From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793831479; b=mpdx3q5ZtddbnRTBK6vhlrPz1R/P3fEB9ZNDa4FBR42zSLrjLdKgryEn3wMW2fXatdb/ hTr6Y/62tgvNm6ueXNX4F8f3JsRjhqcjNjdW1v9iKMen4vn+Q+py3X/mkaKTJXx6xbD+D MpMAw2upp05fszUxsofYPlqDOhaZ2cxgfqr7iNbbFfELKQWDcnPRymb78TlLmuIUwEjlK tk/pMHe6DRJQl5sKxdeCegSuLaZMFDmvFni0ZIRwfEGzCPuofQOx7IxKEWIxFXNYx3EPq HHGL2ii65YU/4qvqpoRV3W/A3nfH2JwSLP3Uz4h7QB6ec/KhISUa3mI4bnhP45pvoXw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793831479; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=czLHp9PrnxFsvI+8UydVH9QLrkFc0TQX/7c6CkKis8A=; b=sC8M3jagf3E6ACU9JiAaL3vveLqKfwW0I4xxwU7VpPANmNdCDFJBuIfiHdHCpdQAf6sX C0TIuFNvQBlXZsrEdthZthmkb2M7fnJfpvZbvH6cHtQAtqUrlLQ5gHigk9MzC6fJKwPtA EKa54mT0MlP/pvbN8P8yhDBkQzkyjYmAu2MWz31TvOawQCJIV4dMja1AHp6u/QM9xsalz IwHTIk0OZqJ9zdcQPtJexLtdvLeWRjTycGN0gQh6sLjR3qNPqA/uc+ekqhIufqvApWP08 ZwokaigX2wZ9yrbxG94YOt0yobUG+QPiz/Skn8rSwQ+uOF8hEPKS0bJLqYmflsr/KwQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=upW3NRCr; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E63F4606AC2A; Wed, 4 Nov 2026 22:31:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=upW3NRCr Received: by smtp.kernel.org (Postfix) with ESMTPSA id 81DBB1F000C1; Wed, 4 Nov 2026 22:31:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793831478; bh=czLHp9PrnxFsvI+8UydVH9QLrkFc0TQX/7c6CkKis8A=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=upW3NRCraEKTU02v4hg9ZW3fWLKTYL3vy6VbeHz7W/SBqpk0fckzSAzs9Yd1YPd8Y QCe5hyN46agT1PVd9uicjvvEc5t8y+EdZpNZ2WiPkzVw0NqjRLMbbiS7jWFG97Le/c KVYm4FbaE7q9oCwXsd8nx+cuRf771MrED77D8qMw= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Imre Kaloz , "Jose A. Perez de Azpillaga" , "Harry Yoo (Meta)" , "Vlastimil Babka (SUSE)" Subject: [PATCH 6.18 0729/1005] mm/slab: sample slab_state once in kmem_cache_destroy() Date: Wed, 4 Nov 2026 16:07:42 -0500 Message-ID: <20261104211103.919931456@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261104211043.516122098@linuxfoundation.org> References: <20261104211043.516122098@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Imre Kaloz commit 088bfdc0d7947d623f4899b9011c866e4445074d upstream. kmem_cache_release() tests slab_state >= FULL after kmem_cache_destroy() has dropped slab_mutex and unlinked the cache, and for a SLAB_TYPESAFE_BY_RCU cache after rcu_barrier(). If slab_late_init() runs before that test it sets slab_state to FULL but skips the unlinked cache, which never got a sysfs entry, so sysfs_slab_release() calls kobject_put() on a kobject that was never initialized: WARNING: lib/kobject.c:734 at kobject_put+0x64/0x2c0, CPU#1: kworker/u8:3/55 kobject: '(null)' ((____ptrval____)): is not initialized, yet kobject_put() is being called. refcount_t: underflow; use-after-free. kobject_put+0x64/0x2c0 sysfs_slab_release+0xc/0x20 kmem_cache_destroy+0x104/0x1e0 bioset_exit+0x13c/0x1e0 disk_release+0x54/0x140 put_disk+0x18/0x40 floppy_async_init+0xbec/0xd10 slab_state >= FULL asks whether the cache has a kobject, which cache creation skips while slab_state <= UP. UP is the state just below FULL, so a false sample cannot skip a kobject_put() that was owed. Seen on sparc64 at boot, where the asynchronous floppy init tears down its bio slab while the late initcalls are running. Sample slab_state once, under slab_mutex which slab_late_init() holds when it sets FULL, and use the result for both the unlink and the release. The history of this problem dates back to v3.2: Commit 69cb8e6b7c29 ("slub: free slabs without holding locks") in v3.2 moved sysfs_slab_remove() outside slub_lock and introduced a race condition between kmem_cache_destroy() and slab_sysfs_init(). Commit 945cf2b6199be ("mm/sl[aou]b: Extract a common function for kmem_cache_destroy") in v3.7 accidentally closed the race while extracting a common implementation for kmem_cache_destroy(). Commit 5413dfba88d6 ("slub: drop mutex before deleting sysfs entry") in v3.8 re-opened the race by dropping slab_mutex around sysfs_slab_remove() in __kmem_cache_shutdown(), to avoid a lockdep splat between slab_mutex and the sysfs lock. Commit 657dc2f97220 ("slab: remove synchronous rcu_barrier() call in memcg cache release path") in v4.11 shifted from synchronous rcu_barrier() to asynchronous RCU work for SLAB_TYPESAFE_BY_RCU caches. That commit, again, accidentally closed the race by moving sysfs_slab_release() to shutdown_cache(), but only for !SLAB_TYPESAFE_BY_RCU caches because destruction of SLAB_TYPESAFE_BY_RCU caches is done in an RCU work. Commit 0495e337b703 ("mm/slab_common: Deleting kobject in kmem_cache_destroy() without holding slab_mutex/cpu_hotplug_lock") in v6.0 re-introduced the race for !SLAB_TYPESAFE_BY_RCU caches. Fixes: 69cb8e6b7c29 ("slub: free slabs without holding locks") Fixes: 5413dfba88d6 ("slub: drop mutex before deleting sysfs entry") Fixes: 0495e337b703 ("mm/slab_common: Deleting kobject in kmem_cache_destroy() without holding slab_mutex/cpu_hotplug_lock") Cc: stable@vger.kernel.org Signed-off-by: Imre Kaloz Reviewed-by: Jose A. Perez de Azpillaga Reviewed-by: Harry Yoo (Meta) Link: https://patch.msgid.link/20261014150844.8536-1-kaloz@kernel.org Reviewed-by: Vlastimil Babka (SUSE) Signed-off-by: Harry Yoo (Meta) Signed-off-by: Greg Kroah-Hartman --- mm/slab_common.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) --- a/mm/slab_common.c +++ b/mm/slab_common.c @@ -498,10 +498,10 @@ EXPORT_SYMBOL(kmem_buckets_create); * and release of the kobject does not need slab_mutex or cpu_hotplug_lock * protection. So they are now done without holding those locks. */ -static void kmem_cache_release(struct kmem_cache *s) +static void kmem_cache_release(struct kmem_cache *s, bool sysfs_ready) { kfence_shutdown_cache(s); - if (__is_defined(SLAB_SUPPORTS_SYSFS) && slab_state >= FULL) + if (__is_defined(SLAB_SUPPORTS_SYSFS) && sysfs_ready) sysfs_slab_release(s); else slab_kmem_cache_release(s); @@ -516,6 +516,7 @@ void slab_kmem_cache_release(struct kmem void kmem_cache_destroy(struct kmem_cache *s) { + bool sysfs_ready; int err; if (unlikely(!s) || !kasan_check_byte(s)) @@ -563,10 +564,18 @@ void kmem_cache_destroy(struct kmem_cach list_del(&s->list); + /* + * slab_late_init() sets slab_state to FULL under slab_mutex and adds + * sysfs entries only for caches still on the list. Sample the state + * here, so that a cache unlinked before that point is not handed to + * sysfs_slab_release() with an uninitialized kobject. + */ + sysfs_ready = slab_state >= FULL; + mutex_unlock(&slab_mutex); cpus_read_unlock(); - if (slab_state >= FULL) + if (sysfs_ready) sysfs_slab_unlink(s); debugfs_slab_release(s); @@ -576,7 +585,7 @@ void kmem_cache_destroy(struct kmem_cach if (s->flags & SLAB_TYPESAFE_BY_RCU) rcu_barrier(); - kmem_cache_release(s); + kmem_cache_release(s, sysfs_ready); } EXPORT_SYMBOL(kmem_cache_destroy);