Re: [PATCH] mm: shrinker: Fix double-free in alloc_shrinker_info error path

[Hongling Zeng <zhongling0719@126.com>]

在 2026年07月11日 13:31, Qi Zheng 写道:
> Hi Hongling,
>
> On 7/11/26 12:19 PM, Hongling Zeng wrote:
>> In alloc_shrinker_info(), when shrinker_unit_alloc() fails for a node,
>> the error handler calls free_shrinker_info() which iterates over ALL
>> nodes and tries to free their shrinker_info. For the failed node,
>> rcu_assign_pointer() was skipped, so its shrinker_info still points
>> to old data. This causes double-free of valid shrinker_info structures.
>
> No, it will be NULL, not old data. Therefore, the double-free you
> mentioned doesn't exist. Before sending the fix, please verify the
> problem exists and your fix actually works.
>
  Sorry, You're absolutely right. After carefully re-examining the code, 
I now see that:
   1. alloc_mem_cgroup_per_node_info() allocates with __GFP_ZERO, so 
shrinker_info is initialized to NULL, not old data
   2. The error handler in alloc_shrinker_info() correctly bounds 
cleanup with if (nid >= failed_nid) break;, so it only frees 
successfully allocated structures
   My analysis was incorrect - there is no double-free issue in this 
code path, I apologize for submitting this patch without proper 
verification.
> And as a reminder, please don't repeatedly send identical patches:
>
> 1. 
> https://lore.kernel.org/all/20260711041509.92926-1-zenghongling@kylinos.cn/
> 2. 
> https://lore.kernel.org/all/20260711041823.95135-1-zenghongling@kylinos.cn/
> 3. 
> https://lore.kernel.org/all/20260711041954.95749-1-zenghongling@kylinos.cn/
>
> One last thing, please make sure to base your changes on the latest
> tree.
>
> Thanks,
> Qi
I also apologize for the multiple identical submissions ，my email 
client was reporting errors when sending, so I retried thinking the 
emails weren't going through。
>
>>
>> Fix by tracking which node failed and only freeing shrinker_info
>> structures that were successfully assigned via rcu_assign_pointer()
>> in this call. Failed/unhandled nodes are left untouched.
>>
>> Fixes: 15e8156713cc ("mm: shrinker: avoid memleak in 
>> alloc_shrinker_info")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
>> ---
>>   mm/shrinker.c | 13 ++++++++++++-
>>   1 file changed, 12 insertions(+), 1 deletion(-)
>>
>> diff --git a/mm/shrinker.c b/mm/shrinker.c
>> index 7082d01c8c9d..92c6cb455fc9 100644
>> --- a/mm/shrinker.c
>> +++ b/mm/shrinker.c
>> @@ -78,6 +78,7 @@ int alloc_shrinker_info(struct mem_cgroup *memcg)
>>   {
>>       int nid, ret = 0;
>>       int array_size = 0;
>> +    int failed_nid;
>>         mutex_lock(&shrinker_mutex);
>>       array_size = shrinker_unit_size(shrinker_nr_max);
>> @@ -98,8 +99,18 @@ int alloc_shrinker_info(struct mem_cgroup *memcg)
>>       return ret;
>>     err:
>> +    failed_nid = nid;
>> +    for_each_node(nid) {
>> +        struct shrinker_info *info;
>> +
>> +        if (nid >= failed_nid)
>> +            break;
>> +        info = shrinker_info_protected(memcg, nid);
>> + rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_info, NULL);
>> +        shrinker_unit_free(info, 0);
>> +        kvfree(info);
>> +    }
>>       mutex_unlock(&shrinker_mutex);
>> -    free_shrinker_info(memcg);
>>       return -ENOMEM;
>>   }