+
+ kmalloc()
+ __slab_alloc()
+ free_delayed()
+ __free_slab()
+ reference to released kmem_cache
+
+Fixes: f0b231101c94 ("mm/SLUB: delay giving back empty slubs to IRQ enabled regions")
+Signed-off-by: Kevin Hao <haokexin@gmail.com>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Cc: stable-rt@vger.kernel.org
+---
+ mm/slub.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/mm/slub.c b/mm/slub.c
+index faba29039375..cb414c1f9ef6 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -2501,9 +2501,6 @@ static void flush_all(struct kmem_cache *s)
+ for_each_online_cpu(cpu) {
+ struct slub_free_list *f;
+
+- if (!has_cpu_slab(cpu, s))
+- continue;
+-
+ f = &per_cpu(slub_free_list, cpu);
+ raw_spin_lock_irq(&f->lock);
+ list_splice_init(&f->list, &tofree);
+--
+2.43.0
+