Re: [PATCH] slub: Don't call lockdep_unregister_key() for immature kmem_cache.

[Alexei Starovoitov <alexei.starovoitov@gmail.com>]

On Tue, Oct 7, 2025 at 12:46 AM Vlastimil Babka <vbabka@suse.cz> wrote:
>
> On 10/7/25 07:25, Kuniyuki Iwashima wrote:
> > syzbot reported the lockdep splat below in __kmem_cache_release(). [0]
> >
> > The problem is that __kmem_cache_release() could be called from
> > do_kmem_cache_create() before init_kmem_cache_cpus() registers
> > the lockdep key.

Hmm. If that's the case then alloc_kmem_cache_cpus() wasn't called yet
and s->cpu_slab == NULL, so any kmalloc/kmem_cache_alloc from
that slub will crash. The above sounds like it's a race condition,
but it's not. It's a weird error path in do_kmem_cache_create()
due to syzbot pressure.
So the fix isn't quite right.
There is no need to sprinkle #ifdef all over the code.

> >
> > Let's move lockdep_unregister_key() from __kmem_cache_release()
> > to slab_kmem_cache_release() and do_kmem_cache_create().

I wouldn't.

> Thanks, added to slab/for-next-fixes

The following is imo much cleaner fix:

diff --git a/mm/slub.c b/mm/slub.c
index 584a5ff1828b..0a1fbddb77f8 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -7693,7 +7693,8 @@ void __kmem_cache_release(struct kmem_cache *s)
                pcs_destroy(s);
 #ifndef CONFIG_SLUB_TINY
 #ifdef CONFIG_PREEMPT_RT
-       lockdep_unregister_key(&s->lock_key);
+       if (s->cpu_slab)
+               lockdep_unregister_key(&s->lock_key);
 #endif
        free_percpu(s->cpu_slab);
 #endif

compile tested only...