Re: [RFC PATCH 01/14] mm/slub: don't try to dereference invalid freepointers

[Hyeonggon Yoo]

On Fri, Sep 15, 2023 at 7:59 PM Matteo Rizzo <matteorizzo@xxxxxxxxxx> wrote:
>
> slab_free_freelist_hook tries to read a freelist pointer from the
> current object even when freeing a single object. This is invalid
> because single objects don't actually contain a freelist pointer when
> they're freed and the memory contains other data. This causes problems
> for checking the integrity of freelist in get_freepointer.
>
> Signed-off-by: Matteo Rizzo <matteorizzo@xxxxxxxxxx>
> ---
>  mm/slub.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/mm/slub.c b/mm/slub.c
> index f7940048138c..a7dae207c2d2 100644
> --- a/mm/slub.c
> +++ b/mm/slub.c
> @@ -1820,7 +1820,9 @@ static inline bool slab_free_freelist_hook(struct kmem_cache *s,
>
>         do {
>                 object = next;
> -               next = get_freepointer(s, object);
> +               /* Single objects don't actually contain a freepointer */
> +               if (object != old_tail)
> +                       next = get_freepointer(s, object);
>
>                 /* If object's reuse doesn't have to be delayed */
>                 if (!slab_free_hook(s, object, slab_want_init_on_free(s))) {
> --
> 2.42.0.459.ge4e396fd5e-goog
>

Looks good to me,
Reviewed-by: Hyeonggon Yoo <42.hyeyoo@xxxxxxxxx>