Re: [PATCH v2] mm/slub: fix lost local objects when bulk remote free batch fills

[Harry Yoo <harry@kernel.org>]

[-- Attachment #1.1: Type: text/plain, Size: 2792 bytes --]



On 7/7/26 6:27 PM, Vlastimil Babka (SUSE) wrote:
> On 7/6/26 15:39, hu.shengming@zte.com.cn wrote:
>> From: Shengming Hu <hu.shengming@zte.com.cn>
>>
>> In free_to_pcs_bulk(), when remote_objects[] fills to PCS_BATCH_MAX,
>> the code jumps to flush_remote to free the batch. If all remote entries
>> have already been compacted out of p[] via tail swaps while local objects
>> remain, the flush_remote path returns early since `i < size` no longer
>> holds. The leftover local objects are then neither cached in the sheaf 
>> nor returned to the slab freelist, causing a memory leak.
>>
>> For illustration:
>>  size = 64, local objects at p[0..31], remote objects at p[32..63]
>>  After scanning all remotes: i = 32, size = 32
>>  p[0..31] local objects are dropped.
>>
>> Harry pointed out that, although the logic contains a real leak, it does
>> not appear to be triggerable with the current in-tree users. To hit this
>> path, at least PCS_BATCH_MAX objects, currently hardcoded to 32, need to
>> be collected in remote_objects[]. Looking at current kmem_cache_free_bulk()
>> users:
>>
>> * maple_node has sheaf_capacity = 32
>> * skbuff_head_cache has sheaf_capacity = 28
>> * panthor and msm drivers have sheaf_capacity = 4
>>
>> The sheaf capacity is, at least for now, derived purely from the object
>> size, with the user-requested capacity used as a minimum. Therefore, among
>> the current users, only maple_node has a sheaf_capacity large enough to
>> reach PCS_BATCH_MAX.
>>
>> However, for the bug to trigger in maple_node, all objects in the sheaf
>> would have to be from remote nodes. In that case, there would be no local
>> objects left to leak. So this issue was found by code review rather than
>> from a runtime report, and it does not seem to be triggerable by current
>> users.
>>
>> Still, the bug could become reachable with future users, a different sheaf
>> capacity, or a change to PCS_BATCH_MAX. Fix the logic by freeing a full
>> remote batch in place during the scan and then continuing to process the
>> compacted array. This keeps all local objects on the normal fast path,
>> while the tail path only handles any leftover partial remote batch. The
>> redundant next_remote_batch jump label is removed as well.
>>
>> Fixes: <989b09b73978>("slab: skip percpu sheaves for remote object freeing")
> 
> Removed the < >
> 
>> Signed-off-by: Shengming Hu <hu.shengming@zte.com.cn>
> 
> Thanks! I added cc: stable anyway so we avoid unexpected surprises in case
> something else is backported there that exposes the bug. And the fix is
> small enough.

Ack.

> Merged to slab/for-next-fixes
> 
>> ---

Reviewed-by: Harry Yoo (Oracle) <harry@kernel.org>

Thanks!

-- 
Cheers,
Harry / Hyeonggon

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 228 bytes --]