linux-kernel - Question about freeing of empty per-CPU partial slabs in SLUB

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+fCnZfFZCCq6ZQuVHoKY2tRJ3z1p0ftPW360-s=1JWd5Rv3JQ@mail.gmail.com>
Date: Tue, 10 Sep 2024 18:38:42 +0200
From: Andrey Konovalov <andreyknvl@...il.com>
To: Vlastimil Babka <vbabka@...e.cz>
Cc: Linux Memory Management List <linux-mm@...ck.org>, LKML <linux-kernel@...r.kernel.org>
Subject: Question about freeing of empty per-CPU partial slabs in SLUB

Hi Vlastimil (and other SLUB maintainers),

I have a question about freeing of empty per-CPU partial slabs in the
SLUB allocator.

The "Linux SLUB Allocator Internals and Debugging" article [1] states:

"If the partial slab becomes an empty slab after freeing up the
object, it will be left in its current list if the number of partial
slabs for the concerned node is within the limits (i.e < slab cache’s
min_partial). This applies to both slabs belonging to a per-cpu
partial slab list and slabs belonging to a per-node partial slab list.
If the number of partial slabs are outside the limit (i.e >= slab
cache’s min partial) then the newly available empty slab is freed and
is removed from the corresponding partial slab list."

The part that seems wrong to me here is the statement that this
applies to the per-CPU partial list. Based on the code in __slab_free,
it looks like it cannot reach the slab_empty label for a slab that is
on the per-CPU partial list.

(I know that an empty per-CPU partial slab can be freed when the list
overflows or via shrinking, the question is about the slab being freed
directly by __slab_free.)

Is the article wrong with regards to this case? Or did this behavior
change recently (I failed found any traces of this)?

Other than this statement, the article seems to be correct about all
other small details that I looked into, so I'm not sure whether my
understanding of the code is wrong of the article is.

I hope you could clarify this.

Thank you!

[1] https://blogs.oracle.com/linux/post/linux-slub-allocator-internals-and-debugging-1