diff options
| author | Muchun Song <songmuchun@bytedance.com> | 2022-03-27 08:18:52 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-04-08 15:22:46 +0300 |
| commit | dd84d71bcbcb2eb7f889449f6d4a3e65ae439e71 (patch) | |
| tree | e7195d09cbc43d23924fdd6abb5df05e5e7a0e22 /mm | |
| parent | 3d7df3f83f677f60a356b39ee167d345786416d0 (diff) | |
| download | linux-dd84d71bcbcb2eb7f889449f6d4a3e65ae439e71.tar.xz | |
mm: kfence: fix missing objcg housekeeping for SLAB
commit ae085d7f9365de7da27ab5c0d16b12d51ea7fca9 upstream.
The objcg is not cleared and put for kfence object when it is freed,
which could lead to memory leak for struct obj_cgroup and wrong
statistics of NR_SLAB_RECLAIMABLE_B or NR_SLAB_UNRECLAIMABLE_B.
Since the last freed object's objcg is not cleared,
mem_cgroup_from_obj() could return the wrong memcg when this kfence
object, which is not charged to any objcgs, is reallocated to other
users.
A real word issue [1] is caused by this bug.
Link: https://lore.kernel.org/all/000000000000cabcb505dae9e577@google.com/ [1]
Reported-by: syzbot+f8c45ccc7d5d45fc5965@syzkaller.appspotmail.com
Fixes: d3fb45f370d9 ("mm, kfence: insert KFENCE hooks for SLAB")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Marco Elver <elver@google.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'mm')
| -rw-r--r-- | mm/slab.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/mm/slab.c b/mm/slab.c index 874b3f8fe80d..03d3074d0bb0 100644 --- a/mm/slab.c +++ b/mm/slab.c @@ -3429,6 +3429,7 @@ static __always_inline void __cache_free(struct kmem_cache *cachep, void *objp, if (is_kfence_address(objp)) { kmemleak_free_recursive(objp, cachep->flags); + memcg_slab_free_hook(cachep, &objp, 1); __kfence_free(objp); return; } |