Re: [PATCH] mm: shrinker: Fix double-free in alloc_shrinker_info error path

[Qi Zheng <qi.zheng@linux.dev>]

Hi Hongling,

On 7/11/26 12:19 PM, Hongling Zeng wrote:
> In alloc_shrinker_info(), when shrinker_unit_alloc() fails for a node,
> the error handler calls free_shrinker_info() which iterates over ALL
> nodes and tries to free their shrinker_info. For the failed node,
> rcu_assign_pointer() was skipped, so its shrinker_info still points
> to old data. This causes double-free of valid shrinker_info structures.

No, it will be NULL, not old data. Therefore, the double-free you
mentioned doesn't exist. Before sending the fix, please verify the
problem exists and your fix actually works.

And as a reminder, please don't repeatedly send identical patches:

1. 
https://lore.kernel.org/all/20260711041509.92926-1-zenghongling@kylinos.cn/
2. 
https://lore.kernel.org/all/20260711041823.95135-1-zenghongling@kylinos.cn/
3. 
https://lore.kernel.org/all/20260711041954.95749-1-zenghongling@kylinos.cn/

One last thing, please make sure to base your changes on the latest
tree.

Thanks,
Qi

> 
> Fix by tracking which node failed and only freeing shrinker_info
> structures that were successfully assigned via rcu_assign_pointer()
> in this call. Failed/unhandled nodes are left untouched.
> 
> Fixes: 15e8156713cc ("mm: shrinker: avoid memleak in alloc_shrinker_info")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
> ---
>   mm/shrinker.c | 13 ++++++++++++-
>   1 file changed, 12 insertions(+), 1 deletion(-)
> 
> diff --git a/mm/shrinker.c b/mm/shrinker.c
> index 7082d01c8c9d..92c6cb455fc9 100644
> --- a/mm/shrinker.c
> +++ b/mm/shrinker.c
> @@ -78,6 +78,7 @@ int alloc_shrinker_info(struct mem_cgroup *memcg)
>   {
>   	int nid, ret = 0;
>   	int array_size = 0;
> +	int failed_nid;
>   
>   	mutex_lock(&shrinker_mutex);
>   	array_size = shrinker_unit_size(shrinker_nr_max);
> @@ -98,8 +99,18 @@ int alloc_shrinker_info(struct mem_cgroup *memcg)
>   	return ret;
>   
>   err:
> +	failed_nid = nid;
> +	for_each_node(nid) {
> +		struct shrinker_info *info;
> +
> +		if (nid >= failed_nid)
> +			break;
> +		info = shrinker_info_protected(memcg, nid);
> +		rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_info, NULL);
> +		shrinker_unit_free(info, 0);
> +		kvfree(info);
> +	}
>   	mutex_unlock(&shrinker_mutex);
> -	free_shrinker_info(memcg);
>   	return -ENOMEM;
>   }
>