Re: [syzbot] [mm?] [f2fs?] [exfat?] memory leak in __kfree_rcu_sheaf

[Harry Yoo <harry.yoo@oracle.com>]

On Wed, Mar 11, 2026 at 06:48:55PM +0800, Qing Wang wrote:
> #syz test
> 
> diff --git a/mm/slub.c b/mm/slub.c
> index 20cb4f3b636d..73b2cfd0e123 100644
> --- a/mm/slub.c
> +++ b/mm/slub.c
> @@ -2797,6 +2797,7 @@ static void free_empty_sheaf(struct kmem_cache *s, struct slab_sheaf *sheaf)
>  	if (s->flags & SLAB_KMALLOC)
>  		mark_obj_codetag_empty(sheaf);
>  
> +	WARN_ON(sheaf->size > 0);
>  	kfree(sheaf);
>  
>  	stat(s, SHEAF_FREE);
> @@ -2828,6 +2829,7 @@ static int refill_sheaf(struct kmem_cache *s, struct slab_sheaf *sheaf,
>  	return 0;
>  }
>  
> +static void sheaf_flush_unused(struct kmem_cache *s, struct slab_sheaf *sheaf);
>  
>  static struct slab_sheaf *alloc_full_sheaf(struct kmem_cache *s, gfp_t gfp)
>  {
> @@ -2837,6 +2839,7 @@ static struct slab_sheaf *alloc_full_sheaf(struct kmem_cache *s, gfp_t gfp)
>  		return NULL;
>  
>  	if (refill_sheaf(s, sheaf, gfp | __GFP_NOMEMALLOC | __GFP_NOWARN)) {
> +		sheaf_flush_unused(s, sheaf);
>  		free_empty_sheaf(s, sheaf);
>  		return NULL;
>  	}
> @@ -4623,6 +4626,7 @@ __pcs_replace_empty_main(struct kmem_cache *s, struct slub_percpu_sheaves *pcs,
>  			 * we must be very low on memory so don't bother
>  			 * with the barn
>  			 */
> +			sheaf_flush_unused(s, empty);
>  			free_empty_sheaf(s, empty);
>  		}
>  	} else {

This won't fix any kmemleak reports because kmemleak couldn't detect this
in the first place. kmemleak doesn't know that those objects exist
until they are allocated and kmemleak_alloc() is called for them.

-- 
Cheers,
Harry / Hyeonggon