raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 10:00:17 +00:00
Code Issues Projects Releases Wiki Activity

slab: Fix obj_ext mistakenly considered NULL due to race condition

Browse Source 
commit 7f434e1d9a upstream.

If two competing threads enter alloc_slab_obj_exts(), and the one that
allocates the vector wins the cmpxchg(), the other thread that failed
allocation mistakenly assumes that slab->obj_exts is still empty due to
its own allocation failure. This will then trigger warnings with
CONFIG_MEM_ALLOC_PROFILING_DEBUG checks in the subsequent free path.

Therefore, let's check the result of cmpxchg() to see if marking the
allocation as failed was successful. If it wasn't, check whether the
winning side has succeeded its allocation (it might have been also
marking it as failed) and if yes, return success.

Suggested-by: Harry Yoo <harry.yoo@oracle.com>
Fixes: f7381b9116 ("slab: mark slab->obj_exts allocation failures unconditionally")
Cc: <stable@vger.kernel.org>
Signed-off-by: Hao Ge <gehao@kylinos.cn>
Link: https://patch.msgid.link/20251023143313.1327968-1-hao.ge@linux.dev
Reviewed-by: Suren Baghdasaryan <surenb@google.com>
Reviewed-by: Harry Yoo <harry.yoo@oracle.com>
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Hao Ge
2025-10-23 22:33:13 +08:00
committed by Greg Kroah-Hartman
parent 7c34feda6a
commit 1bbdfd6476
1 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
mm/slub.c
View File

@@ -1976,9 +1976,9 @@ static inline void mark_objexts_empty(struct slabobj_ext *obj_exts)
} }
} }
static inline void mark_failed_objexts_alloc(struct slab *slab) static inline bool mark_failed_objexts_alloc(struct slab *slab)
{ {
cmpxchg(&slab->obj_exts, 0, OBJEXTS_ALLOC_FAIL); return cmpxchg(&slab->obj_exts, 0, OBJEXTS_ALLOC_FAIL) == 0;
} }
static inline void handle_failed_objexts_alloc(unsigned long obj_exts, static inline void handle_failed_objexts_alloc(unsigned long obj_exts,
@@ -2000,7 +2000,7 @@ static inline void handle_failed_objexts_alloc(unsigned long obj_exts,
#else /* CONFIG_MEM_ALLOC_PROFILING_DEBUG */ #else /* CONFIG_MEM_ALLOC_PROFILING_DEBUG */
static inline void mark_objexts_empty(struct slabobj_ext *obj_exts) {} static inline void mark_objexts_empty(struct slabobj_ext *obj_exts) {}
static inline void mark_failed_objexts_alloc(struct slab *slab) {} static inline bool mark_failed_objexts_alloc(struct slab *slab) { return false; }
static inline void handle_failed_objexts_alloc(unsigned long obj_exts, static inline void handle_failed_objexts_alloc(unsigned long obj_exts,
struct slabobj_ext *vec, unsigned int objects) {} struct slabobj_ext *vec, unsigned int objects) {}
@@ -2033,8 +2033,14 @@ int alloc_slab_obj_exts(struct slab *slab, struct kmem_cache *s,
vec = kcalloc_node(objects, sizeof(struct slabobj_ext), gfp, vec = kcalloc_node(objects, sizeof(struct slabobj_ext), gfp,
slab_nid(slab)); slab_nid(slab));
if (!vec) { if (!vec) {
/* Mark vectors which failed to allocate */ /*
mark_failed_objexts_alloc(slab); * Try to mark vectors which failed to allocate.
* If this operation fails, there may be a racing process
* that has already completed the allocation.
*/
if (!mark_failed_objexts_alloc(slab) &&
slab_obj_exts(slab))
return 0;
return -ENOMEM; return -ENOMEM;
} }