linux-kernel - [BUG]INFO: Slab ADDR objects=NUM used=NUM fp=ADDR flags=ADDR

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAJNGr6vHrsSZ4QrRbRrN8-+tTb7ks8+xY9W7iE2VLsdgZe-eFQ@mail.gmail.com>
Date: Fri, 16 May 2025 19:42:22 +0800
From: Guoyu Yin <y04609127@...il.com>
To: ericvh@...nel.org
Cc: lucho@...kov.net, asmadeus@...ewreck.org, linux_oss@...debyte.com, 
	v9fs@...ts.linux.dev, linux-kernel@...r.kernel.org
Subject: [BUG]INFO: Slab ADDR objects=NUM used=NUM fp=ADDR flags=ADDR

Hi,

I encountered a kernel crash on linux5.10 described as "INFO: Slab
ADDR objects=NUM used=NUM fp=ADDR." The issue occurs when shutting
down the 9p-fcall-cache slab cache, with the dmesg log indicating that
objects remain in the cache, triggering kernel warnings and errors.

According to the dmesg log, the crash occurs in kmem_cache_destroy,
with the call path p9_client_destroy -> kmem_cache_destroy. This
happens during resource cleanup after a failed 9P filesystem mount.
The log shows that the 9p-fcall-cache slab cache still contains
objects (e.g., "objects=3 used=1"), indicating incomplete cleanup.

I suspect that p9_client_destroy fails to properly release all fcall
objects in the cleanup path after a mount failure, possibly due to
reference count errors or a memory leak. I recommend reviewing the
p9_client_destroy function in net/9p/client.c to ensure all fcall
objects are freed before the slab cache is destroyed.

This can be reproduced on:

HEAD commit:

2c85ebc57b3e1817b6ce1a6b703928e113a90442

console output : https://pastebin.com/raw/4CieLjqM

kernel config : https://pastebin.com/raw/gPbJY2Bq

C reproducer : https://pastebin.com/raw/EanQb7c

The C reproducer may take a few minutes to trigger this crash, please
wait for a while.

Best regards,

Guoyu