From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8BAD3C43219 for ; Mon, 25 Oct 2021 19:27:40 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7751A6115A for ; Mon, 25 Oct 2021 19:27:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235437AbhJYT35 (ORCPT ); Mon, 25 Oct 2021 15:29:57 -0400 Received: from mail.kernel.org ([198.145.29.99]:45600 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235669AbhJYT26 (ORCPT ); Mon, 25 Oct 2021 15:28:58 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 9615D610A0; Mon, 25 Oct 2021 19:25:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1635189941; bh=AbZLSRwlqgRD75tPmJv027h81lparaNy+HNNTI/GWrk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TENVy0q7g2ehDcuNk2/kNTlXIedDyJSEELxI9JbYYtlU29DduNtRE7PeGZloRk5mI nghVB8Yx9R7koEe5ScRpNz36MGelrqqu5o2idQpx6s2WghZtJeJWZJDLYWcQagR5ux VtfgL2kGLahvqwdHTOwb6mk3TTPK6IXi1z/8H958= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaohe Lin , Vlastimil Babka , Andrey Konovalov , Andrey Ryabinin , Bharata B Rao , Christoph Lameter , David Rientjes , Faiyaz Mohammed , Joonsoo Kim , Kees Cook , Pekka Enberg , Roman Gushchin , Andrew Morton , Linus Torvalds Subject: [PATCH 4.19 22/37] mm, slub: fix mismatch between reconstructed freelist depth and cnt Date: Mon, 25 Oct 2021 21:14:47 +0200 Message-Id: <20211025190932.732192691@linuxfoundation.org> X-Mailer: git-send-email 2.33.1 In-Reply-To: <20211025190926.680827862@linuxfoundation.org> References: <20211025190926.680827862@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Miaohe Lin commit 899447f669da76cc3605665e1a95ee877bc464cc upstream. If object's reuse is delayed, it will be excluded from the reconstructed freelist. But we forgot to adjust the cnt accordingly. So there will be a mismatch between reconstructed freelist depth and cnt. This will lead to free_debug_processing() complaining about freelist count or a incorrect slub inuse count. Link: https://lkml.kernel.org/r/20210916123920.48704-3-linmiaohe@huawei.com Fixes: c3895391df38 ("kasan, slub: fix handling of kasan_slab_free hook") Signed-off-by: Miaohe Lin Reviewed-by: Vlastimil Babka Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Bharata B Rao Cc: Christoph Lameter Cc: David Rientjes Cc: Faiyaz Mohammed Cc: Greg Kroah-Hartman Cc: Joonsoo Kim Cc: Kees Cook Cc: Pekka Enberg Cc: Roman Gushchin Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- mm/slub.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) --- a/mm/slub.c +++ b/mm/slub.c @@ -1392,7 +1392,8 @@ static __always_inline bool slab_free_ho } static inline bool slab_free_freelist_hook(struct kmem_cache *s, - void **head, void **tail) + void **head, void **tail, + int *cnt) { /* * Compiler cannot detect this function can be removed if slab_free_hook() @@ -1421,6 +1422,12 @@ static inline bool slab_free_freelist_ho *head = object; if (!*tail) *tail = object; + } else { + /* + * Adjust the reconstructed freelist depth + * accordingly if object's reuse is delayed. + */ + --(*cnt); } } while (object != old_tail); @@ -2988,7 +2995,7 @@ static __always_inline void slab_free(st * With KASAN enabled slab_free_freelist_hook modifies the freelist * to remove objects, whose reuse must be delayed. */ - if (slab_free_freelist_hook(s, &head, &tail)) + if (slab_free_freelist_hook(s, &head, &tail, &cnt)) do_slab_free(s, page, head, tail, cnt, addr); }