Handle cases where the the object being kvfree_rcu()'d is not aligned by
2-byte boundaries.
Signed-off-by: Joel Fernandes (Google) <joel@xxxxxxxxxxxxxxxxx>
---
kernel/rcu/tree.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index 311d216c7faa7..d6536374d12a9 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -2827,6 +2827,9 @@ struct kvfree_rcu_bulk_data {
#define KVFREE_BULK_MAX_ENTR \
((PAGE_SIZE - sizeof(struct kvfree_rcu_bulk_data)) / sizeof(void *))
+/* Encoding the offset of a fake rcu_head to indicate the head is a wrapper. */
+#define RCU_HEADLESS_KFREE BIT(31)
+
/**
* struct kfree_rcu_cpu_work - single batch of kfree_rcu() requests
* @rcu_work: Let queue_rcu_work() invoke workqueue handler after grace period
@@ -2970,9 +2973,9 @@ static void kfree_rcu_work(struct work_struct *work)
next = head->next;
/* We tag the headless object, if so adjust offset. */
- headless = (((unsigned long) head - offset) & BIT(0));
+ headless = !!(offset & RCU_HEADLESS_KFREE);
if (headless)
- offset -= 1;
+ offset &= ~(RCU_HEADLESS_KFREE);
ptr = (void *) head - offset;
debug_rcu_head_unqueue((struct rcu_head *)ptr);
@@ -3221,7 +3224,7 @@ void kvfree_call_rcu(struct rcu_head *head, rcu_callback_t func)
* to the original allocated memory, that has to be freed as
* well as dynamically attached wrapper/head.
*/
- func = (rcu_callback_t) (sizeof(unsigned long *) + 1);
+ func = (rcu_callback_t)(sizeof(unsigned long *) | RCU_HEADLESS_KFREE);
}
head->func = func;
--
2.26.0.rc2.310.g2932bb562d-goog
