[PATCH v2 4/4] Documentation/mm: describe SLUB previous lifetime tracking

[Pengpeng Hou <pengpeng@iscas.ac.cn>]

Document that SLAB_STORE_USER now retains one previous completed
allocation/free pair, show the additional report section, and state that
address history is diagnostic evidence rather than semantic ownership
attribution.

Assisted-by: Codex:gpt-5
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 Documentation/admin-guide/mm/slab.rst | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/Documentation/admin-guide/mm/slab.rst b/Documentation/admin-guide/mm/slab.rst
index 14429ab90611..5f60904b1e0b 100644
--- a/Documentation/admin-guide/mm/slab.rst
+++ b/Documentation/admin-guide/mm/slab.rst
@@ -49,7 +49,8 @@ Possible debug options are::
 			Sorry SLAB legacy issues)
 	Z		Red zoning
 	P		Poisoning (object and padding)
-	U		User tracking (free and alloc)
+	U		User tracking (free and alloc, plus one previous
+			completed object lifetime)
 	T		Trace (please only use on single slabs)
 	A		Enable failslab filter mark for the cache
 	O		Switch debugging off for caches that would have
@@ -245,10 +246,20 @@ into the syslog:
 	cpu> pid=<pid of the process>
      INFO: Freed in <kernel function> age=<jiffies since free> cpu=<freed by cpu>
 	pid=<pid of the process>
+     INFO: Previous object lifetime:
+     INFO: Allocated in <kernel function> age=<jiffies since alloc> cpu=<allocated by
+	cpu> pid=<pid of the process>
+     INFO: Freed in <kernel function> age=<jiffies since free> cpu=<freed by cpu>
+	pid=<pid of the process>
 
    (Object allocation / free information is only available if SLAB_STORE_USER is
    set for the slab. slab_debug sets that option)
 
+   If an object with a completed allocation/free pair is reused, user tracking
+   also retains that pair as the previous object lifetime. This address history
+   can help diagnose stale references after reuse, but it does not establish
+   semantic ownership or identify a use-after-free root cause by itself.
+
 2. The object contents if an object was involved.
 
    Various types of lines can follow the BUG SLUB line:
-- 
2.50.1 (Apple Git-155)