linux-toradex.git/mm/slab.c, branch v2.6.17.10

[PATCH] slab.c: fix offslab_limit bug

2006-06-02T18:21:10+00:00

mm/slab.c's offlab_limit logic is totally broken.

Firstly, "offslab_limit" is a global variable while it should either be
calculated in situ or should be passed in as a parameter.

Secondly, the more serious problem with it is that the condition for
calculating it:

               if (!(OFF_SLAB(sizes->cs_cachep))) {
                       offslab_limit = sizes->cs_size - sizeof(struct slab);
                       offslab_limit /= sizeof(kmem_bufctl_t);

is in total disconnect with the condition that makes use of it:

               /* More than offslab_limit objects will cause problems */
               if ((flags & CFLGS_OFF_SLAB) && num > offslab_limit)
                       break;

but due to offslab_limit being a global variable this breakage was
hidden.

Up until lockdep came along and perturbed the slab sizes sufficiently so
that the first off-slab cache would still see a (non-calculated) zero
value for offslab_limit and would panic with:

  kmem_cache_create: couldn't create cache size-512.

  Call Trace:
   [] show_trace+0x96/0x1c8
   [] dump_stack+0x13/0x15
   [] panic+0x39/0x21a
   [] kmem_cache_create+0x5a0/0x5d0
   [] kmem_cache_init+0x193/0x379
   [] start_kernel+0x17f/0x218
   [] _sinittext+0x263/0x26a

  Kernel panic - not syncing: kmem_cache_create(): failed to create slab `size-512'

Paolo Ornati's config on x86_64 managed to trigger it.

The fix is to move the calculation to the place that makes use of it.
This also makes slab.o 54 bytes smaller.

Btw., the check itself is quite silly. Its intention is to test whether
the number of objects per slab would be higher than the number of slab
control pointers possible. In theory it could be triggered: if someone
tried to allocate 4-byte objects cache and explicitly requested with
CFLGS_OFF_SLAB. So i kept the check.

Out of historic interest i checked how old this bug was and it's
ancient, 10 years old! It is the oldest hidden and then truly triggering
bugs i ever saw being fixed in the kernel!

Signed-off-by: Ingo Molnar 
Signed-off-by: Linus Torvalds

[PATCH] slab: Fix kmem_cache_destroy() on NUMA

2006-05-16T14:59:32+00:00

With CONFIG_NUMA set, kmem_cache_destroy() may fail and say "Can't
free all objects."  The problem is caused by sequences such as the
following (suppose we are on a NUMA machine with two nodes, 0 and 1):

 * Allocate an object from cache on node 0.
 * Free the object on node 1.  The object is put into node 1's alien
   array_cache for node 0.
 * Call kmem_cache_destroy(), which ultimately ends up in __cache_shrink().
 * __cache_shrink() does drain_cpu_caches(), which loops through all nodes.
   For each node it drains the shared array_cache and then handles the
   alien array_cache for the other node.

However this means that node 0's shared array_cache will be drained,
and then node 1 will move the contents of its alien[0] array_cache
into that same shared array_cache.  node 0's shared array_cache is
never looked at again, so the objects left there will appear to be in
use when __cache_shrink() calls __node_shrink() for node 0.  So
__node_shrink() will return 1 and kmem_cache_destroy() will fail.

This patch fixes this by having drain_cpu_caches() do
drain_alien_cache() on every node before it does drain_array() on the
nodes' shared array_caches.

The problem was originally reported by Or Gerlitz .

Signed-off-by: Roland Dreier 
Acked-by: Christoph Lameter 
Acked-by: Pekka Enberg 
Signed-off-by: Linus Torvalds

[PATCH] add slab_is_available() routine for boot code

2006-05-15T18:20:56+00:00

slab_is_available() indicates slab based allocators are available for use.
SPARSEMEM code needs to know this as it can be called at various times
during the boot process.

Signed-off-by: Mike Kravetz 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] slab: fix crash on __drain_alien_cahce() during CPU Hotplug

2006-04-28T16:00:35+00:00

transfer_objects should only be called when all of the cpus in the
node are online.  CPU_DEAD notifier callback marks l3->shared to NULL.

Signed-off-by: Jacob Shin 
Signed-off-by: Linus Torvalds

[PATCH] Remove devinit and cpuinit from notifier_call definitions

2006-04-26T15:30:03+00:00

Few of the notifier_chain_register() callers use __init in the definition
of notifier_call.  It is incorrect as the function definition should be
available after the initializations (they do not unregister them during
initializations).

This patch fixes all such usages to _not_ have the notifier_call __init
section.

Signed-off-by: Chandra Seetharaman 
Signed-off-by: Linus Torvalds

[PATCH] nommu: use compound page in slab allocator

2006-04-11T13:18:32+00:00

The earlier patch to consolidate mmu and nommu page allocation and
refcounting by using compound pages for nommu allocations had a bug:
kmalloc slabs who's pages were initially allocated by a non-__GFP_COMP
allocator could be passed into mm/nommu.c kmalloc allocations which really
wanted __GFP_COMP underlying pages.  Fix that by having nommu pass
__GFP_COMP to all higher order slab allocations.

Signed-off-by: Luke Yang 
Acked-by: Nick Piggin 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] slab: add statistics for alien cache overflows

2006-04-11T13:18:31+00:00

Add a statistics counter which is incremented everytime the alien cache
overflows.  alien_cache limit is hardcoded to 12 right now.  We can use
this statistics to tune alien cache if needed in the future.

Signed-off-by: Alok N Kataria 
Signed-off-by: Ravikiran Thirumalai 
Signed-off-by: Shai Fultheim 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

[PATCH] slab: allocate node local memory for off-slab slabmanagement

2006-04-11T13:18:31+00:00

Allocate off-slab slab descriptors from node local memory.

Signed-off-by: Alok N Kataria 
Signed-off-by: Ravikiran Thirumalai 
Signed-off-by: Shai Fultheim 
Acked-by: Christoph Lameter 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

BUG_ON() Conversion in mm/slab.c

2006-04-02T11:49:25+00:00

this changes if() BUG(); constructs to BUG_ON() which is
cleaner, contains unlikely() and can better optimized away.

Signed-off-by: Eric Sesterhenn 
Signed-off-by: Adrian Bunk

[PATCH] for_each_possible_cpu: fixes for generic part

2006-03-28T17:16:05+00:00

replaces for_each_cpu with for_each_possible_cpu().

Signed-off-by: KAMEZAWA Hiroyuki 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

linux-toradex.git/mm/slab.c, branch v2.6.17.10

[PATCH] slab.c: fix offslab_limit bug

[PATCH] slab: Fix kmem_cache_destroy() on NUMA

[PATCH] add slab_is_available() routine for boot code

[PATCH] slab: fix crash on __drain_alien_cahce() during CPU Hotplug

[PATCH] Remove __devinit and __cpuinit from notifier_call definitions

[PATCH] nommu: use compound page in slab allocator

[PATCH] slab: add statistics for alien cache overflows

[PATCH] slab: allocate node local memory for off-slab slabmanagement

BUG_ON() Conversion in mm/slab.c

[PATCH] for_each_possible_cpu: fixes for generic part

[PATCH] Remove devinit and cpuinit from notifier_call definitions