On Mon, Jun 17, 2024 at 06:57:45PM +0200, Jason A. Donenfeld wrote:

On Mon, Jun 17, 2024 at 06:42:23PM +0200, Uladzislau Rezki wrote:

quoted

On Mon, Jun 17, 2024 at 06:33:23PM +0200, Jason A. Donenfeld wrote:

quoted

On Mon, Jun 17, 2024 at 6:30 PM Uladzislau Rezki [off-list ref] wrote:

quoted

Here if an "err" is less then "0" means there are still objects
whereas "is_destroyed" is set to "true" which is not correlated
with a comment:

"Destruction happens when no objects"

The comment is just poorly written. But the logic of the code is right.

OK.

quoted

quoted

quoted

 out_unlock:
      mutex_unlock(&slab_mutex);
      cpus_read_unlock();

diff --git a/mm/slub.c b/mm/slub.c
index 1373ac365a46..7db8fe90a323 100644
--- a/mm/slub.c
+++ b/mm/slub.c

@@ -4510,6 +4510,8 @@ void kmem_cache_free(struct kmem_cache *s, void *x)
              return;
      trace_kmem_cache_free(_RET_IP_, x, s);
      slab_free(s, virt_to_slab(x), x, _RET_IP_);
+     if (s->is_destroyed)
+             kmem_cache_destroy(s);

Here i am not follow you. How do you see that a cache has been fully
freed? Or is it just super draft code?

kmem_cache_destroy() does this in shutdown_cache().

Right. In this scenario you invoke kmem_cache_destroy() over and over
until the last object gets freed. This potentially slowing the kmem_cache_free()
which is not OK, at least to me.

--
Uladzislau Rezki