Re: [PATCH] kasan: fix quarantine_size accounting during cache removal

[Hui Su <sh_def@163.com>]

> > quarantine_size tracks the total number of bytes stored in
> > global_quarantine[]. It is incremented when per-CPU quarantine objects
> > are moved into the global quarantine and decremented when a global
> > batch is evicted by kasan_quarantine_reduce().
> >
> > kasan_quarantine_remove_cache() also removes objects from the global
> > quarantine. qlist_move_cache() rebuilds the source batch and updates
> > its .bytes field, but quarantine_size is not adjusted accordingly.
> >
> > As a result, quarantine_size remains over-counted by the size of the
> > removed objects. The stale accounting accumulates across cache removals.
> > Once the inflated value exceeds quarantine_max_size,
> > kasan_quarantine_reduce() can evict a batch even though the actual
> > number of bytes in global_quarantine[] is still below
> > quarantine_max_size, shortening the quarantine window.
> >
> > Fix the accounting by recording each batch's size before
> > qlist_move_cache() and subtracting the number of bytes actually removed
> > from quarantine_size while holding quarantine_lock.
> >
> > A KUnit reproducer used during testing observed the over-count grow by
> > 4698864 bytes after one kasan_quarantine_remove_cache() call with the
> > fix reverted. With this change applied, the over-count did not grow.
> >
> 
> Thanks.
> 
> > @@ -365,9 +365,14 @@ void kasan_quarantine_remove_cache(struct kmem_cache *cache)
> 
> Sashiko might have found an unrelated pre-existing bug in here.
> 
> 	https://sashiko.dev/#/patchset/20260811073332.1351893-1-sh_def@163.com

Thanks for pointing this out.

The issue found by Sashiko was fixed by a previous patch:
https://lore.kernel.org/lkml/20260808031459.3032812-1-sh_def@163.com/