slab fixes for 6.0-rc7
-----BEGIN PGP SIGNATURE----- iQEzBAABCAAdFiEEjUuTAak14xi+SF7M4CHKc/GJqRAFAmMsvZoACgkQ4CHKc/GJ qRC3UQf/bHHsh/tYV26OrNBJ82V9KlM8V5TNkn2QRfnS9EP3J1y4snENpQ+gZRXf QgSt/hgQqhvdazNtNwzUeW4ENymyt78zJfH87Kj36ApB+6xUnX3qIqmPHGn5Bqzn Oo1mY4UfYExzq8k9m2L5De/ULNBClItjkYZ1sPGAbMvM8LSSeneABimxq9aey00d IENX1mboxju13+Z2nasze7QJkeaJ8emFJY2X2E1A0FGPvcnRSK34t5EtFZnC/wd3 D2awIw4ebASY1NqBnJfy6ClcyY0dE30pT2eWLLatjDXdesI8oDkqkaeyyWZEXwX5 gMkJOEaAJcob4LpcsVPikRUrPadGrA== =Jao8 -----END PGP SIGNATURE----- Merge tag 'slab-for-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fixes from Vlastimil Babka: - Fix a possible use-after-free in SLUB's kmem_cache removal, introduced in this cycle, by Feng Tang. - WQ_MEM_RECLAIM dependency fix for the workqueue-based cpu slab flushing introduced in 5.15, by Maurizio Lombardi. - Add missing KASAN hooks in two kmalloc entry paths, by Peter Collingbourne. - A BUG_ON() removal in SLUB's kmem_cache creation when allocation fails (too small to possibly happen in practice, syzbot used fault injection), by Chao Yu. * tag 'slab-for-6.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm: slub: fix flush_cpu_slab()/__free_slab() invocations in task context. mm/slab_common: fix possible double free of kmem_cache kasan: call kasan_malloc() from __kmalloc_*track_caller() mm/slub: fix to return errno if kmalloc() fails
This commit is contained in:
commit
3c0f396a38
@ -475,6 +475,7 @@ void slab_kmem_cache_release(struct kmem_cache *s)
|
||||
void kmem_cache_destroy(struct kmem_cache *s)
|
||||
{
|
||||
int refcnt;
|
||||
bool rcu_set;
|
||||
|
||||
if (unlikely(!s) || !kasan_check_byte(s))
|
||||
return;
|
||||
@ -482,6 +483,8 @@ void kmem_cache_destroy(struct kmem_cache *s)
|
||||
cpus_read_lock();
|
||||
mutex_lock(&slab_mutex);
|
||||
|
||||
rcu_set = s->flags & SLAB_TYPESAFE_BY_RCU;
|
||||
|
||||
refcnt = --s->refcount;
|
||||
if (refcnt)
|
||||
goto out_unlock;
|
||||
@ -492,7 +495,7 @@ void kmem_cache_destroy(struct kmem_cache *s)
|
||||
out_unlock:
|
||||
mutex_unlock(&slab_mutex);
|
||||
cpus_read_unlock();
|
||||
if (!refcnt && !(s->flags & SLAB_TYPESAFE_BY_RCU))
|
||||
if (!refcnt && !rcu_set)
|
||||
kmem_cache_release(s);
|
||||
}
|
||||
EXPORT_SYMBOL(kmem_cache_destroy);
|
||||
|
18
mm/slub.c
18
mm/slub.c
@ -310,6 +310,11 @@ static inline void stat(const struct kmem_cache *s, enum stat_item si)
|
||||
*/
|
||||
static nodemask_t slab_nodes;
|
||||
|
||||
/*
|
||||
* Workqueue used for flush_cpu_slab().
|
||||
*/
|
||||
static struct workqueue_struct *flushwq;
|
||||
|
||||
/********************************************************************
|
||||
* Core slab cache functions
|
||||
*******************************************************************/
|
||||
@ -2730,7 +2735,7 @@ static void flush_all_cpus_locked(struct kmem_cache *s)
|
||||
INIT_WORK(&sfw->work, flush_cpu_slab);
|
||||
sfw->skip = false;
|
||||
sfw->s = s;
|
||||
schedule_work_on(cpu, &sfw->work);
|
||||
queue_work_on(cpu, flushwq, &sfw->work);
|
||||
}
|
||||
|
||||
for_each_online_cpu(cpu) {
|
||||
@ -4858,6 +4863,8 @@ void __init kmem_cache_init(void)
|
||||
|
||||
void __init kmem_cache_init_late(void)
|
||||
{
|
||||
flushwq = alloc_workqueue("slub_flushwq", WQ_MEM_RECLAIM, 0);
|
||||
WARN_ON(!flushwq);
|
||||
}
|
||||
|
||||
struct kmem_cache *
|
||||
@ -4926,6 +4933,8 @@ void *__kmalloc_track_caller(size_t size, gfp_t gfpflags, unsigned long caller)
|
||||
/* Honor the call site pointer we received. */
|
||||
trace_kmalloc(caller, ret, s, size, s->size, gfpflags);
|
||||
|
||||
ret = kasan_kmalloc(s, ret, size, gfpflags);
|
||||
|
||||
return ret;
|
||||
}
|
||||
EXPORT_SYMBOL(__kmalloc_track_caller);
|
||||
@ -4957,6 +4966,8 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
|
||||
/* Honor the call site pointer we received. */
|
||||
trace_kmalloc_node(caller, ret, s, size, s->size, gfpflags, node);
|
||||
|
||||
ret = kasan_kmalloc(s, ret, size, gfpflags);
|
||||
|
||||
return ret;
|
||||
}
|
||||
EXPORT_SYMBOL(__kmalloc_node_track_caller);
|
||||
@ -5890,7 +5901,8 @@ static char *create_unique_id(struct kmem_cache *s)
|
||||
char *name = kmalloc(ID_STR_LENGTH, GFP_KERNEL);
|
||||
char *p = name;
|
||||
|
||||
BUG_ON(!name);
|
||||
if (!name)
|
||||
return ERR_PTR(-ENOMEM);
|
||||
|
||||
*p++ = ':';
|
||||
/*
|
||||
@ -5948,6 +5960,8 @@ static int sysfs_slab_add(struct kmem_cache *s)
|
||||
* for the symlinks.
|
||||
*/
|
||||
name = create_unique_id(s);
|
||||
if (IS_ERR(name))
|
||||
return PTR_ERR(name);
|
||||
}
|
||||
|
||||
s->kobj.kset = kset;
|
||||
|
Loading…
Reference in New Issue
Block a user