Re: [PATCH v3 02/10] kasan, kunit: pin test slabs by an extra allocation

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] kasan: kunit: unbalanced migrate_disable() in kmem_cache_rcu_reuse()
--

commit 9889dce92c4935230b2785629413456302c4d31c
Author: Vlastimil Babka (SUSE) <vbabka@kernel.org>

kasan, kunit: pin test slabs by an extra allocation

This commit adds an extra object allocation to kmem_cache_double_free() and
kmem_cache_rcu_reuse() in mm/kasan/kasan_test_c.c to keep the test slab from
being freed when s->min_partial is zero.

> diff --git a/mm/kasan/kasan_test_c.c b/mm/kasan/kasan_test_c.c
> index b9e167ed5be32..580a9bf007ec4 100644
> --- a/mm/kasan/kasan_test_c.c
> +++ b/mm/kasan/kasan_test_c.c

[ ... ]

> @@ -1152,7 +1160,7 @@ static void kmem_cache_rcu_uaf(struct kunit *test)
>   */
>  static void kmem_cache_rcu_reuse(struct kunit *test)
>  {
> -	char *p, *p2;
> +	char *p, *p2, *pin;
>  	struct kmem_cache *cache;
>  
>  	KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_SLUB_RCU_DEBUG);
> @@ -1162,6 +1170,12 @@ static void kmem_cache_rcu_reuse(struct kunit *test)
>  	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
>  
>  	migrate_disable();
> +	pin = kmem_cache_alloc(cache, GFP_KERNEL);
> +	if (!pin) {
> +		kunit_err(test, "Allocation failed: %s\n", __func__);
> +		goto destroy;
> +	}
> +
>  	p = kmem_cache_alloc(cache, GFP_KERNEL);
>  	if (!p) {
>  		kunit_err(test, "Allocation failed: %s\n", __func__);
> @@ -1178,8 +1192,12 @@ static void kmem_cache_rcu_reuse(struct kunit *test)
>  
>  	kmem_cache_free(cache, p2);
>  
> +
>  out:
>  	migrate_enable();
> +	kmem_cache_free(cache, pin);
> +
> +destroy:
>  	kmem_cache_destroy(cache);
>  }

[Severity: Medium]
If kmem_cache_alloc() for pin fails in kmem_cache_rcu_reuse(), jumping to the
destroy label skips migrate_enable(), leaving migration disabled when
kmem_cache_destroy() is called and after the function returns. Should
migrate_enable() be called under the destroy label, or before jumping to
destroy?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261105-slub_tiny_rework-v3-0-0484ce59eabb@kernel.org?part=2