static int drain_freelist(struct kmem_cache *cache,
                        struct kmem_cache_node *n, int tofree);
 static void free_block(struct kmem_cache *cachep, void **objpp, int len,
-                       int node);
+                       int node, struct list_head *list);
+static void slabs_destroy(struct kmem_cache *cachep, struct list_head *list);
 static int enable_cpucache(struct kmem_cache *cachep, gfp_t gfp);
 static void cache_reap(struct work_struct *unused);
 
                                struct array_cache *ac, int node)
 {
        struct kmem_cache_node *n = get_node(cachep, node);
+       LIST_HEAD(list);
 
        if (ac->avail) {
                spin_lock(&n->list_lock);
                if (n->shared)
                        transfer_objects(n->shared, ac, ac->limit);
 
-               free_block(cachep, ac->entry, ac->avail, node);
+               free_block(cachep, ac->entry, ac->avail, node, &list);
                ac->avail = 0;
                spin_unlock(&n->list_lock);
+               slabs_destroy(cachep, &list);
        }
 }
 
        struct kmem_cache_node *n;
        struct array_cache *alien = NULL;
        int node;
+       LIST_HEAD(list);
 
        node = numa_mem_id();
 
        } else {
                n = get_node(cachep, nodeid);
                spin_lock(&n->list_lock);
-               free_block(cachep, &objp, 1, nodeid);
+               free_block(cachep, &objp, 1, nodeid, &list);
                spin_unlock(&n->list_lock);
+               slabs_destroy(cachep, &list);
        }
        return 1;
 }
                struct array_cache *nc;
                struct array_cache *shared;
                struct array_cache **alien;
+               LIST_HEAD(list);
 
                /* cpu is dead; no one can alloc from it. */
                nc = cachep->array[cpu];
                /* Free limit for this kmem_cache_node */
                n->free_limit -= cachep->batchcount;
                if (nc)
-                       free_block(cachep, nc->entry, nc->avail, node);
+                       free_block(cachep, nc->entry, nc->avail, node, &list);
 
                if (!cpumask_empty(mask)) {
                        spin_unlock_irq(&n->list_lock);
                shared = n->shared;
                if (shared) {
                        free_block(cachep, shared->entry,
-                                  shared->avail, node);
+                                  shared->avail, node, &list);
                        n->shared = NULL;
                }
 
                        free_alien_cache(alien);
                }
 free_array_cache:
+               slabs_destroy(cachep, &list);
                kfree(nc);
        }
        /*
                kmem_cache_free(cachep->freelist_cache, freelist);
 }
 
+static void slabs_destroy(struct kmem_cache *cachep, struct list_head *list)
+{
+       struct page *page, *n;
+
+       list_for_each_entry_safe(page, n, list, lru) {
+               list_del(&page->lru);
+               slab_destroy(cachep, page);
+       }
+}
+
 /**
  * calculate_slab_order - calculate size (page order) of slabs
  * @cachep: pointer to the cache that is being created
        struct array_cache *ac;
        int node = numa_mem_id();
        struct kmem_cache_node *n;
+       LIST_HEAD(list);
 
        check_irq_off();
        ac = cpu_cache_get(cachep);
        n = get_node(cachep, node);
        spin_lock(&n->list_lock);
-       free_block(cachep, ac->entry, ac->avail, node);
+       free_block(cachep, ac->entry, ac->avail, node, &list);
        spin_unlock(&n->list_lock);
+       slabs_destroy(cachep, &list);
        ac->avail = 0;
 }
 
 
 /*
  * Caller needs to acquire correct kmem_cache_node's list_lock
+ * @list: List of detached free slabs should be freed by caller
  */
-static void free_block(struct kmem_cache *cachep, void **objpp, int nr_objects,
-                      int node)
+static void free_block(struct kmem_cache *cachep, void **objpp,
+                       int nr_objects, int node, struct list_head *list)
 {
        int i;
        struct kmem_cache_node *n = get_node(cachep, node);
                if (page->active == 0) {
                        if (n->free_objects > n->free_limit) {
                                n->free_objects -= cachep->num;
-                               /* No need to drop any previously held
-                                * lock here, even if we have a off-slab slab
-                                * descriptor it is guaranteed to come from
-                                * a different cache, refer to comments before
-                                * alloc_slabmgmt.
-                                */
-                               slab_destroy(cachep, page);
+                               list_add_tail(&page->lru, list);
                        } else {
                                list_add(&page->lru, &n->slabs_free);
                        }
        int batchcount;
        struct kmem_cache_node *n;
        int node = numa_mem_id();
+       LIST_HEAD(list);
 
        batchcount = ac->batchcount;
 #if DEBUG
                }
        }
 
-       free_block(cachep, ac->entry, batchcount, node);
+       free_block(cachep, ac->entry, batchcount, node, &list);
 free_done:
 #if STATS
        {
        }
 #endif
        spin_unlock(&n->list_lock);
+       slabs_destroy(cachep, &list);
        ac->avail -= batchcount;
        memmove(ac->entry, &(ac->entry[batchcount]), sizeof(void *)*ac->avail);
 }
                n = get_node(cachep, node);
                if (n) {
                        struct array_cache *shared = n->shared;
+                       LIST_HEAD(list);
 
                        spin_lock_irq(&n->list_lock);
 
                        if (shared)
                                free_block(cachep, shared->entry,
-                                               shared->avail, node);
+                                               shared->avail, node, &list);
 
                        n->shared = new_shared;
                        if (!n->alien) {
                        n->free_limit = (1 + nr_cpus_node(node)) *
                                        cachep->batchcount + cachep->num;
                        spin_unlock_irq(&n->list_lock);
+                       slabs_destroy(cachep, &list);
                        kfree(shared);
                        free_alien_cache(new_alien);
                        continue;
        cachep->shared = shared;
 
        for_each_online_cpu(i) {
+               LIST_HEAD(list);
                struct array_cache *ccold = new->new[i];
                int node;
                struct kmem_cache_node *n;
                node = cpu_to_mem(i);
                n = get_node(cachep, node);
                spin_lock_irq(&n->list_lock);
-               free_block(cachep, ccold->entry, ccold->avail, node);
+               free_block(cachep, ccold->entry, ccold->avail, node, &list);
                spin_unlock_irq(&n->list_lock);
+               slabs_destroy(cachep, &list);
                kfree(ccold);
        }
        kfree(new);
 static void drain_array(struct kmem_cache *cachep, struct kmem_cache_node *n,
                         struct array_cache *ac, int force, int node)
 {
+       LIST_HEAD(list);
        int tofree;
 
        if (!ac || !ac->avail)
                        tofree = force ? ac->avail : (ac->limit + 4) / 5;
                        if (tofree > ac->avail)
                                tofree = (ac->avail + 1) / 2;
-                       free_block(cachep, ac->entry, tofree, node);
+                       free_block(cachep, ac->entry, tofree, node, &list);
                        ac->avail -= tofree;
                        memmove(ac->entry, &(ac->entry[tofree]),
                                sizeof(void *) * ac->avail);
                }
                spin_unlock_irq(&n->list_lock);
+               slabs_destroy(cachep, &list);
        }
 }