From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 49496C4707A for ; Mon, 25 Oct 2021 19:53:03 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 38D64604DA for ; Mon, 25 Oct 2021 19:53:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239170AbhJYTyP (ORCPT ); Mon, 25 Oct 2021 15:54:15 -0400 Received: from mail.kernel.org ([198.145.29.99]:37198 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237015AbhJYTtk (ORCPT ); Mon, 25 Oct 2021 15:49:40 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id A569961248; Mon, 25 Oct 2021 19:41:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1635190913; bh=5p8bZG8z4p9WGxRfQLTTQFOry9/dc9pJK+hpBQ75HDQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Wm+GCXtf3BN8nO+g0EDOzPMiXQsuYTVDmENo3GqP+HvNwCz0hi7VWciliEHIy6r2+ JTUdSsT3RVjmBpEKGaVgEwv+CF0zHD3DkBBr60M2BV6IjzW0V3X76oqWIMjsFEUDTK gTpEj6pTq13u95MNtz8KPzUigKGDQip7VINQggpI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaohe Lin , Vlastimil Babka , Andrey Konovalov , Andrey Ryabinin , Bharata B Rao , Christoph Lameter , David Rientjes , Faiyaz Mohammed , Joonsoo Kim , Kees Cook , Pekka Enberg , Roman Gushchin , Andrew Morton , Linus Torvalds Subject: [PATCH 5.14 100/169] mm, slub: fix mismatch between reconstructed freelist depth and cnt Date: Mon, 25 Oct 2021 21:14:41 +0200 Message-Id: <20211025191030.534001211@linuxfoundation.org> X-Mailer: git-send-email 2.33.1 In-Reply-To: <20211025191017.756020307@linuxfoundation.org> References: <20211025191017.756020307@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Miaohe Lin commit 899447f669da76cc3605665e1a95ee877bc464cc upstream. If object's reuse is delayed, it will be excluded from the reconstructed freelist. But we forgot to adjust the cnt accordingly. So there will be a mismatch between reconstructed freelist depth and cnt. This will lead to free_debug_processing() complaining about freelist count or a incorrect slub inuse count. Link: https://lkml.kernel.org/r/20210916123920.48704-3-linmiaohe@huawei.com Fixes: c3895391df38 ("kasan, slub: fix handling of kasan_slab_free hook") Signed-off-by: Miaohe Lin Reviewed-by: Vlastimil Babka Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Bharata B Rao Cc: Christoph Lameter Cc: David Rientjes Cc: Faiyaz Mohammed Cc: Greg Kroah-Hartman Cc: Joonsoo Kim Cc: Kees Cook Cc: Pekka Enberg Cc: Roman Gushchin Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- mm/slub.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) --- a/mm/slub.c +++ b/mm/slub.c @@ -1629,7 +1629,8 @@ static __always_inline bool slab_free_ho } static inline bool slab_free_freelist_hook(struct kmem_cache *s, - void **head, void **tail) + void **head, void **tail, + int *cnt) { void *object; @@ -1656,6 +1657,12 @@ static inline bool slab_free_freelist_ho *head = object; if (!*tail) *tail = object; + } else { + /* + * Adjust the reconstructed freelist depth + * accordingly if object's reuse is delayed. + */ + --(*cnt); } } while (object != old_tail); @@ -3210,7 +3217,7 @@ static __always_inline void slab_free(st * With KASAN enabled slab_free_freelist_hook modifies the freelist * to remove objects, whose reuse must be delayed. */ - if (slab_free_freelist_hook(s, &head, &tail)) + if (slab_free_freelist_hook(s, &head, &tail, &cnt)) do_slab_free(s, page, head, tail, cnt, addr); }