# git rev-parse -q --verify ae085d7f9365de7da27ab5c0d16b12d51ea7fca9^{commit} ae085d7f9365de7da27ab5c0d16b12d51ea7fca9 already have revision, skipping fetch # git checkout -q -f -B kisskb ae085d7f9365de7da27ab5c0d16b12d51ea7fca9 # git clean -qxdf # < git log -1 # commit ae085d7f9365de7da27ab5c0d16b12d51ea7fca9 # Author: Muchun Song # Date: Sun Mar 27 13:18:52 2022 +0800 # # mm: kfence: fix missing objcg housekeeping for SLAB # # The objcg is not cleared and put for kfence object when it is freed, # which could lead to memory leak for struct obj_cgroup and wrong # statistics of NR_SLAB_RECLAIMABLE_B or NR_SLAB_UNRECLAIMABLE_B. # # Since the last freed object's objcg is not cleared, # mem_cgroup_from_obj() could return the wrong memcg when this kfence # object, which is not charged to any objcgs, is reallocated to other # users. # # A real word issue [1] is caused by this bug. # # Link: https://lore.kernel.org/all/000000000000cabcb505dae9e577@google.com/ [1] # Reported-by: syzbot+f8c45ccc7d5d45fc5965@syzkaller.appspotmail.com # Fixes: d3fb45f370d9 ("mm, kfence: insert KFENCE hooks for SLAB") # Signed-off-by: Muchun Song # Cc: Dmitry Vyukov # Cc: Marco Elver # Cc: Andrew Morton # Signed-off-by: Linus Torvalds # < /opt/cross/kisskb/korg/gcc-11.1.0-nolibc/sparc64-linux/bin/sparc64-linux-gcc --version # < /opt/cross/kisskb/korg/gcc-11.1.0-nolibc/sparc64-linux/bin/sparc64-linux-ld --version # < git log --format=%s --max-count=1 ae085d7f9365de7da27ab5c0d16b12d51ea7fca9 # < make -s -j 24 ARCH=sparc64 O=/kisskb/build/linus_sparc64-allmodconfig_sparc64-gcc11 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-11.1.0-nolibc/sparc64-linux/bin/sparc64-linux- allmodconfig # Added to kconfig CONFIG_BUILD_DOCSRC=n # Added to kconfig CONFIG_HAVE_FTRACE_MCOUNT_RECORD=n # Added to kconfig CONFIG_SAMPLES=n # Added to kconfig CONFIG_MODULE_SIG=n # < make -s -j 24 ARCH=sparc64 O=/kisskb/build/linus_sparc64-allmodconfig_sparc64-gcc11 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-11.1.0-nolibc/sparc64-linux/bin/sparc64-linux- help # make -s -j 24 ARCH=sparc64 O=/kisskb/build/linus_sparc64-allmodconfig_sparc64-gcc11 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-11.1.0-nolibc/sparc64-linux/bin/sparc64-linux- olddefconfig # make -s -j 24 ARCH=sparc64 O=/kisskb/build/linus_sparc64-allmodconfig_sparc64-gcc11 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-11.1.0-nolibc/sparc64-linux/bin/sparc64-linux- :1517:2: warning: #warning syscall clone3 not implemented [-Wcpp] In file included from /kisskb/src/include/linux/string.h:20, from /kisskb/src/include/linux/bitmap.h:11, from /kisskb/src/include/linux/cpumask.h:12, from /kisskb/src/include/linux/smp.h:13, from /kisskb/src/include/linux/lockdep.h:14, from /kisskb/src/include/linux/rcupdate.h:29, from /kisskb/src/include/linux/rculist.h:11, from /kisskb/src/include/linux/sched/signal.h:5, from /kisskb/src/drivers/staging/rtl8723bs/include/drv_types.h:17, from /kisskb/src/drivers/staging/rtl8723bs/core/rtw_recv.c:7: /kisskb/src/drivers/staging/rtl8723bs/core/rtw_recv.c: In function 'wlanhdr_to_ethhdr': /kisskb/src/arch/sparc/include/asm/string.h:15:25: error: '__builtin_memcpy' offset [0, 5] is out of the bounds [0, 0] [-Werror=array-bounds] 15 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n) | ^~~~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/drivers/staging/rtl8723bs/core/rtw_recv.c:1558:9: note: in expansion of macro 'memcpy' 1558 | memcpy(ptr, pattrib->dst, ETH_ALEN); | ^~~~~~ /kisskb/src/arch/sparc/include/asm/string.h:15:25: error: '__builtin_memcpy' offset [0, 5] is out of the bounds [0, 0] [-Werror=array-bounds] 15 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n) | ^~~~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/drivers/staging/rtl8723bs/core/rtw_recv.c:1559:9: note: in expansion of macro 'memcpy' 1559 | memcpy(ptr+ETH_ALEN, pattrib->src, ETH_ALEN); | ^~~~~~ /kisskb/src/arch/sparc/include/asm/string.h:15:25: error: '__builtin_memcpy' offset [0, 5] is out of the bounds [0, 0] [-Werror=array-bounds] 15 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n) | ^~~~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/drivers/staging/rtl8723bs/core/rtw_recv.c:1558:9: note: in expansion of macro 'memcpy' 1558 | memcpy(ptr, pattrib->dst, ETH_ALEN); | ^~~~~~ /kisskb/src/arch/sparc/include/asm/string.h:15:25: error: '__builtin_memcpy' offset [0, 5] is out of the bounds [0, 0] [-Werror=array-bounds] 15 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n) | ^~~~~~~~~~~~~~~~~~~~~~~~~ /kisskb/src/drivers/staging/rtl8723bs/core/rtw_recv.c:1559:9: note: in expansion of macro 'memcpy' 1559 | memcpy(ptr+ETH_ALEN, pattrib->src, ETH_ALEN); | ^~~~~~ cc1: all warnings being treated as errors make[4]: *** [/kisskb/src/scripts/Makefile.build:289: drivers/staging/rtl8723bs/core/rtw_recv.o] Error 1 make[4]: *** Waiting for unfinished jobs.... make[3]: *** [/kisskb/src/scripts/Makefile.build:551: drivers/staging/rtl8723bs] Error 2 make[3]: *** Waiting for unfinished jobs.... make[2]: *** [/kisskb/src/scripts/Makefile.build:551: drivers/staging] Error 2 make[2]: *** Waiting for unfinished jobs.... make[1]: *** [/kisskb/src/Makefile:1830: drivers] Error 2 make: *** [Makefile:219: __sub-make] Error 2 Command 'make -s -j 24 ARCH=sparc64 O=/kisskb/build/linus_sparc64-allmodconfig_sparc64-gcc11 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-11.1.0-nolibc/sparc64-linux/bin/sparc64-linux- ' returned non-zero exit status 2 # rm -rf /kisskb/build/linus_sparc64-allmodconfig_sparc64-gcc11 # Build took: 0:17:30.626151