Re: [PATCH] kasan: fix cache shrink race with CPU hotplug

[Andrew Morton]

On Thu,  6 Aug 2026 20:10:06 +0800 Hui Su <sh_def@xxxxxxx> wrote:

> kasan_quarantine_remove_cache() first invokes per_cpu_remove_cache() on
> all online CPUs. Each callback moves objects belonging to the cache from
> cpu_quarantine to the CPU's shrink_qlist, where they can later be freed
> from task context.
> 
> kmem_cache_destroy() invokes the quarantine removal path while holding
> cpus_read_lock(), but kmem_cache_shrink() does not. The latter can
> therefore race with CPU offlining as follows:
> 
>   kmem_cache_shrink()             CPU hotplug
>   -------------------             -----------
>   on_each_cpu()
>     CPU1 moves objects to
>     CPU1's shrink_qlist
>   on_each_cpu() returns
>                                   CPU1 goes offline
>                                   kasan_cpu_offline()
>                                     drains cpu_quarantine
>                                     leaves shrink_qlist untouched
>   for_each_online_cpu()
>     skips CPU1
> 
> The objects left on CPU1's shrink_qlist are not returned to the slab
> allocator. This may prevent kmem_cache_shrink() from releasing slabs
> that would otherwise become empty. If CPU1 remains offline, a later
> kmem_cache_destroy() also skips the list and can report that the cache
> still contains objects.
> 
> Per-CPU shrink_qlist storage exists for every possible CPU, and each
> list is protected by its own raw spinlock. Iterate over possible CPUs
> so that a list populated before its CPU went offline is drained as well.

Thanks.

Please always describe the userspace-visible runtime effects of a bug
when proposing a fix.

> Fixes: 07d067e4f2ce ("kasan: fix sleeping function called from invalid context on RT kernel")
> Cc: stable@xxxxxxxxxxxxxxx

Especially when proposing a backport.  At present we've provided our
-stable recipients no reason to accept the patch.

Documentation/process/stable-kernel-rules.rst says "it must fix a real
bug that bothers people".


> --- a/mm/kasan/quarantine.c
> +++ b/mm/kasan/quarantine.c
> @@ -355,7 +355,12 @@ void kasan_quarantine_remove_cache(struct kmem_cache *cache)
>  	 */
>  	on_each_cpu(per_cpu_remove_cache, cache, 1);
>  
> -	for_each_online_cpu(cpu) {
> +	/*
> +	 * A CPU can go offline after on_each_cpu() returns, leaving cache
> +	 * objects on that CPU's shrink list. Scan all possible CPUs to
> +	 * drain those lists.
> +	 */
> +	for_each_possible_cpu(cpu) {

In some configurations, for_each_possible_cpu() can do a lot more work
than for_each_online_cpu().  What are the worst-case userspace-visible
runtime effects of this additional work?