Re: [PATCH 1/2] mm/kasan: Detect double-free involving kfree_rcu_sheaf().

[Kuniyuki Iwashima <kuniyu@google.com>]

On Tue, 27 Oct 2026 13:48:03 +0100, Alexander Potapenko wrote:
> On Fri, Oct 9, 2026 at 11:46 PM Kuniyuki Iwashima <kuniyu@google.com> wrote:
> 
> > The bit is marked along with recording the stack trace when
> > deferring slab frees in kfree_rcu_sheaf() and checked in
> > check_slab_allocation() so that any double-free pattern above
> > can be detected immediately.
> >
> > Link: https://lore.kernel.org/all/6ac959ee.70ed5d86.2ac85.007d.GAE@google.com/ #[0]
> > Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
> Tested-by: Alexander Potapenko <glider@google.com>
> 
> Do we need a Fixes: tag?

Will add

Fixes: ec66e0d59952 ("slab: add sheaf support for batching kfree_rcu() operations")

> 
> 
> 
> 
> >   */
> >  static __always_inline bool kasan_slab_pre_free(struct kmem_cache *s,
> > -                                               void *object)
> > +                                               void *object,
> > +                                               bool after_rcu_delay)
> 
> Please update the doc comment as well.

Will do.


> 
> 
> >         poison_slab_object(slab->slab_cache, ptr, false);
> > diff --git a/mm/kasan/generic.c b/mm/kasan/generic.c
> > index 2b8e73f5f6a7..07636ffe1626 100644
> > --- a/mm/kasan/generic.c
> > +++ b/mm/kasan/generic.c
> > @@ -536,7 +536,7 @@ size_t kasan_metadata_size(struct kmem_cache *cache, bool in_object)
> >   * This function avoids dynamic memory allocations and thus can be called from
> >   * contexts that do not allow allocating memory.
> >   */
> 
> Please update the comment for this function.

Will do.


> 
> 
> > +void kasan_record_aux_stack(void *addr)
> > +{
> > +       __kasan_record_aux_stack(addr, false);
> > +}
> > +
> 
> I think there's an important distinction between
> kasan_record_aux_stack() and kasan_record_aux_stack_rcu(): namely, it
> affects how this object is handled later.
> Let's somehow reflect this in a comment ("records the aux stack and
> arms the check") and perhaps rename it to something like
> kasan_mark_rcu_free_pending()?

Sure, will rename to it and add comments.


> 
> Otherwise the series looks good, I'll be happy to stamp it once you
> fix the comments.
> 

Thank you !