lkml.org 
[lkml]   [2008]   [Apr]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    SubjectRe: kmemcheck caught read from freed memory (cfq_free_io_context)
    From
    Date
    On Wed, 2008-04-02 at 13:53 +0200, Jens Axboe wrote:

    > > Yeah, SLAB_DESTROY_BY_RCU should have a _HUGE_ comment explaining it,
    > > I'm sure this is not the first (nor the last) time people get that
    > > wrong.
    >
    > It should, SLAB_DESTROY_BY_RCU is definitely useful, but it is expected
    > to be an 'easier' way of doing the call_rcu() manually. So it definitely
    > needs more documentation.
    >

    Ok I gave it a go, how bad is this text?

    Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
    ---
    diff --git a/include/linux/slab.h b/include/linux/slab.h
    index f950a89..e049ddc 100644
    --- a/include/linux/slab.h
    +++ b/include/linux/slab.h
    @@ -25,6 +25,32 @@
    #define SLAB_CACHE_DMA 0x00004000UL /* Use GFP_DMA memory */
    #define SLAB_STORE_USER 0x00010000UL /* DEBUG: Store the last owner for bug hunting */
    #define SLAB_PANIC 0x00040000UL /* Panic if kmem_cache_create() fails */
    +/*
    + * SLAB_DESTROY_BY_RCU - **WARNING** READ THIS!
    + *
    + * This delays freeing the SLAB page by a grace period, it does _NOT_
    + * delay object freeing. This means that if you do kmem_cache_free()
    + * that memory location is free to be reused at any time. Thus it may
    + * be possible to see another object there in the same RCU grace period.
    + *
    + * This feature only ensures the memory location backing the object
    + * stays valid, the trick to using this is relying on an independent
    + * object validation pass. Something like:
    + *
    + * rcu_read_lock()
    + * again:
    + * obj = lockless_lookup(key);
    + * if (obj) {
    + * if (!try_get_ref(obj)) // might fail for free objects
    + * goto again;
    + *
    + * if (obj->key != key) { // not the object we expected
    + * put_ref(obj);
    + * goto again;
    + * }
    + * }
    + * rcu_read_unlock();
    + */
    #define SLAB_DESTROY_BY_RCU 0x00080000UL /* Defer freeing slabs to RCU */
    #define SLAB_MEM_SPREAD 0x00100000UL /* Spread some memory over cpuset */
    #define SLAB_TRACE 0x00200000UL /* Trace allocations and frees */



    \
     
     \ /
      Last update: 2008-04-02 14:17    [W:0.028 / U:91.296 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site