Re: mm/slub: has_pcs_used() reads remote per-CPU sheaf state from flush_all_cpus_locked() without synchronization (data race; KCSAN blind spot: slub.o is uninstrumented)

[Qing Wang]

On Wed, 04 Nov 2026 at 17:41, Qing Wang <wangqing7171@xxxxxxxxx> wrote:
> You're right, there is a data race in has_pcs_used() reading the pcs
> fields.  The possible consequences:
> 
> 1. has_pcs_used() observes an empty pcs and sets sfw->skip, so the
>    flush is skipped and the memory is not freed in time.

Sorry, I didn't state point 1 correctly.  It should be:

has_pcs_used() reads main->size as 0 before the concurrent free
increments it, so sfw->skip is wrongly set and the memory is not
reclaimed in time.

--
Best regards,
Qing