The patch titled Subject: mm: fix slab->page _count corruption when using slub has been added to the -mm tree. Its filename is mm-fix-slab-page-_count-corruption-when-using-slub.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Pravin B Shelar <pshelar@xxxxxxxxxx> Subject: mm: fix slab->page _count corruption when using slub On arches that do not support this_cpu_cmpxchg_double() slab_lock is used to do atomic cmpxchg() on double word which contains page->_count. The page count can be changed from get_page() or put_page() without taking slab_lock. That corrupts page counter. Fix it by moving page->_count out of cmpxchg_double data. So that slub does no change it while updating slub meta-data in struct page. Reported-by: Amey Bhide <abhide@xxxxxxxxxx> Signed-off-by: Pravin B Shelar <pshelar@xxxxxxxxxx> Acked-by: Christoph Lameter <cl@xxxxxxxxx> Cc: Pekka Enberg <penberg@xxxxxxxxxxxxxx> Cc: Andrea Arcangeli <aarcange@xxxxxxxxxx> Cc: <stable@xxxxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- include/linux/mm_types.h | 8 ++++++++ 1 file changed, 8 insertions(+) diff -puN include/linux/mm_types.h~mm-fix-slab-page-_count-corruption-when-using-slub include/linux/mm_types.h --- a/include/linux/mm_types.h~mm-fix-slab-page-_count-corruption-when-using-slub +++ a/include/linux/mm_types.h @@ -57,8 +57,16 @@ struct page { }; union { +#if defined(CONFIG_HAVE_CMPXCHG_DOUBLE) && \ + defined(CONFIG_HAVE_ALIGNED_STRUCT_PAGE) /* Used for cmpxchg_double in slub */ unsigned long counters; +#else + /* Keep _count separate from slub cmpxchg_double data, + * As rest of double word is protected by slab_lock + * but _count is not. */ + unsigned counters; +#endif struct { _ Subject: Subject: mm: fix slab->page _count corruption when using slub Patches currently in -mm which might be from pshelar@xxxxxxxxxx are mm-fix-slab-page-_count-corruption-when-using-slub.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html