Forwarded: [PATCH] mm/slub: fix kmemleak false positive in RCU sheaves

[syzbot <syzbot+4d078516add5f4f12cea@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [PATCH] mm/slub: fix kmemleak false positive in RCU sheaves
Author: gowtham398gs@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

The SLUB allocator's sheaf caching layer allocates `struct slab_sheaf`
objects via `kmalloc_flags()`, which registers them with kmemleak
for leak tracking. When full RCU sheaves are retired in
`__kfree_rcu_sheaf()`, they are queued into RCU via
`call_rcu(&rcu_sheaf->rcu_head, rcu_free_sheaf)`.

While pending in RCU's singly-linked callback list, if any preceding
callback resides in memory untracked or ignored by kmemleak
(such as `struct slab` from `call_rcu(&slab->rcu_head, rcu_free_slab)`),
kmemleak cannot traverse the chain to reach subsequent callbacks.
Because `__alloc_empty_sheaf()` does not mark the sheaf with
`kmemleak_not_leak()`,kmemleak falsely flags pending RCU sheaves
as unreferenced memory leaks.

Applying `kmemleak_not_leak()` marks the sheaf metadata as grey,
preventing the false leak report while ensuring kmemleak still scans the
cached objects within `sheaf->objects[]`, whose freeing hooks
are deferred until `rcu_free_sheaf()` runs.

Reported-by: syzbot+4d078516add5f4f12cea@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4d078516add5f4f12cea
Fixes: 36aad21d50d1 ("mm/slub: add RCU sheaf caching")

Signed-off-by: Gowtham S Bhushan <gowtham398gs@gmail.com>
---
 mm/slub.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/mm/slub.c b/mm/slub.c
index 45e077c7526c..61cd77644c3b 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2856,6 +2856,8 @@ static struct slab_sheaf *__alloc_empty_sheaf(struct kmem_cache *s, gfp_t gfp,
 	if (unlikely(!sheaf))
 		return NULL;
 
+	kmemleak_not_leak(sheaf);
+
 	sheaf->cache = s;
 
 	stat(s, SHEAF_ALLOC);
-- 
2.56.0