Re: [PATCH v3 2/2] mm/kasan/kunit: Add double-free tests involving kfree_rcu_sheaf().

[Harry Yoo <harry@kernel.org>]

On Wed, Oct 28, 2026 at 09:51:59PM -0700, Kuniyuki Iwashima wrote:
> On Wed, Oct 28, 2026 at 9:46 PM Andrew Morton <akpm@linux-foundation.org> wrote:
> >
> > On Wed, 28 Oct 2026 19:39:20 +0000 Kuniyuki Iwashima <kuniyu@google.com> wrote:
> >
> > > The new test cases verify that KASAN immediately detects all
> > > three combinations of double-free involving kfree_rcu_sheaf():
> > >
> > >   1. kmem_cache_free() -> kfree_rcu()
> > >   2. kfree_rcu()       -> kmem_cache_free()
> > >   3. kfree_rcu()       -> kfree_rcu()
> > >
> > > Each test also evicts the object from the KASAN quarantine and
> > > reallocates it as a victim object before flushing the RCU sheaf
> > > to ensure the live victim object is not poisoned by the rejected
> > > double-free.
> > >
> > > Without the patch, all tests fail to detect the 2nd free, and
> > > the victim is poisoned:
> > >
> > > ...
> > >
> > > With the patch, all tests can detect the 2nd free immediately and
> > > prevent the victim from being poisoned:
> > >
> > > Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
> > > Reviewed-by: Alexander Potapenko <glider@google.com>
> >
> > Thanks.  I believe this should have
> >
> > Fixes: ec66e0d59952 ("slab: add sheaf support for batching kfree_rcu() operations")

Looks correct to me.

> > and that both patches deserve a cc:stable.  Please comfirm.

At least KASAN parts deserve it assuming people use KASAN for testing
and fuzzing.

> I was not sure if a new KUnit test deserved it, but I have no
> strong opinion, and I'm fine with that.

-- 
Cheers,
Harry / Hyeonggon