linux-kernel - [PATCH] mm: mempool: fix wake-up edge case bug for zero-minimum pools

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <8c0cdb71-8d21-497e-b793-c43ce3a16345@suse.com>
Date: Wed, 16 Jul 2025 23:37:30 +0800
From: Yadan Fan <ydfan@...e.com>
To: akpm@...ux-foundation.org
Cc: linux-mm@...ck.org, linux-kernel@...r.kernel.org
Subject: [PATCH] mm: mempool: fix wake-up edge case bug for zero-minimum pools

The mempool wake-up mechanism has a edge case bug that affects pools
created with min_nr=0. When a thread blocks waiting for memory from an
empty pool (curr_nr == 0), subsequent mempool_free() calls fail to wake
the waiting thread because the condition "curr_nr < min_nr" evaluates
to "0 < 0" which is false, this causes threads to sleep indefinitely.

There is at least 2 places where the mempool created with min_nr=0:

1. lib/btree.c:191: mempool_create(0, btree_alloc, btree_free, NULL)
2. drivers/md/dm-verity-fec.c:791:
    mempool_init_slab_pool(&f->extra_pool, 0, f->cache)

Add an explicit check in mempool_free() to handle the min_nr=0 case:
when the pool has zero minimum reserves, is currently empty, and has
active waiters, wake them up. The wq_has_sleeper() avoids unnecessary
wake-ups when no threads are waiting.

Signed-off-by: Yadan Fan <ydfan@...e.com>
---
  mm/mempool.c | 16 ++++++++++++++++
  1 file changed, 16 insertions(+)

diff --git a/mm/mempool.c b/mm/mempool.c
index 3223337135d0..803f8853e0f1 100644
--- a/mm/mempool.c
+++ b/mm/mempool.c
@@ -545,6 +545,22 @@ void mempool_free(void *element, mempool_t *pool)
                 }
                 spin_unlock_irqrestore(&pool->lock, flags);
         }
+       /*
+        * Handle the min_nr = 0 edge case:
+        * For zero-minimum pools, curr_nr < min_nr (0 < 0) never succeeds,
+        * so waiters sleeping on pool->wait would never be woken by the
+        * normal wake-up path. This explicit check ensures that when
+        * pool->min_nr == 0 and pool->curr_nr == 0, any active waiters
+        * are properly awakened.
+        * The wq_has_sleeper() avoids unnecessary wake-ups when no
+        * threads are waiting.
+        */
+       if (unlikely(pool->min_nr == 0 &&
+                    READ_ONCE(pool->curr_nr) == 0 &&
+                    wq_has_sleeper(&pool->wait))) {
+               wake_up(&pool->wait);
+       }
+
         pool->free(element, pool->pool_data);
  }
  EXPORT_SYMBOL(mempool_free);
-- 
2.50.1