Messages in this thread | | | Date | Mon, 19 Sep 2022 09:34:10 -0400 | Subject | Re: [PATCH] mm/slab_common: fix possiable double free of kmem_cache | From | Waiman Long <> |
| |
On 9/19/22 08:50, Feng Tang wrote: > On Mon, Sep 19, 2022 at 05:12:38PM +0800, Vlastimil Babka wrote: >> On 9/19/22 05:12, Feng Tang wrote: > [...] >>> The cause is inside kmem_cache_destroy(): >>> >>> kmem_cache_destroy >>> acquire lock/mutex >>> shutdown_cache >>> schedule_work(kmem_cache_release) (if RCU flag set) >>> release lock/mutex >>> kmem_cache_release (if RCU flag set) >> ^ not set >> >> I've fixed that up. > Oops.. Thanks for catching it! > >>> in some certain timing, the scheduled work could be run before >>> the next RCU flag checking which will get a wrong state. >>> >>> Fix it by caching the RCU flag inside protected area, just like 'refcnt' >>> >>> Signed-off-by: Feng Tang <feng.tang@intel.com> >> Thanks! >> >>> --- >>> >>> note: >>> >>> The error only happens on linux-next tree, and not in Linus' tree, >>> which already has Waiman's commit: >>> 0495e337b703 ("mm/slab_common: Deleting kobject in kmem_cache_destroy() >>> without holding slab_mutex/cpu_hotplug_lock") >> Actually that commit is already in Linus' rc5 too, so I will send your fix >> this week too. Added a Fixes: 0495e337b703 (...) too. > Got it, thanks > > - Feng
Thanks for catching this bug.
Reviewed-by: Waiman Long <longman@redhat.com>
Cheers, Longman
| |