Sandro/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-09-18 22:19:30 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

mm/slab: disallow kfree_rcu_sheaf() on PREEMPT_RT again

Browse Source 
This partially reverts commit 2a8bb29ec9 ("mm/slab: allow
kfree_rcu_sheaf() on PREEMPT_RT"). It was based on the assumption that
local_trylock() is safe on PREEMPT_RT from any context.

However kvfree_rcu() is also called by set_cpus_allowed_force() with
task_struct::pi_lock acquired and there it's not safe, as syzbot
has reported.

For the immediate fix, skip kfree_rcu_sheaf() on PREEMPT_RT again from
kvfree_call_rcu(). In theory, kfree_rcu_nolock() would have the same
problem when called from under pi_lock on PREEMPT_RT but that can
be addressed if such a caller is proposed.

Add an explanation comment, courtesy of Sebastian.

Reported-by: syzbot+acf142088e0182172e58@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=acf142088e0182172e58
Reported-by: ThangNN99 <ngocthang2710.1999@gmail.com>
Fixes: 2a8bb29ec9 ("mm/slab: allow kfree_rcu_sheaf() on PREEMPT_RT")
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://patch.msgid.link/20260831-b4-kfree_rcu_hotfix-v1-1-4f0fb882638b@kernel.org
Reviewed-by: Harry Yoo (Meta) <harry@kernel.org>
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
This commit is contained in:
Vlastimil Babka (SUSE)
2026-09-04 12:15:41 +02:00
parent cee9395acd
commit 5541d89758
2 changed files with 11 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mm/slab_common.c
+8 -10
View File
@@ -1667,14 +1667,6 @@ static bool kfree_rcu_sheaf(void *obj)
{
struct kmem_cache *s;
struct slab *slab;
unsigned int free_flags = SLAB_FREE_DEFAULT;
/*
* It is not safe to spin on PREEMPT_RT because the kernel might be
* holding a raw spinlock and slab acquires sleeping locks.
*/
if (IS_ENABLED(CONFIG_PREEMPT_RT))
free_flags = SLAB_FREE_NOLOCK;
if (is_vmalloc_addr(obj))
return false;
@@ -1685,7 +1677,7 @@ static bool kfree_rcu_sheaf(void *obj)
s = slab->slab_cache;
if (likely(!IS_ENABLED(CONFIG_NUMA) || slab_nid(slab) == numa_mem_id()))
return __kfree_rcu_sheaf(s, obj, free_flags);
return __kfree_rcu_sheaf(s, obj, SLAB_FREE_DEFAULT);
return false;
}
@@ -2034,7 +2026,13 @@ void kvfree_call_rcu(struct kvfree_rcu_head *head, void *ptr)
if (!head)
might_sleep();
if (kfree_rcu_sheaf(ptr))
/*
* kvfree_rcu() is called by set_cpus_allowed_force() with
* task_struct::pi_lock acquired. On PREEMPT_RT the local_trylock()
* usage below will acquire the waitlock which must be avoided.
* Therefore avoid it on PREEMPT_RT.
*/
if (!IS_ENABLED(CONFIG_PREEMPT_RT) && kfree_rcu_sheaf(ptr))
return;
// Queue the object but don't yet schedule the batch.
mm/slub.c
+3 -2
View File
@@ -6088,8 +6088,9 @@ empty:
/*
* kvfree_call_rcu() can be called while holding a raw_spinlock_t. Since
* __kfree_rcu_sheaf() may acquire a spinlock_t (sleeping lock on PREEMPT_RT),
* this would violate lock nesting rules. Therefore, kvfree_call_rcu() avoids
* this problem by passing SLAB_FREE_NOLOCK on PREEMPT_RT.
* this would violate lock nesting rules. Therefore, kfree_call_rcu_nolock()
* avoids this problem by passing SLAB_FREE_NOLOCK. kvfree_call_rcu() is
* bypassing the sheaves layer completely on PREEMPT_RT.
*
* However, lockdep still complains that it is invalid to acquire spinlock_t
* while holding raw_spinlock_t, even on !PREEMPT_RT where spinlock_t is a