# git rev-parse -q --verify ae085d7f9365de7da27ab5c0d16b12d51ea7fca9^{commit} ae085d7f9365de7da27ab5c0d16b12d51ea7fca9 already have revision, skipping fetch # git checkout -q -f -B kisskb ae085d7f9365de7da27ab5c0d16b12d51ea7fca9 # git clean -qxdf # < git log -1 # commit ae085d7f9365de7da27ab5c0d16b12d51ea7fca9 # Author: Muchun Song # Date: Sun Mar 27 13:18:52 2022 +0800 # # mm: kfence: fix missing objcg housekeeping for SLAB # # The objcg is not cleared and put for kfence object when it is freed, # which could lead to memory leak for struct obj_cgroup and wrong # statistics of NR_SLAB_RECLAIMABLE_B or NR_SLAB_UNRECLAIMABLE_B. # # Since the last freed object's objcg is not cleared, # mem_cgroup_from_obj() could return the wrong memcg when this kfence # object, which is not charged to any objcgs, is reallocated to other # users. # # A real word issue [1] is caused by this bug. # # Link: https://lore.kernel.org/all/000000000000cabcb505dae9e577@google.com/ [1] # Reported-by: syzbot+f8c45ccc7d5d45fc5965@syzkaller.appspotmail.com # Fixes: d3fb45f370d9 ("mm, kfence: insert KFENCE hooks for SLAB") # Signed-off-by: Muchun Song # Cc: Dmitry Vyukov # Cc: Marco Elver # Cc: Andrew Morton # Signed-off-by: Linus Torvalds # < /opt/cross/kisskb/korg/gcc-11.1.0-nolibc/aarch64-linux/bin/aarch64-linux-gcc --version # < /opt/cross/kisskb/korg/gcc-11.1.0-nolibc/aarch64-linux/bin/aarch64-linux-ld --version # < git log --format=%s --max-count=1 ae085d7f9365de7da27ab5c0d16b12d51ea7fca9 # < make -s -j 32 ARCH=arm64 O=/kisskb/build/linus-rand_arm64-randconfig_arm64-gcc11 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-11.1.0-nolibc/aarch64-linux/bin/aarch64-linux- randconfig # Added to kconfig CONFIG_PREVENT_FIRMWARE_BUILD=y # < make -s -j 32 ARCH=arm64 O=/kisskb/build/linus-rand_arm64-randconfig_arm64-gcc11 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-11.1.0-nolibc/aarch64-linux/bin/aarch64-linux- help # make -s -j 32 ARCH=arm64 O=/kisskb/build/linus-rand_arm64-randconfig_arm64-gcc11 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-11.1.0-nolibc/aarch64-linux/bin/aarch64-linux- olddefconfig # make -s -j 32 ARCH=arm64 O=/kisskb/build/linus-rand_arm64-randconfig_arm64-gcc11 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-11.1.0-nolibc/aarch64-linux/bin/aarch64-linux- /kisskb/src/drivers/infiniband/core/user_mad.c: In function 'ib_umad_write': /kisskb/src/drivers/infiniband/core/user_mad.c:564:50: error: array subscript 'struct ib_rmpp_mad[0]' is partly outside array bounds of 'unsigned char[140]' [-Werror=array-bounds] 564 | hdr_len = ib_get_mad_data_offset(rmpp_mad->mad_hdr.mgmt_class); | ^~ /kisskb/src/drivers/infiniband/core/user_mad.c:509:18: note: referencing an object of size 140 allocated by 'kzalloc.constprop' 509 | packet = kzalloc(sizeof *packet + IB_MGMT_RMPP_HDR, GFP_KERNEL); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/drivers/infiniband/core/user_mad.c:566:42: error: array subscript 'struct ib_rmpp_mad[0]' is partly outside array bounds of 'unsigned char[140]' [-Werror=array-bounds] 566 | if (ib_is_mad_class_rmpp(rmpp_mad->mad_hdr.mgmt_class) | ^~ /kisskb/src/drivers/infiniband/core/user_mad.c:509:18: note: referencing an object of size 140 allocated by 'kzalloc.constprop' 509 | packet = kzalloc(sizeof *packet + IB_MGMT_RMPP_HDR, GFP_KERNEL); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/drivers/infiniband/core/user_mad.c:618:25: error: array subscript 'struct ib_rmpp_mad[0]' is partly outside array bounds of 'unsigned char[140]' [-Werror=array-bounds] 618 | rmpp_mad->mad_hdr.tid = *tid; | ^~ /kisskb/src/drivers/infiniband/core/user_mad.c:509:18: note: referencing an object of size 140 allocated by 'kzalloc.constprop' 509 | packet = kzalloc(sizeof *packet + IB_MGMT_RMPP_HDR, GFP_KERNEL); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/drivers/infiniband/core/user_mad.c:622:44: error: array subscript 'struct ib_rmpp_mad[0]' is partly outside array bounds of 'unsigned char[140]' [-Werror=array-bounds] 622 | && ib_is_mad_class_rmpp(rmpp_mad->mad_hdr.mgmt_class) | ^~ /kisskb/src/drivers/infiniband/core/user_mad.c:509:18: note: referencing an object of size 140 allocated by 'kzalloc.constprop' 509 | packet = kzalloc(sizeof *packet + IB_MGMT_RMPP_HDR, GFP_KERNEL); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors make[4]: *** [/kisskb/src/scripts/Makefile.build:289: drivers/infiniband/core/user_mad.o] Error 1 make[4]: *** Waiting for unfinished jobs.... make[3]: *** [/kisskb/src/scripts/Makefile.build:551: drivers/infiniband/core] Error 2 make[2]: *** [/kisskb/src/scripts/Makefile.build:551: drivers/infiniband] Error 2 make[2]: *** Waiting for unfinished jobs.... make[1]: *** [/kisskb/src/Makefile:1830: drivers] Error 2 make: *** [Makefile:219: __sub-make] Error 2 Command 'make -s -j 32 ARCH=arm64 O=/kisskb/build/linus-rand_arm64-randconfig_arm64-gcc11 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-11.1.0-nolibc/aarch64-linux/bin/aarch64-linux- ' returned non-zero exit status 2 # rm -rf /kisskb/build/linus-rand_arm64-randconfig_arm64-gcc11 # Build took: 0:03:53.872165