Re: [PATCH] mm/slab: sample slab_state once in kmem_cache_destroy()

[Imre Kaloz <kaloz@kernel.org>]

Hi Harry,

On Wed, 14 Oct 2026, Harry Yoo wrote:

<snip>

>> So it takes both. The read that hurts is the one at release time,
>> after rcu_barrier(); fixing only the double read keeps it, and so
>> does moving only the unlink check under the mutex. Reading once
>> right after the unlock didn't trigger it, but that is still racy,
>> just a much smaller window.
>
> Thanks for verifying that.
>
>> For stable, as far as I can tell the release-side read has been
>> outside slab_mutex since d50d82faa0c9 ("slub: fix failure when we
>> delete and create a slab cache") in v4.18
>
> For SLAB_TYPESAFE_BY_RCU caches, yes.
> and others since 0495e337b703.
>
> I think Fixes: d50d82faa0c9 should be fine.
>
>> , so that would cover
>> 5.10.y. The patch doesn't apply before 6.12, so the older branches
>> need their own backports.
>
> Ack.
> Are you willing to backport it to -stable kernels as well?
>
> And could you please post v2 with updated Fixes: and the
> commit message ;)
>
> Thanks for fixing this!

Sure thing. v2 is out:
https://lore.kernel.org/all/20261014150844.8536-1-kaloz@kernel.org/

I'll send the backports for 6.6, 6.1, 5.15 and 5.10 once it's in
mainline; 6.12 and later should take it as is.


Best,
Imre