Re: [PATCH] mm/slub: Flush virtual-slab work before cache destruction

[Harry Yoo <harry@kernel.org>]

Hi Felix,

CONFIG_SLAB_VIRTUAL is not in the upstream kernel.
Maybe you sent a patch for a downstream tree to the upstream?

On Fri, 13 Nov 2026 23:13:30 +0100, Felix Hoffmann wrote:
> Under CONFIG_SLAB_VIRTUAL, freeing a slab queues it to
> slub_tlbflush_work. The worker later follows slab->slab_cache to take the
> cache's virtual-slab lock and update its lists.
>
> __kmem_cache_shutdown() can report success after the last slabs have been
> removed from the cache's accounting but before that deferred work runs.
> The cache can then be released while queued slabs still refer to it. When
> the worker runs, it dereferences the freed kmem_cache and corrupts its
> lists.
>
> Flush the virtual-slab worker after confirming that every cache node is
> empty and before allowing cache destruction to proceed. This drains both
> queued and running work that can still reference the cache.
>
> Fixes: 0d6f38b78adda ("mm/slub: allocate slabs from virtual memory")
> Signed-off-by: Felix Hoffmann <f3lix.dev@gmx.de>
> ---
> Tested on x86-64 with KCSAN enabled:
>
>   - on the unmodified SLAB_VIRTUAL feature kernel, a stress module that
>     repeatedly created, filled, emptied and destroyed a non-mergeable cache
>     triggered list corruption in slub_tlbflush_worker() and panicked the
>     kernel almost immediately
>   - with this change, the identical module completed 10,000 cache
>     create/destroy cycles (81.92 million allocation/free pairs) without a
>     BUG, warning, KCSAN report or panic
>   - the fixed KCSAN kernel and the external stress module build with W=1
>
> The reproducer and complete console logs are available privately on request.
>  mm/slub.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/mm/slub.c b/mm/slub.c
> index b4c64b2bbd334..dbfd42b31a0a2 100644
> --- a/mm/slub.c
> +++ b/mm/slub.c
> @@ -8541,6 +8541,11 @@ int __kmem_cache_shutdown(struct kmem_cache *s)
>  		if (n->nr_partial || node_nr_slabs(n))
>  			return 1;
>  	}
> +
> +#ifdef CONFIG_SLAB_VIRTUAL
> +	/* The TLB flush worker still dereferences slab->slab_cache. */
> +	kthread_flush_work(&slub_tlbflush_work);
> +#endif
>  	return 0;
>  }
>
> --
> 2.43.0