Re: [PATCH] mm/slab: sample slab_state once in kmem_cache_destroy()

[Imre Kaloz]

Hi Harry,

On Wed, 14 Oct 2026, Harry Yoo wrote:

<snip>

> > So it takes both. The read that hurts is the one at release time,
> > after rcu_barrier(); fixing only the double read keeps it, and so
> > does moving only the unlink check under the mutex. Reading once
> > right after the unlock didn't trigger it, but that is still racy,
> > just a much smaller window.
>
> Thanks for verifying that.
>
> > For stable, as far as I can tell the release-side read has been
> > outside slab_mutex since d50d82faa0c9 ("slub: fix failure when we
> > delete and create a slab cache") in v4.18
>
> For SLAB_TYPESAFE_BY_RCU caches, yes.
> and others since 0495e337b703.
>
> I think Fixes: d50d82faa0c9 should be fine.
>
> > , so that would cover
> > 5.10.y. The patch doesn't apply before 6.12, so the older branches
> > need their own backports.
>
> Ack.
> Are you willing to backport it to -stable kernels as well?
>
> And could you please post v2 with updated Fixes: and the
> commit message ;)
>
> Thanks for fixing this!

Sure thing. v2 is out:
https://lore.kernel.org/all/20261014150844.8536-1-kaloz@xxxxxxxxxx/

I'll send the backports for 6.6, 6.1, 5.15 and 5.10 once it's in
mainline; 6.12 and later should take it as is.


Best,
Imre