Messages in this thread | | | Subject | Re: [patch] Real-Time Preemption, -RT-2.6.10-rc2-mm3-V0.7.32-6 | From | Steven Rostedt <> | Date | Wed, 08 Dec 2004 12:13:38 -0500 |
| |
Hi Ingo,
I found a race condition in slab.c, but I'm still trying to figure out exactly how it's playing out. This has to do with dynamic loading and unloading of caches. I have a small test case that simulates the problem at http://home.stny.rr.com/rostedt/tests/sillycaches.tgz
This was done on:
# uname -r 2.6.10-rc2-mm3-V0.7.32-9
I have a module that creates a cache to allocate objects from. When you unload the module, it deallocates the objects and then destroys the cache. But with your patched kernel I get the following output, and the system then goes into an unstable state. That is the system will crash at a latter time. Usually when dealing with caches.
Here's the output:
slab error in kmem_cache_destroy(): cache `silly_stuff': Can't free all objects [<c0103953>] dump_stack+0x23/0x30 (20) [<c014929f>] kmem_cache_destroy+0xff/0x1a0 (28) [<d081e10d>] mkcache_cleanup+0x1d/0x21 [sillymod] (12) [<c013a711>] sys_delete_module+0x161/0x1a0 (100) [<c0102a00>] syscall_call+0x7/0xb (-8124) --------------------------- | preempt count: 00000001 ] | 1-level deep critical section nesting: ---------------------------------------- .. [<c01383ed>] .... print_traces+0x1d/0x60 .....[<c0103953>] .. ( <= dump_stack+0x23/0x30)
I've done some extra testing and found that if I wait between the frees and the destroying of the cache, everything works fine. This problem happens because it seems that the objects in the slab are being freed in a batch style and they don't get freed on the destroy. I put prints in to see more information and found that in kmem_cache_destroy, it calls __cache_shrink, which calls drain_cpu_caches (obvious from code), but what my prints show, is that when it gets down to drain_array_locked (it gets in the function) that ac->avail is zero. I need to read more into the details of how the slab works, but you can take a look too.
By the way, 2.6.10-rc2-mm3 does not have a problem with this.
Thanks,
-- Steve - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |