[PATCH] mm: shrinker: fix double-free in alloc_shrinker_info error path

[PATCH] mm: shrinker: fix double-free in alloc_shrinker_info error path

[Hongling Zeng]

In alloc_shrinker_info(), when shrinker_unit_alloc() fails for a node,
the error handler calls free_shrinker_info() which iterates over ALL
nodes and tries to free their shrinker_info. For the failed node,
rcu_assign_pointer() was skipped, so its shrinker_info still points
to old data. This causes double-free of valid shrinker_info structures.

Fix by tracking which node failed and only freeing shrinker_info
structures that were successfully assigned via rcu_assign_pointer()
in this call. Failed/unhandled nodes are left untouched.

Fixes: 4a3ec379aa21 ("mm: shrinker: make shrinker tracking memcg aware")
Cc: stable@vger.kernel.org
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
---
 mm/shrinker.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/mm/shrinker.c b/mm/shrinker.c
index 7082d01c8c9d..92c6cb455fc9 100644
--- a/mm/shrinker.c
+++ b/mm/shrinker.c
@@ -78,6 +78,7 @@ int alloc_shrinker_info(struct mem_cgroup *memcg)
 {
 	int nid, ret = 0;
 	int array_size = 0;
+	int failed_nid;
 
 	mutex_lock(&shrinker_mutex);
 	array_size = shrinker_unit_size(shrinker_nr_max);
@@ -98,8 +99,18 @@ int alloc_shrinker_info(struct mem_cgroup *memcg)
 	return ret;
 
 err:
+	failed_nid = nid;
+	for_each_node(nid) {
+		struct shrinker_info *info;
+
+		if (nid >= failed_nid)
+			break;
+		info = shrinker_info_protected(memcg, nid);
+		rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_info, NULL);
+		shrinker_unit_free(info, 0);
+		kvfree(info);
+	}
 	mutex_unlock(&shrinker_mutex);
-	free_shrinker_info(memcg);
 	return -ENOMEM;
 }
 
-- 
2.25.1

[PATCH] mm: shrinker: fix double-free in alloc_shrinker_info error path

[Hongling Zeng]

In alloc_shrinker_info(), when shrinker_unit_alloc() fails for a node,
the error handler calls free_shrinker_info() which iterates over ALL
nodes and tries to free their shrinker_info. For the failed node,
rcu_assign_pointer() was skipped, so its shrinker_info still points
to old data. This causes double-free of valid shrinker_info structures.

Fix by tracking which node failed and only freeing shrinker_info
structures that were successfully assigned via rcu_assign_pointer()
in this call. Failed/unhandled nodes are left untouched.

Fixes: 4a3ec379aa21 ("mm: shrinker: make shrinker tracking memcg aware")
Cc: stable@vger.kernel.org
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
---
 mm/shrinker.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/mm/shrinker.c b/mm/shrinker.c
index 7082d01c8c9d..92c6cb455fc9 100644
--- a/mm/shrinker.c
+++ b/mm/shrinker.c
@@ -78,6 +78,7 @@ int alloc_shrinker_info(struct mem_cgroup *memcg)
 {
 	int nid, ret = 0;
 	int array_size = 0;
+	int failed_nid;
 
 	mutex_lock(&shrinker_mutex);
 	array_size = shrinker_unit_size(shrinker_nr_max);
@@ -98,8 +99,18 @@ int alloc_shrinker_info(struct mem_cgroup *memcg)
 	return ret;
 
 err:
+	failed_nid = nid;
+	for_each_node(nid) {
+		struct shrinker_info *info;
+
+		if (nid >= failed_nid)
+			break;
+		info = shrinker_info_protected(memcg, nid);
+		rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_info, NULL);
+		shrinker_unit_free(info, 0);
+		kvfree(info);
+	}
 	mutex_unlock(&shrinker_mutex);
-	free_shrinker_info(memcg);
 	return -ENOMEM;
 }
 
-- 
2.25.1

[PATCH] mm: shrinker: Fix double-free in alloc_shrinker_info error path

[Hongling Zeng]

In alloc_shrinker_info(), when shrinker_unit_alloc() fails for a node,
the error handler calls free_shrinker_info() which iterates over ALL
nodes and tries to free their shrinker_info. For the failed node,
rcu_assign_pointer() was skipped, so its shrinker_info still points
to old data. This causes double-free of valid shrinker_info structures.

Fix by tracking which node failed and only freeing shrinker_info
structures that were successfully assigned via rcu_assign_pointer()
in this call. Failed/unhandled nodes are left untouched.

Fixes: 15e8156713cc ("mm: shrinker: avoid memleak in alloc_shrinker_info")
Cc: stable@vger.kernel.org
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
---
 mm/shrinker.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/mm/shrinker.c b/mm/shrinker.c
index 7082d01c8c9d..92c6cb455fc9 100644
--- a/mm/shrinker.c
+++ b/mm/shrinker.c
@@ -78,6 +78,7 @@ int alloc_shrinker_info(struct mem_cgroup *memcg)
 {
 	int nid, ret = 0;
 	int array_size = 0;
+	int failed_nid;
 
 	mutex_lock(&shrinker_mutex);
 	array_size = shrinker_unit_size(shrinker_nr_max);
@@ -98,8 +99,18 @@ int alloc_shrinker_info(struct mem_cgroup *memcg)
 	return ret;
 
 err:
+	failed_nid = nid;
+	for_each_node(nid) {
+		struct shrinker_info *info;
+
+		if (nid >= failed_nid)
+			break;
+		info = shrinker_info_protected(memcg, nid);
+		rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_info, NULL);
+		shrinker_unit_free(info, 0);
+		kvfree(info);
+	}
 	mutex_unlock(&shrinker_mutex);
-	free_shrinker_info(memcg);
 	return -ENOMEM;
 }
 
-- 
2.25.1

Re: [PATCH] mm: shrinker: Fix double-free in alloc_shrinker_info error path

[Qi Zheng]

Hi Hongling,

On 7/11/26 12:19 PM, Hongling Zeng wrote:
> In alloc_shrinker_info(), when shrinker_unit_alloc() fails for a node,
> the error handler calls free_shrinker_info() which iterates over ALL
> nodes and tries to free their shrinker_info. For the failed node,
> rcu_assign_pointer() was skipped, so its shrinker_info still points
> to old data. This causes double-free of valid shrinker_info structures.

No, it will be NULL, not old data. Therefore, the double-free you
mentioned doesn't exist. Before sending the fix, please verify the
problem exists and your fix actually works.

And as a reminder, please don't repeatedly send identical patches:

1. 
https://lore.kernel.org/all/20260711041509.92926-1-zenghongling@kylinos.cn/
2. 
https://lore.kernel.org/all/20260711041823.95135-1-zenghongling@kylinos.cn/
3. 
https://lore.kernel.org/all/20260711041954.95749-1-zenghongling@kylinos.cn/

One last thing, please make sure to base your changes on the latest
tree.

Thanks,
Qi

> 
> Fix by tracking which node failed and only freeing shrinker_info
> structures that were successfully assigned via rcu_assign_pointer()
> in this call. Failed/unhandled nodes are left untouched.
> 
> Fixes: 15e8156713cc ("mm: shrinker: avoid memleak in alloc_shrinker_info")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
> ---
>   mm/shrinker.c | 13 ++++++++++++-
>   1 file changed, 12 insertions(+), 1 deletion(-)
> 
> diff --git a/mm/shrinker.c b/mm/shrinker.c
> index 7082d01c8c9d..92c6cb455fc9 100644
> --- a/mm/shrinker.c
> +++ b/mm/shrinker.c
> @@ -78,6 +78,7 @@ int alloc_shrinker_info(struct mem_cgroup *memcg)
>   {
>   	int nid, ret = 0;
>   	int array_size = 0;
> +	int failed_nid;
>   
>   	mutex_lock(&shrinker_mutex);
>   	array_size = shrinker_unit_size(shrinker_nr_max);
> @@ -98,8 +99,18 @@ int alloc_shrinker_info(struct mem_cgroup *memcg)
>   	return ret;
>   
>   err:
> +	failed_nid = nid;
> +	for_each_node(nid) {
> +		struct shrinker_info *info;
> +
> +		if (nid >= failed_nid)
> +			break;
> +		info = shrinker_info_protected(memcg, nid);
> +		rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_info, NULL);
> +		shrinker_unit_free(info, 0);
> +		kvfree(info);
> +	}
>   	mutex_unlock(&shrinker_mutex);
> -	free_shrinker_info(memcg);
>   	return -ENOMEM;
>   }
>   

Re: [PATCH] mm: shrinker: Fix double-free in alloc_shrinker_info error path

[Hongling Zeng]

在 2026年07月11日 13:31, Qi Zheng 写道:
> Hi Hongling,
>
> On 7/11/26 12:19 PM, Hongling Zeng wrote:
>> In alloc_shrinker_info(), when shrinker_unit_alloc() fails for a node,
>> the error handler calls free_shrinker_info() which iterates over ALL
>> nodes and tries to free their shrinker_info. For the failed node,
>> rcu_assign_pointer() was skipped, so its shrinker_info still points
>> to old data. This causes double-free of valid shrinker_info structures.
>
> No, it will be NULL, not old data. Therefore, the double-free you
> mentioned doesn't exist. Before sending the fix, please verify the
> problem exists and your fix actually works.
>
  Sorry, You're absolutely right. After carefully re-examining the code, 
I now see that:
   1. alloc_mem_cgroup_per_node_info() allocates with __GFP_ZERO, so 
shrinker_info is initialized to NULL, not old data
   2. The error handler in alloc_shrinker_info() correctly bounds 
cleanup with if (nid >= failed_nid) break;, so it only frees 
successfully allocated structures
   My analysis was incorrect - there is no double-free issue in this 
code path, I apologize for submitting this patch without proper 
verification.
> And as a reminder, please don't repeatedly send identical patches:
>
> 1. 
> https://lore.kernel.org/all/20260711041509.92926-1-zenghongling@kylinos.cn/
> 2. 
> https://lore.kernel.org/all/20260711041823.95135-1-zenghongling@kylinos.cn/
> 3. 
> https://lore.kernel.org/all/20260711041954.95749-1-zenghongling@kylinos.cn/
>
> One last thing, please make sure to base your changes on the latest
> tree.
>
> Thanks,
> Qi
I also apologize for the multiple identical submissions ，my email 
client was reporting errors when sending, so I retried thinking the 
emails weren't going through。
>
>>
>> Fix by tracking which node failed and only freeing shrinker_info
>> structures that were successfully assigned via rcu_assign_pointer()
>> in this call. Failed/unhandled nodes are left untouched.
>>
>> Fixes: 15e8156713cc ("mm: shrinker: avoid memleak in 
>> alloc_shrinker_info")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
>> ---
>>   mm/shrinker.c | 13 ++++++++++++-
>>   1 file changed, 12 insertions(+), 1 deletion(-)
>>
>> diff --git a/mm/shrinker.c b/mm/shrinker.c
>> index 7082d01c8c9d..92c6cb455fc9 100644
>> --- a/mm/shrinker.c
>> +++ b/mm/shrinker.c
>> @@ -78,6 +78,7 @@ int alloc_shrinker_info(struct mem_cgroup *memcg)
>>   {
>>       int nid, ret = 0;
>>       int array_size = 0;
>> +    int failed_nid;
>>         mutex_lock(&shrinker_mutex);
>>       array_size = shrinker_unit_size(shrinker_nr_max);
>> @@ -98,8 +99,18 @@ int alloc_shrinker_info(struct mem_cgroup *memcg)
>>       return ret;
>>     err:
>> +    failed_nid = nid;
>> +    for_each_node(nid) {
>> +        struct shrinker_info *info;
>> +
>> +        if (nid >= failed_nid)
>> +            break;
>> +        info = shrinker_info_protected(memcg, nid);
>> + rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_info, NULL);
>> +        shrinker_unit_free(info, 0);
>> +        kvfree(info);
>> +    }
>>       mutex_unlock(&shrinker_mutex);
>> -    free_shrinker_info(memcg);
>>       return -ENOMEM;
>>   }

Re: [PATCH] mm: shrinker: fix double-free in alloc_shrinker_info error path

[kernel test robot]

Hi Hongling,

kernel test robot noticed the following build warnings:

[auto build test WARNING on v7.2-rc2]
[cannot apply to akpm-mm/mm-everything linus/master next-20260710]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Hongling-Zeng/mm-shrinker-fix-double-free-in-alloc_shrinker_info-error-path/20260711-122040
base:   v7.2-rc2
patch link:    https://lore.kernel.org/r/20260711041823.95135-1-zenghongling%40kylinos.cn
patch subject: [PATCH] mm: shrinker: fix double-free in alloc_shrinker_info error path
config: nios2-allmodconfig (https://download.01.org/0day-ci/archive/20260711/202607111736.7pLPe0yR-lkp@intel.com/config)
compiler: nios2-linux-gcc (GCC) 11.5.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260711/202607111736.7pLPe0yR-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202607111736.7pLPe0yR-lkp@intel.com/

All warnings (new ones prefixed by >>):

   mm/shrinker.c: In function 'alloc_shrinker_info':
   mm/shrinker.c:108:24: error: implicit declaration of function 'shrinker_info_protected' [-Werror=implicit-function-declaration]
     108 |                 info = shrinker_info_protected(memcg, nid);
         |                        ^~~~~~~~~~~~~~~~~~~~~~~
>> mm/shrinker.c:108:22: warning: assignment to 'struct shrinker_info *' from 'int' makes pointer from integer without a cast [-Wint-conversion]
     108 |                 info = shrinker_info_protected(memcg, nid);
         |                      ^
   mm/shrinker.c: At top level:
   mm/shrinker.c:117:30: error: conflicting types for 'shrinker_info_protected'; have 'struct shrinker_info *(struct mem_cgroup *, int)'
     117 | static struct shrinker_info *shrinker_info_protected(struct mem_cgroup *memcg,
         |                              ^~~~~~~~~~~~~~~~~~~~~~~
   mm/shrinker.c:108:24: note: previous implicit declaration of 'shrinker_info_protected' with type 'int()'
     108 |                 info = shrinker_info_protected(memcg, nid);
         |                        ^~~~~~~~~~~~~~~~~~~~~~~
   cc1: some warnings being treated as errors


vim +108 mm/shrinker.c

    76	
    77	int alloc_shrinker_info(struct mem_cgroup *memcg)
    78	{
    79		int nid, ret = 0;
    80		int array_size = 0;
    81		int failed_nid;
    82	
    83		mutex_lock(&shrinker_mutex);
    84		array_size = shrinker_unit_size(shrinker_nr_max);
    85		for_each_node(nid) {
    86			struct shrinker_info *info = kvzalloc_node(sizeof(*info) + array_size,
    87								   GFP_KERNEL, nid);
    88			if (!info)
    89				goto err;
    90			info->map_nr_max = shrinker_nr_max;
    91			if (shrinker_unit_alloc(info, NULL, nid)) {
    92				kvfree(info);
    93				goto err;
    94			}
    95			rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_info, info);
    96		}
    97		mutex_unlock(&shrinker_mutex);
    98	
    99		return ret;
   100	
   101	err:
   102		failed_nid = nid;
   103		for_each_node(nid) {
   104			struct shrinker_info *info;
   105	
   106			if (nid >= failed_nid)
   107				break;
 > 108			info = shrinker_info_protected(memcg, nid);
   109			rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_info, NULL);
   110			shrinker_unit_free(info, 0);
   111			kvfree(info);
   112		}
   113		mutex_unlock(&shrinker_mutex);
   114		return -ENOMEM;
   115	}
   116	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH] mm: shrinker: fix double-free in alloc_shrinker_info error path

[kernel test robot]

Hi Hongling,

kernel test robot noticed the following build errors:

[auto build test ERROR on v7.2-rc2]
[cannot apply to akpm-mm/mm-everything linus/master next-20260710]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Hongling-Zeng/mm-shrinker-fix-double-free-in-alloc_shrinker_info-error-path/20260711-122040
base:   v7.2-rc2
patch link:    https://lore.kernel.org/r/20260711041823.95135-1-zenghongling%40kylinos.cn
patch subject: [PATCH] mm: shrinker: fix double-free in alloc_shrinker_info error path
config: x86_64-kexec (https://download.01.org/0day-ci/archive/20260711/202607111559.uTGMAUhC-lkp@intel.com/config)
compiler: clang version 22.1.8 (https://github.com/llvm/llvm-project ca7933e47d3a3451d81e72ac174dcb5aa28b59d1)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260711/202607111559.uTGMAUhC-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202607111559.uTGMAUhC-lkp@intel.com/

All errors (new ones prefixed by >>):

>> mm/shrinker.c:108:10: error: call to undeclared function 'shrinker_info_protected'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
     108 |                 info = shrinker_info_protected(memcg, nid);
         |                        ^
>> mm/shrinker.c:108:8: error: incompatible integer to pointer conversion assigning to 'struct shrinker_info *' from 'int' [-Wint-conversion]
     108 |                 info = shrinker_info_protected(memcg, nid);
         |                      ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> mm/shrinker.c:117:30: error: conflicting types for 'shrinker_info_protected'
     117 | static struct shrinker_info *shrinker_info_protected(struct mem_cgroup *memcg,
         |                              ^
   mm/shrinker.c:108:10: note: previous implicit declaration is here
     108 |                 info = shrinker_info_protected(memcg, nid);
         |                        ^
   3 errors generated.


vim +/shrinker_info_protected +108 mm/shrinker.c

    76	
    77	int alloc_shrinker_info(struct mem_cgroup *memcg)
    78	{
    79		int nid, ret = 0;
    80		int array_size = 0;
    81		int failed_nid;
    82	
    83		mutex_lock(&shrinker_mutex);
    84		array_size = shrinker_unit_size(shrinker_nr_max);
    85		for_each_node(nid) {
    86			struct shrinker_info *info = kvzalloc_node(sizeof(*info) + array_size,
    87								   GFP_KERNEL, nid);
    88			if (!info)
    89				goto err;
    90			info->map_nr_max = shrinker_nr_max;
    91			if (shrinker_unit_alloc(info, NULL, nid)) {
    92				kvfree(info);
    93				goto err;
    94			}
    95			rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_info, info);
    96		}
    97		mutex_unlock(&shrinker_mutex);
    98	
    99		return ret;
   100	
   101	err:
   102		failed_nid = nid;
   103		for_each_node(nid) {
   104			struct shrinker_info *info;
   105	
   106			if (nid >= failed_nid)
   107				break;
 > 108			info = shrinker_info_protected(memcg, nid);
   109			rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_info, NULL);
   110			shrinker_unit_free(info, 0);
   111			kvfree(info);
   112		}
   113		mutex_unlock(&shrinker_mutex);
   114		return -ENOMEM;
   115	}
   116	
 > 117	static struct shrinker_info *shrinker_info_protected(struct mem_cgroup *memcg,
   118							     int nid)
   119	{
   120		return rcu_dereference_protected(memcg->nodeinfo[nid]->shrinker_info,
   121						 lockdep_is_held(&shrinker_mutex));
   122	}
   123	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki