linux-kernel - Re: [PATCH 1/2] mm/slub: Fix cmp_loc_by_count() to return 0 when counts are equal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250825144838.4081382-1-joshua.hahnjy@gmail.com>
Date: Mon, 25 Aug 2025 07:48:36 -0700
From: Joshua Hahn <joshua.hahnjy@...il.com>
To: Kuan-Wei Chiu <visitorckw@...il.com>
Cc: vbabka@...e.cz,
	akpm@...ux-foundation.org,
	cl@...two.org,
	rientjes@...gle.com,
	roman.gushchin@...ux.dev,
	harry.yoo@...cle.com,
	glittao@...il.com,
	jserv@...s.ncku.edu.tw,
	linux-mm@...ck.org,
	linux-kernel@...r.kernel.org,
	stable@...r.kernel.org
Subject: Re: [PATCH 1/2] mm/slub: Fix cmp_loc_by_count() to return 0 when counts are equal

On Mon, 25 Aug 2025 09:34:18 +0800 Kuan-Wei Chiu <visitorckw@...il.com> wrote:

> The comparison function cmp_loc_by_count() used for sorting stack trace
> locations in debugfs currently returns -1 if a->count > b->count and 1
> otherwise. This breaks the antisymmetry property required by sort(),
> because when two counts are equal, both cmp(a, b) and cmp(b, a) return
> 1.
> 
> This can lead to undefined or incorrect ordering results. Fix it by
> explicitly returning 0 when the counts are equal, ensuring that the
> comparison function follows the expected mathematical properties.
> 
> Fixes: 553c0369b3e1 ("mm/slub: sort debugfs output by frequency of stack traces")
> Cc: stable@...r.kernel.org
> Signed-off-by: Kuan-Wei Chiu <visitorckw@...il.com>
> ---
>  mm/slub.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/mm/slub.c b/mm/slub.c
> index 30003763d224..c91b3744adbc 100644
> --- a/mm/slub.c
> +++ b/mm/slub.c
> @@ -7718,8 +7718,9 @@ static int cmp_loc_by_count(const void *a, const void *b, const void *data)
>  
>  	if (loc1->count > loc2->count)
>  		return -1;
> -	else
> +	if (loc1->count < loc2->count)
>  		return 1;
> +	return 0;
>  }

Hello Kuan-Wei,

This is a great catch! I was thinking that in addition to separating out the
== case, we can also simplify the behavior by just opting to use the
cmp_int macro, which is defined in the <linux/sort.h> header, which is
already included in mm/slub.c. For the description, we have:

 * Return: 1 if the left argument is greater than the right one; 0 if the
 * arguments are equal; -1 if the left argument is less than the right one.

So in this case, we can replace the entire code block above with:

return cmp_int(loc2->count, loc1->count);

or

return -1 * cmp_int(loc1->count, loc2->count);

if you prefer to keep the position of loc1 and loc2. I guess we do lose
some interpretability of what -1 and 1 would refer to here, but I think
a comment should be able to take care of that.

Please let me know what you think. I hope you have a great day!
Joshua