Re: 2.5.39 kmem_cache bug

[Andrew Morton]

John Levon wrote:
> 
> On Sat, Sep 28, 2002 at 01:56:55PM -0700, Andrew Morton wrote:
> 
> >       if (list_empty(&cachep->slabs_free))
> >               list_add(&slabp->list, &cachep->slabs_free);
> >       else
> >               kmem_slab_destroy(cachep, slabp);
> 
> This seems to work for me on a quick test.
> 

Thanks.    I'll send the below patch.

Slab currently has a policy of buffering a single spare page per slab. 
We're putting that on the partially-full list, which confuses
kmem_cache_destroy().

So put it on cachep->slabs_free, which is where empty pages go.

 mm/slab.c |    9 ++++-----
 1 files changed, 4 insertions(+), 5 deletions(-)

--- 2.5.39/mm/slab.c~slab-fix	Sat Sep 28 14:20:52 2002
+++ 2.5.39-akpm/mm/slab.c	Sat Sep 28 14:23:50 2002
@@ -1499,9 +1499,9 @@ static inline void kmem_cache_free_one(k
 		if (unlikely(!--slabp->inuse)) {
 			/* Was partial or full, now empty. */
 			list_del(&slabp->list);
-/*			list_add(&slabp->list, &cachep->slabs_free); 		*/
-			if (unlikely(list_empty(&cachep->slabs_partial)))
-				list_add(&slabp->list, &cachep->slabs_partial);
+			/* We only buffer a single page */
+			if (list_empty(&cachep->slabs_free))
+				list_add(&slabp->list, &cachep->slabs_free);
 			else
 				kmem_slab_destroy(cachep, slabp);
 		} else if (unlikely(inuse == cachep->num)) {
@@ -1977,8 +1977,7 @@ static int s_show(struct seq_file *m, vo
 	}
 	list_for_each(q,&cachep->slabs_partial) {
 		slabp = list_entry(q, slab_t, list);
-		if (slabp->inuse == cachep->num)
-			BUG();
+		BUG_ON(slabp->inuse == cachep->num || !slabp->inuse);
 		active_objs += slabp->inuse;
 		active_slabs++;
 	}

.