Re: [PATCH] mm: shrinker: fix double-free in alloc_shrinker_info error path

[kernel test robot <lkp@intel.com>]

Hi Hongling,

kernel test robot noticed the following build warnings:

[auto build test WARNING on v7.2-rc2]
[cannot apply to akpm-mm/mm-everything linus/master next-20260710]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Hongling-Zeng/mm-shrinker-fix-double-free-in-alloc_shrinker_info-error-path/20260711-122040
base:   v7.2-rc2
patch link:    https://lore.kernel.org/r/20260711041823.95135-1-zenghongling%40kylinos.cn
patch subject: [PATCH] mm: shrinker: fix double-free in alloc_shrinker_info error path
config: nios2-allmodconfig (https://download.01.org/0day-ci/archive/20260711/202607111736.7pLPe0yR-lkp@intel.com/config)
compiler: nios2-linux-gcc (GCC) 11.5.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260711/202607111736.7pLPe0yR-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202607111736.7pLPe0yR-lkp@intel.com/

All warnings (new ones prefixed by >>):

   mm/shrinker.c: In function 'alloc_shrinker_info':
   mm/shrinker.c:108:24: error: implicit declaration of function 'shrinker_info_protected' [-Werror=implicit-function-declaration]
     108 |                 info = shrinker_info_protected(memcg, nid);
         |                        ^~~~~~~~~~~~~~~~~~~~~~~
>> mm/shrinker.c:108:22: warning: assignment to 'struct shrinker_info *' from 'int' makes pointer from integer without a cast [-Wint-conversion]
     108 |                 info = shrinker_info_protected(memcg, nid);
         |                      ^
   mm/shrinker.c: At top level:
   mm/shrinker.c:117:30: error: conflicting types for 'shrinker_info_protected'; have 'struct shrinker_info *(struct mem_cgroup *, int)'
     117 | static struct shrinker_info *shrinker_info_protected(struct mem_cgroup *memcg,
         |                              ^~~~~~~~~~~~~~~~~~~~~~~
   mm/shrinker.c:108:24: note: previous implicit declaration of 'shrinker_info_protected' with type 'int()'
     108 |                 info = shrinker_info_protected(memcg, nid);
         |                        ^~~~~~~~~~~~~~~~~~~~~~~
   cc1: some warnings being treated as errors


vim +108 mm/shrinker.c

    76	
    77	int alloc_shrinker_info(struct mem_cgroup *memcg)
    78	{
    79		int nid, ret = 0;
    80		int array_size = 0;
    81		int failed_nid;
    82	
    83		mutex_lock(&shrinker_mutex);
    84		array_size = shrinker_unit_size(shrinker_nr_max);
    85		for_each_node(nid) {
    86			struct shrinker_info *info = kvzalloc_node(sizeof(*info) + array_size,
    87								   GFP_KERNEL, nid);
    88			if (!info)
    89				goto err;
    90			info->map_nr_max = shrinker_nr_max;
    91			if (shrinker_unit_alloc(info, NULL, nid)) {
    92				kvfree(info);
    93				goto err;
    94			}
    95			rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_info, info);
    96		}
    97		mutex_unlock(&shrinker_mutex);
    98	
    99		return ret;
   100	
   101	err:
   102		failed_nid = nid;
   103		for_each_node(nid) {
   104			struct shrinker_info *info;
   105	
   106			if (nid >= failed_nid)
   107				break;
 > 108			info = shrinker_info_protected(memcg, nid);
   109			rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_info, NULL);
   110			shrinker_unit_free(info, 0);
   111			kvfree(info);
   112		}
   113		mutex_unlock(&shrinker_mutex);
   114		return -ENOMEM;
   115	}
   116	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki