[lkml]   [2011]   [Oct]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH][RT] slab: Fix __do_drain to use the right array cache
The array cache in __do_drain() was using the cpu_cache_get() function
which uses smp_processor_id() to get the proper array. On mainline, this
is fine as __do_drain() is called by for_each_cpu() which runs
__do_drain() on the CPU it is processing. In RT locks are used instead
and __do_drain() is only called from a single CPU. This can cause the
accounting to be off and trigger the following bug:

slab error in kmem_cache_destroy(): cache `nfs_write_data': Can't free all objects
Pid: 2905, comm: rmmod Not tainted 3.0.6-test-rt17+ #78
Call Trace:
[<ffffffff810fb623>] kmem_cache_destroy+0xa0/0xdf
[<ffffffffa03aaffb>] nfs_destroy_writepagecache+0x49/0x4e [nfs]
[<ffffffffa03c0fe0>] exit_nfs_fs+0xe/0x46 [nfs]
[<ffffffff8107af09>] sys_delete_module+0x1ba/0x22c
[<ffffffff8109429d>] ? audit_syscall_entry+0x11c/0x148
[<ffffffff814b6442>] system_call_fastpath+0x16/0x1b

This can be easily triggered by a simple while loop:

# while :; do modprobe nfs; rmmod nfs; done

The proper function to use is cpu_cache_get_on_cpu(). It works for both
RT and non-RT as the non-RT passes in smp_processor_id() into

Signed-off-by: Steven Rostedt <>

Index: linux-rt.git/mm/slab.c
--- linux-rt.git.orig/mm/slab.c
+++ linux-rt.git/mm/slab.c
@@ -2601,7 +2601,7 @@ static void __do_drain(void *arg, unsign
struct array_cache *ac;
int node = cpu_to_mem(cpu);

- ac = cpu_cache_get(cachep);
+ ac = cpu_cache_get_on_cpu(cachep, cpu);
free_block(cachep, ac->entry, ac->avail, node);

 \ /
  Last update: 2011-10-12 05:59    [W:0.029 / U:0.520 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site