Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'slab-fixes-for-6.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab
Pull slab fixes from Vlastimil Babka:
- stable fix to prevent list corruption when destroying caches with
leftover objects (Rafael Aquini)
- fix for a gotcha in kmalloc_size_roundup() when calling it with too
high size, discovered when recently a networking call site had to be
fixed for a different issue (David Laight)
* tag 'slab-fixes-for-6.6-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:
slab: kmalloc_size_roundup() must not return 0 for non-zero size
mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy()
+18
-18
+18
-18
mm/slab_common.c
+18
-18
mm/slab_common.c
···
479
479
480
480
void kmem_cache_destroy(struct kmem_cache *s)
481
481
{
482
-
int refcnt;
482
+
int err = -EBUSY;
483
483
bool rcu_set;
484
484
485
485
if (unlikely(!s) || !kasan_check_byte(s))
···
490
490
491
491
rcu_set = s->flags & SLAB_TYPESAFE_BY_RCU;
492
492
493
-
refcnt = --s->refcount;
494
-
if (refcnt)
493
+
s->refcount--;
494
+
if (s->refcount)
495
495
goto out_unlock;
496
496
497
-
WARN(shutdown_cache(s),
498
-
"%s %s: Slab cache still has objects when called from %pS",
497
+
err = shutdown_cache(s);
498
+
WARN(err, "%s %s: Slab cache still has objects when called from %pS",
499
499
__func__, s->name, (void *)_RET_IP_);
500
500
out_unlock:
501
501
mutex_unlock(&slab_mutex);
502
502
cpus_read_unlock();
503
-
if (!refcnt && !rcu_set)
503
+
if (!err && !rcu_set)
504
504
kmem_cache_release(s);
505
505
}
506
506
EXPORT_SYMBOL(kmem_cache_destroy);
···
745
745
746
746
size_t kmalloc_size_roundup(size_t size)
747
747
{
748
-
struct kmem_cache *c;
748
+
if (size && size <= KMALLOC_MAX_CACHE_SIZE) {
749
+
/*
750
+
* The flags don't matter since size_index is common to all.
751
+
* Neither does the caller for just getting ->object_size.
752
+
*/
753
+
return kmalloc_slab(size, GFP_KERNEL, 0)->object_size;
754
+
}
749
755
750
-
/* Short-circuit the 0 size case. */
751
-
if (unlikely(size == 0))
752
-
return 0;
753
-
/* Short-circuit saturated "too-large" case. */
754
-
if (unlikely(size == SIZE_MAX))
755
-
return SIZE_MAX;
756
756
/* Above the smaller buckets, size is a multiple of page size. */
757
-
if (size > KMALLOC_MAX_CACHE_SIZE)
757
+
if (size && size <= KMALLOC_MAX_SIZE)
758
758
return PAGE_SIZE << get_order(size);
759
759
760
760
/*
761
-
* The flags don't matter since size_index is common to all.
762
-
* Neither does the caller for just getting ->object_size.
761
+
* Return 'size' for 0 - kmalloc() returns ZERO_SIZE_PTR
762
+
* and very large size - kmalloc() may fail.
763
763
*/
764
-
c = kmalloc_slab(size, GFP_KERNEL, 0);
765
-
return c ? c->object_size : 0;
764
+
return size;
765
+
766
766
}
767
767
EXPORT_SYMBOL(kmalloc_size_roundup);
768
768