Re: [PATCH] kasan: fix slab double free when cpu-hotplug

[Kuan-Ying Lee]

On Fri, 2020-12-04 at 17:25 -0800, Andrew Morton wrote:
> On Fri, 4 Dec 2020 20:01:35 +0800 Kuan-Ying Lee <Kuan-Ying.Lee@xxxxxxxxxxxx> wrote:
> 
> > > diff --git a/mm/kasan/quarantine.c b/mm/kasan/quarantine.c
> > > index d98b516f372f..55783125a767 100644
> > > --- a/mm/kasan/quarantine.c
> > > +++ b/mm/kasan/quarantine.c
> > > @@ -194,7 +194,6 @@ bool quarantine_put(struct kmem_cache *cache, void *object)
> > >  
> > >  	q = this_cpu_ptr(&cpu_quarantine);
> > >  	if (q->offline) {
> > > -		qlink_free(&meta->quarantine_link, cache);
> > >  		local_irq_restore(flags);
> > >  		return false;

Hi Andrew,

Return false will cause slab allocator to free the object.
Thus, we do not need to qlink_free here to free object twice.

The return value is introduced from Andrey's patch.
"kasan: sanitize objects when metadata doesn't fit"


> > >  	}
> > 
> > Hi Qiang,
> > 
> > Thanks for fixing this.
> > Due to that issue, my commit has been removed by Stephen from
> > linux-next.
> > 
> > 
> > Hi Stephen, Andrew,
> > 
> > Should I directly upload the v4 or Stephen can pick the commit which 
> > has been removed back to the linux-next.
> 
> I took care of it.  Restored the original patch and added this one as a
> -fix.

Thanks for taking care of it.

I think there are some problem in the patch you just restored.
I saw the restored patch is not based on Andrey's patch and Stephen's
fix conflict patch.

But the issue Qiang fixed need to be based on the Andrey's patch and
Stephen's fix conflict patch.
"kasan: sanitize objects when metadata doesn't fit"
"kasan-rename-get_alloc-free_info-fix"

If the restored patch is not based on that, it may cause some problems
and conflicts.

I think I can prepare a patch v4 based on Andrey's patch, fix the
conflict and include the Qiang's modification.

Thanks,
Kuan-Ying