Nicolas Bouchinet 8f828aa488 mm/slub: avoid zeroing outside-object freepointer for single free ... Commit 284f17ac13 ("mm/slub: handle bulk and single object freeing separately") splits single and bulk object freeing in two functions slab_free() and slab_free_bulk() which leads slab_free() to call slab_free_hook() directly instead of slab_free_freelist_hook(). If `init_on_free` is set, slab_free_hook() zeroes the object. Afterward, if `slub_debug=F` and `CONFIG_SLAB_FREELIST_HARDENED` are set, the do_slab_free() slowpath executes freelist consistency checks and try to decode a zeroed freepointer which leads to a "Freepointer corrupt" detection in check_object(). During bulk free, slab_free_freelist_hook() isn't affected as it always sets it objects freepointer using set_freepointer() to maintain its reconstructed freelist after `init_on_free`. For single free, object's freepointer thus needs to be avoided when stored outside the object if `init_on_free` is set. The freepointer left as is, check_object() may later detect an invalid pointer value due to objects overflow. To reproduce, set `slub_debug=FU init_on_free=1 log_level=7` on the command line of a kernel build with `CONFIG_SLAB_FREELIST_HARDENED=y`. dmesg sample log: [ 10.708715] ============================================================================= [ 10.710323] BUG kmalloc-rnd-05-32 (Tainted: G B T ): Freepointer corrupt [ 10.712695] ----------------------------------------------------------------------------- [ 10.712695] [ 10.712695] Slab 0xffffd8bdc400d580 objects=32 used=4 fp=0xffff9d9a80356f80 flags=0x200000000000a00(workingset|slab|node=0|zone=2) [ 10.716698] Object 0xffff9d9a80356600 @offset=1536 fp=0x7ee4f480ce0ecd7c [ 10.716698] [ 10.716698] Bytes b4 ffff9d9a803565f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 10.720703] Object ffff9d9a80356600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 10.720703] Object ffff9d9a80356610: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 10.724696] Padding ffff9d9a8035666c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 10.724696] Padding ffff9d9a8035667c: 00 00 00 00 .... [ 10.724696] FIX kmalloc-rnd-05-32: Object at 0xffff9d9a80356600 not freed Fixes: 284f17ac13 ("mm/slub: handle bulk and single object freeing separately") Cc: <stable@vger.kernel.org> Co-developed-by: Chengming Zhou <chengming.zhou@linux.dev> Signed-off-by: Chengming Zhou <chengming.zhou@linux.dev> Signed-off-by: Nicolas Bouchinet <nicolas.bouchinet@ssi.gouv.fr> Signed-off-by: Vlastimil Babka <vbabka@suse.cz>		2024-05-01 17:28:56 +02:00
..
damon	mm: madvise: pageout: ignore references rather than clearing young	2024-03-04 17:01:18 -08:00
kasan	- Sumanth Korikkar has taught s390 to allocate hotplug-time page frames	2024-03-14 17:43:30 -07:00
kfence	KFENCE: cleanup kfence_guarded_alloc() after CONFIG_SLAB removal	2023-12-05 11:17:58 +01:00
kmsan	mm: kmsan: remove runtime checks from kmsan_unpoison_memory()	2024-02-22 10:24:41 -08:00
backing-dev.c	vfs-6.9.misc	2024-03-11 09:38:17 -07:00
balloon_compaction.c
bootmem_info.c	bootmem: use kmemleak_free_part_phys in put_page_bootmem	2023-10-25 16:47:13 -07:00
cma_debug.c
cma_sysfs.c	mm/cma: add sysfs file 'release_pages_success'	2024-02-22 10:24:57 -08:00
cma.c	mm/cma: add sysfs file 'release_pages_success'	2024-02-22 10:24:57 -08:00
cma.h	mm/cma: add sysfs file 'release_pages_success'	2024-02-22 10:24:57 -08:00
compaction.c	- Sumanth Korikkar has taught s390 to allocate hotplug-time page frames	2024-03-14 17:43:30 -07:00
debug_page_alloc.c	mm, treewide: rename MAX_ORDER to MAX_PAGE_ORDER	2024-01-08 15:27:15 -08:00
debug_page_ref.c
debug_vm_pgtable.c	mm/debug_vm_pgtable: fix BUG_ON with pud advanced test	2024-02-23 17:27:13 -08:00
debug.c	mm: make dump_page() take a const argument	2024-03-06 13:04:18 -08:00
dmapool_test.c	dmapool: add alloc/free performance test	2023-04-05 19:42:38 -07:00
dmapool.c	mm/mempool/dmapool: remove CONFIG_DEBUG_SLAB ifdefs	2023-12-05 11:17:58 +01:00
early_ioremap.c	mm/early_ioremap.c: improve the execution efficiency of early_ioremap_setup()	2023-06-09 16:25:56 -07:00
fadvise.c	mm: remove unnecessary pagevec includes	2023-06-23 16:59:31 -07:00
fail_page_alloc.c	mm: page_alloc: split out FAIL_PAGE_ALLOC	2023-06-09 16:25:23 -07:00
failslab.c	mm: fix unexpected changes to {failslab|fail_page_alloc}.attr	2022-11-22 18:50:44 -08:00
filemap.c	mm: cachestat: fix two shmem bugs	2024-03-26 11:07:20 -07:00
folio-compat.c	mm: remove page_add_new_anon_rmap and lru_cache_add_inactive_or_unevictable	2023-12-29 11:58:27 -08:00
gup_test.c	Merge mm-hotfixes-stable into mm-stable to pick up depended-upon changes.	2023-06-23 16:58:19 -07:00
gup_test.h	mm/gup_test: start/stop/read functionality for PIN LONGTERM test	2022-11-08 17:37:15 -08:00
gup.c	mm/madvise: make MADV_POPULATE_(READ|WRITE) handle VM_FAULT_RETRY properly	2024-04-16 15:39:48 -07:00
highmem.c	x86/kexec: use pr_err() instead of kexec_dprintk() when an error occurs	2023-12-29 12:22:28 -08:00
hmm.c	mm: enable page walking API to lock vmas during the walk	2023-08-21 13:07:20 -07:00
huge_memory.c	userfaultfd: change src_folio after ensuring it's unpinned in UFFDIO_MOVE	2024-04-16 15:39:48 -07:00
hugetlb_cgroup.c	mm, hugetlb: remove HUGETLB_CGROUP_MIN_ORDER	2023-10-18 14:34:17 -07:00
hugetlb_vmemmap.c	mm: hugetlb_vmemmap: move mmap lock to vmemmap_remap_range()	2023-12-12 10:57:08 -08:00
hugetlb_vmemmap.h	mm: hugetlb_vmemmap: fix reference to nonexistent file	2023-10-25 16:47:14 -07:00
hugetlb.c	mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio()	2024-04-25 10:07:27 -07:00
hwpoison-inject.c
init-mm.c	mm: Deprecate pasid field	2023-12-12 10:11:32 +01:00
internal.h	mm/madvise: make MADV_POPULATE_(READ|WRITE) handle VM_FAULT_RETRY properly	2024-04-16 15:39:48 -07:00
interval_tree.c
io-mapping.c
ioremap.c	mm: ioremap: remove unneeded ioremap_allowed and iounmap_allowed	2023-08-18 10:12:36 -07:00
Kconfig	Kbuild updates for v6.9	2024-03-21 14:41:00 -07:00
Kconfig.debug	mm/slub: unify all sl[au]b parameters with "slab_$param"	2024-01-22 10:31:08 +01:00
khugepaged.c	mm: convert free_swap_cache() to take a folio	2024-03-04 17:01:26 -08:00
kmemleak.c	kmemleak: avoid RCU stalls when freeing metadata for per-CPU pointers	2023-12-12 10:57:07 -08:00
ksm.c	mm: convert page_try_share_anon_rmap() to folio_try_share_anon_rmap_[pte|pmd]()	2023-12-29 11:58:56 -08:00
list_lru.c	mm/zswap: stop lru list shrinking when encounter warm region	2024-02-22 10:24:54 -08:00
maccess.c	mm: Fix copy_from_user_nofault().	2023-04-12 17:36:23 -07:00
madvise.c	mm/madvise: make MADV_POPULATE_(READ|WRITE) handle VM_FAULT_RETRY properly	2024-04-16 15:39:48 -07:00
Makefile	kbuild: make -Woverride-init warnings more consistent	2024-03-31 11:32:26 +09:00
mapping_dirty_helpers.c	mm: fix clean_record_shared_mapping_range kernel-doc	2023-08-24 16:20:30 -07:00
memblock.c	cxl fixes for 6.8-rc6	2024-02-24 15:53:40 -08:00
memcontrol.c	memcg: remove mem_cgroup_uncharge_list()	2024-03-04 17:01:25 -08:00
memfd.c	mm/memfd: refactor memfd_tag_pins() and memfd_wait_for_pins()	2024-03-04 17:01:21 -08:00
memory_hotplug.c	mm/memory_hotplug: export mhp_supports_memmap_on_memory()	2024-02-22 10:24:40 -08:00
memory-failure.c	mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabled	2024-04-16 15:39:50 -07:00
memory-tiers.c	mm/demotion: print demotion targets	2024-02-22 10:24:55 -08:00
memory.c	x86/mm/pat: fix VM_PAT handling in COW mappings	2024-04-05 11:21:31 -07:00
mempolicy.c	mm/mempolicy: use a folio in do_mbind()	2024-03-06 13:04:18 -08:00
mempool.c	mempool: kvmalloc pool	2024-03-13 18:38:13 -04:00
memremap.c	mm: remove stale example from comment	2023-12-29 11:58:26 -08:00
memtest.c	memtest: use {READ,WRITE}_ONCE in memory scanning	2024-03-13 12:12:21 -07:00
migrate_device.c	mm: convert page_try_share_anon_rmap() to folio_try_share_anon_rmap_[pte|pmd]()	2023-12-29 11:58:56 -08:00
migrate.c	merge mm-hotfixes-stable into mm-nonmm-stable to pick up stackdepot changes	2024-02-23 17:28:43 -08:00
mincore.c	mm: enable page walking API to lock vmas during the walk	2023-08-21 13:07:20 -07:00
mlock.c	mm: make folios_put() the basis of release_pages()	2024-03-04 17:01:22 -08:00
mm_init.c	Author: Gang Li padata: dispatch works on	2024-03-06 13:04:17 -08:00
mm_slot.h
mmap_lock.c
mmap.c	RISC-V Patches for the 6.9 Merge Window	2024-03-22 10:41:13 -07:00
mmu_gather.c	mm/mmu_gather: improve cond_resched() handling with large folios and expensive page freeing	2024-02-22 15:27:17 -08:00
mmu_notifier.c	mmu_notifiers: rename invalidate_range notifier	2023-08-18 10:12:41 -07:00
mmzone.c	zswap: shrink zswap pool based on memory pressure	2023-12-12 10:57:02 -08:00
mprotect.c	mprotect: use pfn_swap_entry_folio	2024-02-21 16:00:03 -08:00
mremap.c	mm: abstract VMA merge and extend into vma_merge_extend() helper	2023-10-18 14:34:18 -07:00
msync.c
nommu.c	mm/vmalloc: remove vmap_area_list	2024-02-23 17:48:19 -08:00
oom_kill.c	mm: update mark_victim tracepoints fields	2024-03-04 17:01:16 -08:00
page_alloc.c	- Sumanth Korikkar has taught s390 to allocate hotplug-time page frames	2024-03-14 17:43:30 -07:00
page_counter.c
page_ext.c	mm/page_ext: move functions around for minor cleanups to page_ext	2023-08-18 10:12:31 -07:00
page_idle.c	mm: page_idle: convert page idle to use a folio	2023-01-18 17:12:52 -08:00
page_io.c	zswap: memcontrol: implement zswap writeback disabling	2023-12-29 20:22:11 -08:00
page_isolation.c	mm: add alloc_contig_migrate_range allocation statistics	2024-03-04 17:01:27 -08:00
page_owner.c	mm,page_owner: defer enablement of static branch	2024-04-16 15:39:51 -07:00
page_poison.c	mm/page_poison: replace kmap_atomic() with kmap_local_page()	2023-12-10 16:51:50 -08:00
page_reporting.c	mm, treewide: rename MAX_ORDER to MAX_PAGE_ORDER	2024-01-08 15:27:15 -08:00
page_reporting.h
page_table_check.c	mm: convert page_table_check_pte_set() to page_table_check_ptes_set()	2023-08-24 16:20:18 -07:00
page_vma_mapped.c	mm: thp: introduce multi-size THP sysfs interface	2023-12-20 14:48:12 -08:00
page-writeback.c	writeback: remove a use of write_cache_pages() from do_writepages()	2024-02-23 17:48:38 -08:00
pagewalk.c	mm: pagewalk: assert write mmap lock only for walking the user page tables	2023-12-10 16:51:53 -08:00
percpu-internal.h	percpu-internal/pcpu_chunk: re-layout pcpu_chunk structure to reduce false sharing	2023-06-19 16:19:29 -07:00
percpu-km.c
percpu-stats.c
percpu-vm.c
percpu.c	mm: Introduce flush_cache_vmap_early()	2023-12-14 00:23:17 -08:00
pgalloc-track.h
pgtable-generic.c	mm/pgtable: notes on pte_offset_map[_lock]()	2023-08-18 10:12:25 -07:00
process_vm_access.c	mm: fix process_vm_rw page counts	2023-12-10 16:51:39 -08:00
ptdump.c	mm: ptdump: add check_wx_pages debugfs attribute	2024-02-22 10:24:47 -08:00
readahead.c	mm: support order-1 folios in the page cache	2024-03-04 17:01:19 -08:00
rmap.c	rmap: replace two calls to compound_order with folio_order	2024-02-22 15:27:20 -08:00
rodata_test.c
secretmem.c	mm/secretmem: use a folio in secretmem_fault()	2023-08-21 13:38:02 -07:00
shmem_quota.c	tmpfs: fix race on handling dquot rbtree	2024-03-26 11:07:23 -07:00
shmem.c	mm/shmem: inline shmem_is_huge() for disabled transparent hugepages	2024-04-16 15:39:51 -07:00
show_mem.c	mm, treewide: introduce NR_PAGE_ORDERS	2024-01-08 15:27:15 -08:00
shrinker_debug.c	mm: shrinker: convert shrinker_rwsem to mutex	2023-10-04 10:32:26 -07:00
shrinker.c	mm: shrinker: use kvzalloc_node() from expand_one_shrinker_info()	2024-01-05 09:58:32 -08:00
shuffle.c	mm/shuffle: convert module_param_call to module_param_cb	2022-10-03 14:03:07 -07:00
shuffle.h	mm, treewide: rename MAX_ORDER to MAX_PAGE_ORDER	2024-01-08 15:27:15 -08:00
slab_common.c	- Kuan-Wei Chiu has developed the well-named series "lib min_heap: Min	2024-03-14 18:03:09 -07:00
slab.h	Merge branch 'slab/for-6.9/slab-flag-cleanups' into slab/for-linus	2024-03-12 10:16:56 +01:00
slub.c	mm/slub: avoid zeroing outside-object freepointer for single free	2024-05-01 17:28:56 +02:00
sparse-vmemmap.c	mm/vmemmap: allow architectures to override how vmemmap optimization works	2023-08-18 10:12:53 -07:00
sparse.c	mm/memory_hotplug: introduce MEM_PREPARE_ONLINE/MEM_FINISH_OFFLINE notifiers	2024-02-21 16:00:01 -08:00
swap_cgroup.c	mm: memcontrol: don't allocate cgroup swap arrays when memcg is disabled	2022-10-03 14:03:36 -07:00
swap_slots.c	mm/zswap: invalidate zswap entry when swap entry free	2024-02-22 10:24:54 -08:00
swap_state.c	mm: convert free_swap_cache() to take a folio	2024-03-04 17:01:26 -08:00
swap.c	mm: fix list corruption in put_pages_list	2024-03-12 13:07:16 -07:00
swap.h	mm/swap: fix race when skipping swapcache	2024-02-20 14:20:48 -08:00
swapfile.c	- Sumanth Korikkar has taught s390 to allocate hotplug-time page frames	2024-03-14 17:43:30 -07:00
truncate.c	fs: convert error_remove_page to error_remove_folio	2023-12-10 16:51:42 -08:00
usercopy.c	mm: Fix copy_from_user_nofault().	2023-04-12 17:36:23 -07:00
userfaultfd.c	userfaultfd: fix deadlock warning when locking src and dst VMAs	2024-03-26 11:07:23 -07:00
util.c	- Sumanth Korikkar has taught s390 to allocate hotplug-time page frames	2024-03-14 17:43:30 -07:00
vmalloc.c	mm: vmalloc: fix lockdep warning	2024-04-05 11:21:30 -07:00
vmpressure.c	eventfd: simplify eventfd_signal()	2023-11-28 14:08:38 +01:00
vmscan.c	- Sumanth Korikkar has taught s390 to allocate hotplug-time page frames	2024-03-14 17:43:30 -07:00
vmstat.c	mm, treewide: rename MAX_ORDER to MAX_PAGE_ORDER	2024-01-08 15:27:15 -08:00
workingset.c	mm: move mapping_set_update out of <linux/swap.h>	2024-02-21 11:36:50 +05:30
z3fold.c	mm/z3fold: fix the comment for __encode_handle()	2024-02-23 17:48:31 -08:00
zbud.c	mm: zswap: remove shrink from zpool interface	2023-06-19 16:19:27 -07:00
zpool.c	mm: zswap: remove shrink from zpool interface	2023-06-19 16:19:27 -07:00
zsmalloc.c	mm/zsmalloc: don't need to reserve LSB in handle	2024-03-04 17:01:28 -08:00
zswap.c	mm: zswap: fix shrinker NULL crash with cgroup_disable=memory	2024-04-24 19:34:26 -07:00