[GIT PULL] SLUB RCU fix for 2.6.31

[Pekka J Enberg]

Hi Linus,

Here's a last minute RCU fix for SLUB from Eric Dumazet. It's a bug fix to Paul
McKenney's commit 7ed9f7e5db58c6e8c2b4b738a75d5dcd8e17aad5 ("fix
RCU-callback-after-kmem_cache_destroy problem in sl[aou]b") that added the
rcu_barrier() call too early in kmem_cache_destroy(). You can find full
discussion of the bug here:

  http://thread.gmane.org/gmane.linux.kernel/876016/focus=876086

The bug can be triggered with "rmmod nf_conntrack", for example. I think 
the fix is simple enough to be merged this late in the release cycle 
but we can also defer the fix to 2.6.31.1 if you don't feel comfortable 
with merging it now.

			Pekka

The following changes since commit 326ba5010a5429a5a528b268b36a5900d4ab0eba:
  Linus Torvalds (1):
        Linux 2.6.31-rc8

are available in the git repository at:

  ssh://master.kernel.org/pub/scm/linux/kernel/git/penberg/slab-2.6 slab/urgent

Eric Dumazet (1):
      slub: Fix kmem_cache_destroy() with SLAB_DESTROY_BY_RCU

 mm/slub.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/mm/slub.c b/mm/slub.c
index b9f1491..b627675 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2594,8 +2594,6 @@ static inline int kmem_cache_close(struct kmem_cache *s)
  */
 void kmem_cache_destroy(struct kmem_cache *s)
 {
-	if (s->flags & SLAB_DESTROY_BY_RCU)
-		rcu_barrier();
 	down_write(&slub_lock);
 	s->refcount--;
 	if (!s->refcount) {
@@ -2606,6 +2604,8 @@ void kmem_cache_destroy(struct kmem_cache *s)
 				"still has objects.\n", s->name, __func__);
 			dump_stack();
 		}
+		if (s->flags & SLAB_DESTROY_BY_RCU)
+			rcu_barrier();
 		sysfs_slab_remove(s);
 	} else
 		up_write(&slub_lock);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/