Skip to content
  • Linus Torvalds's avatar
    Revert "SLUB: Alternate fast paths using cmpxchg_local" · 00e962c5
    Linus Torvalds authored
    This reverts commit 1f84260c, which is
    suspected to be the reason for some very occasional and hard-to-trigger
    crashes that usually look related to memory allocation (mostly reported
    in networking, but since that's generally the most common source of
    shortlived allocations - and allocations in interrupt contexts - that in
    itself is not a big clue).
    
    See for example
    	http://bugzilla.kernel.org/show_bug.cgi?id=9973
    	http://lkml.org/lkml/2008/2/19/278
    
    
    etc.
    
    One promising suspicion for what the root cause of bug is (which also
    explains why it's so hard to trigger in practice) came from Eric
    Dumazet:
    
       "I wonder how SLUB_FASTPATH is supposed to work, since it is affected
        by a classical ABA problem of lockless algo.
    
        cmpxchg_local(&c->freelist, object, object[c->offset]) can succeed,
        while an interrupt came (on this cpu), and several allocations were
        done, and one free was performed at the end of this interruption, so
        'object' was recycled.
    
        c->freelist can then contain the previous value (object), but
        object[c->offset] was changed by IRQ.
    
        We then put back in freelist an already allocated object."
    
    but another reason for the revert is simply that everybody agrees that
    this code was the main suspect just by virtue of the pattern of oopses.
    
    Cc: Torsten Kaiser <just.for.lkml@googlemail.com>
    Cc: Christoph Lameter <clameter@sgi.com>
    Cc: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca>
    Cc: Pekka Enberg <penberg@cs.helsinki.fi>
    Cc: Ingo Molnar <mingo@elte.hu>
    Cc: Eric Dumazet <dada1@cosmosbay.com>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    00e962c5