[PATCH] mm/slub: fix missing debugfs entries for caches created before sysfs init

[PATCH] mm/slub: fix missing debugfs entries for caches created before sysfs init

[Li Xiasong]

slab_debugfs_init() creates the slab debugfs root at device
initcall time, while slab_sysfs_init() moves slab_state to FULL
at late initcall time. SLAB_STORE_USER caches created in this
window currently miss their debugfs entries because
do_kmem_cache_create() skips debugfs_slab_add() when slab_state
<= UP. This was observed with MPTCP's request_sock_subflow_v6
cache, whose slab debugfs directory was missing.

The affected initcall window is:

  slab_debugfs_init()
    slab_debugfs_root = debugfs_create_dir(...)

  kmem_cache_create(..., SLAB_STORE_USER, ...)
    do_kmem_cache_create()
      if (slab_state <= UP)
        return without debugfs entries

  slab_sysfs_init()
    slab_state = FULL

Run slab_debugfs_init() after slab_sysfs_init() and protect its scan of
slab_caches with slab_mutex.

Fixes: 1a5ad30b89b4 ("mm: slub: make slab_sysfs_init() a late_initcall")
Signed-off-by: Li Xiasong <lixiasong1@huawei.com>
---
 mm/slub.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/mm/slub.c b/mm/slub.c
index 9ec774dc7009..d35e40c7a7ba 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -9992,16 +9992,23 @@ static int __init slab_debugfs_init(void)
 {
 	struct kmem_cache *s;
 
+	mutex_lock(&slab_mutex);
+
 	slab_debugfs_root = debugfs_create_dir("slab", NULL);
 
 	list_for_each_entry(s, &slab_caches, list)
 		if (s->flags & SLAB_STORE_USER)
 			debugfs_slab_add(s);
 
+	mutex_unlock(&slab_mutex);
 	return 0;
 
 }
-__initcall(slab_debugfs_init);
+/*
+ * This must be after slab_sysfs_init(), otherwise caches created between
+ * the debugfs scan and slab_state reaching FULL miss their debugfs entries.
+ */
+late_initcall(slab_debugfs_init);
 #endif
 /*
  * The /proc/slabinfo ABI
-- 
2.34.1

Re: [PATCH] mm/slub: fix missing debugfs entries for caches created before sysfs init

[Vlastimil Babka (SUSE)]

On 7/20/26 16:51, Li Xiasong wrote:
> slab_debugfs_init() creates the slab debugfs root at device
> initcall time, while slab_sysfs_init() moves slab_state to FULL
> at late initcall time. SLAB_STORE_USER caches created in this
> window currently miss their debugfs entries because
> do_kmem_cache_create() skips debugfs_slab_add() when slab_state
> <= UP. This was observed with MPTCP's request_sock_subflow_v6
> cache, whose slab debugfs directory was missing.
> 
> The affected initcall window is:
> 
>   slab_debugfs_init()
>     slab_debugfs_root = debugfs_create_dir(...)
> 
>   kmem_cache_create(..., SLAB_STORE_USER, ...)
>     do_kmem_cache_create()
>       if (slab_state <= UP)
>         return without debugfs entries
> 
>   slab_sysfs_init()
>     slab_state = FULL
> 
> Run slab_debugfs_init() after slab_sysfs_init() and protect its scan of
> slab_caches with slab_mutex.
> 
> Fixes: 1a5ad30b89b4 ("mm: slub: make slab_sysfs_init() a late_initcall")
> Signed-off-by: Li Xiasong <lixiasong1@huawei.com>

Oops, good catch. Cc: stable perhaps?

> ---
>  mm/slub.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/mm/slub.c b/mm/slub.c
> index 9ec774dc7009..d35e40c7a7ba 100644
> --- a/mm/slub.c
> +++ b/mm/slub.c
> @@ -9992,16 +9992,23 @@ static int __init slab_debugfs_init(void)
>  {
>  	struct kmem_cache *s;
>  
> +	mutex_lock(&slab_mutex);
> +
>  	slab_debugfs_root = debugfs_create_dir("slab", NULL);
>  
>  	list_for_each_entry(s, &slab_caches, list)
>  		if (s->flags & SLAB_STORE_USER)
>  			debugfs_slab_add(s);
>  
> +	mutex_unlock(&slab_mutex);
>  	return 0;
>  
>  }
> -__initcall(slab_debugfs_init);
> +/*
> + * This must be after slab_sysfs_init(), otherwise caches created between
> + * the debugfs scan and slab_state reaching FULL miss their debugfs entries.
> + */
> +late_initcall(slab_debugfs_init);

Hm but does anything guarantee the ordering between late_initcall() is what
we would want? Or it's possible we still miss something because the ordering
could be:

slab_debugfs_init()
$some_other_late_initcall_fn() -> kmem_cache_create()
slab_sysfs_init()

What about a single late_initcall() function that walks the list once and
calls both sysfs and debugfs parts?

>  #endif
>  /*
>   * The /proc/slabinfo ABI