54 lines
2.1 KiB
Diff
54 lines
2.1 KiB
Diff
From 0cf4a0f832a996e67a51ea51c9ae73ddcf60b76d Mon Sep 17 00:00:00 2001
|
|
From: Steven Rostedt <rostedt@goodmis.org>
|
|
Date: Tue, 11 Oct 2011 23:56:23 -0400
|
|
Subject: [091/256] slab: Fix __do_drain to use the right array cache
|
|
|
|
The array cache in __do_drain() was using the cpu_cache_get() function
|
|
which uses smp_processor_id() to get the proper array. On mainline, this
|
|
is fine as __do_drain() is called by for_each_cpu() which runs
|
|
__do_drain() on the CPU it is processing. In RT locks are used instead
|
|
and __do_drain() is only called from a single CPU. This can cause the
|
|
accounting to be off and trigger the following bug:
|
|
|
|
slab error in kmem_cache_destroy(): cache `nfs_write_data': Can't free all objects
|
|
Pid: 2905, comm: rmmod Not tainted 3.0.6-test-rt17+ #78
|
|
Call Trace:
|
|
[<ffffffff810fb623>] kmem_cache_destroy+0xa0/0xdf
|
|
[<ffffffffa03aaffb>] nfs_destroy_writepagecache+0x49/0x4e [nfs]
|
|
[<ffffffffa03c0fe0>] exit_nfs_fs+0xe/0x46 [nfs]
|
|
[<ffffffff8107af09>] sys_delete_module+0x1ba/0x22c
|
|
[<ffffffff8109429d>] ? audit_syscall_entry+0x11c/0x148
|
|
[<ffffffff814b6442>] system_call_fastpath+0x16/0x1b
|
|
|
|
This can be easily triggered by a simple while loop:
|
|
|
|
# while :; do modprobe nfs; rmmod nfs; done
|
|
|
|
The proper function to use is cpu_cache_get_on_cpu(). It works for both
|
|
RT and non-RT as the non-RT passes in smp_processor_id() into
|
|
__do_drain().
|
|
|
|
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
|
|
Cc: Luis Claudio R. Goncalves <lgoncalv@redhat.com>
|
|
Cc: Clark Williams <clark@redhat.com>
|
|
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
|
|
Link: http://lkml.kernel.org/r/1318391783.13262.11.camel@gandalf.stny.rr.com
|
|
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
|
|
---
|
|
mm/slab.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/mm/slab.c b/mm/slab.c
|
|
index dc84364..341748b 100644
|
|
--- a/mm/slab.c
|
|
+++ b/mm/slab.c
|
|
@@ -2638,7 +2638,7 @@ static void __do_drain(void *arg, unsigned int cpu)
|
|
struct array_cache *ac;
|
|
int node = cpu_to_mem(cpu);
|
|
|
|
- ac = cpu_cache_get(cachep);
|
|
+ ac = cpu_cache_get_on_cpu(cachep, cpu);
|
|
spin_lock(&cachep->nodelists[node]->list_lock);
|
|
free_block(cachep, ac->entry, ac->avail, node);
|
|
spin_unlock(&cachep->nodelists[node]->list_lock);
|