[PATCH] mm/slub: Flush virtual-slab work before cache destruction

[Felix Hoffmann]

Under CONFIG_SLAB_VIRTUAL, freeing a slab queues it to
slub_tlbflush_work. The worker later follows slab->slab_cache to take the
cache's virtual-slab lock and update its lists.

__kmem_cache_shutdown() can report success after the last slabs have been
removed from the cache's accounting but before that deferred work runs.
The cache can then be released while queued slabs still refer to it. When
the worker runs, it dereferences the freed kmem_cache and corrupts its
lists.

Flush the virtual-slab worker after confirming that every cache node is
empty and before allowing cache destruction to proceed. This drains both
queued and running work that can still reference the cache.

Fixes: 0d6f38b78adda ("mm/slub: allocate slabs from virtual memory")
Signed-off-by: Felix Hoffmann <f3lix.dev@xxxxxx>
---
Tested on x86-64 with KCSAN enabled:

  - on the unmodified SLAB_VIRTUAL feature kernel, a stress module that
    repeatedly created, filled, emptied and destroyed a non-mergeable cache
    triggered list corruption in slub_tlbflush_worker() and panicked the
    kernel almost immediately
  - with this change, the identical module completed 10,000 cache
    create/destroy cycles (81.92 million allocation/free pairs) without a
    BUG, warning, KCSAN report or panic
  - the fixed KCSAN kernel and the external stress module build with W=1

The reproducer and complete console logs are available privately on request.
 mm/slub.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/mm/slub.c b/mm/slub.c
index b4c64b2bbd334..dbfd42b31a0a2 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -8541,6 +8541,11 @@ int __kmem_cache_shutdown(struct kmem_cache *s)
 		if (n->nr_partial || node_nr_slabs(n))
 			return 1;
 	}
+
+#ifdef CONFIG_SLAB_VIRTUAL
+	/* The TLB flush worker still dereferences slab->slab_cache. */
+	kthread_flush_work(&slub_tlbflush_work);
+#endif
 	return 0;
 }
 
-- 
2.43.0