Re: [PATCH] mm/mempolicy: refcount the weighted interleave state instead of copying it

On Sun, 23 Aug 2026 22:41:17 -0400 Gregory Price <[email protected]> wrote:

> alloc_pages_bulk_weighted_interleave() copies iw_table into a scratch
> array on every call to get the table outside of RCU.
> 
> Refcount the weighted interleave state and cleanup with kfree_rcu().
> Refcount and iw_table get their own cachelines to prevent false sharing.
> 
> This drops a kzalloc/memcpy/kfree per call and deals with a bug induced
> by the scratch array's hardcoded GFP_KERNEL and the partial allocation it
> returned when that failed.
> 
> Tested in VM (KASAN, PROVE_LOCKING and DEBUG_OBJECTS_RCU_HEAD) with a
> udelay() injected between the rcu_dereference() and the refcount_inc
> to stress the race. Six concurrent bulk allocators racing four threads
> writing the sysfs weights took the retry path 2536 times with no splat,
> and the published state was back to a count of one at rest.
> 
> Replacing the kfree_rcu() with a bare kfree() in that same test reports
> a use-after-free immediately, so the test does exercise what the deferred
> free protects.
> 
> ...
> 
> Hi Andrew - please consider this instead.

Let's keep Eric's nice simple one-liner
(https://lore.kernel.org/[email protected])
for a backportable fix.  THen we can work on more sophisticated
approaches in the next -rc cycle.