Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Thu, 27 Sep 2018 15:26:38 +0000
From:   Christopher Lameter <cl@linux.com>
To:     zhong jiang <zhongjiang@huawei.com>
cc:     gregkh@linux-foundation.org, iamjoonsoo.kim@lge.com,
        rientjes@google.com, penberg@kernel.org, akpm@linux-foundation.org,
        mhocko@suse.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org,
        stable@vger.kernel.org
Subject: Re: [STABLE PATCH] slub: make ->cpu_partial unsigned int
In-Reply-To: <1538059420-14439-1-git-send-email-zhongjiang@huawei.com>
Message-ID: <010001661ba398a8-f7e5b6c8-b7ff-4f01-8b18-0ad582344ea7-000000@email.amazonses.com>
References: <1538059420-14439-1-git-send-email-zhongjiang@huawei.com>
User-Agent: Alpine 2.21 (DEB 202 2017-01-01)
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Feedback-ID: 1.us-east-1.fQZZZ0Xtj2+TD7V5apTT/NrT6QKuPgzCT/IC7XYgDKI=:AmazonSES
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Thu, 27 Sep 2018, zhong jiang wrote:

> From: Alexey Dobriyan <adobriyan@gmail.com>
>
>         /*
>          * cpu_partial determined the maximum number of objects
>          * kept in the per cpu partial lists of a processor.
>          */
>
> Can't be negative.

True.

> I hit a real issue that it will result in a large number of memory leak.
> Because Freeing slabs are in interrupt context. So it can trigger this issue.
> put_cpu_partial can be interrupted more than once.
> due to a union struct of lru and pobjects in struct page, when other core handles
> page->lru list, for eaxmple, remove_partial in freeing slab code flow, It will
> result in pobjects being a negative value(0xdead0000). Therefore, a large number
> of slabs will be added to per_cpu partial list.

That sounds like it needs more investigation. Concurrent use of page
fields for other purposes can cause serious bugs.

>
> I had posted the issue to community before. The detailed issue description is as follows.

I did not see it. Please make sure to CC the maintainers.