linux-kernel - Re: [PATCH] slab: Avoid race on slab->obj_exts in alloc_slab_obj

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <da90b3a5-a256-49f7-a640-6585f2cce340@suse.cz>
Date: Mon, 20 Oct 2025 12:20:57 +0200
From: Vlastimil Babka <vbabka@...e.cz>
To: Hao Ge <hao.ge@...ux.dev>, Suren Baghdasaryan <surenb@...gle.com>
Cc: Harry Yoo <harry.yoo@...cle.com>,
 Andrew Morton <akpm@...ux-foundation.org>, Christoph Lameter
 <cl@...two.org>, David Rientjes <rientjes@...gle.com>,
 Roman Gushchin <roman.gushchin@...ux.dev>,
 Shakeel Butt <shakeel.butt@...ux.dev>, linux-mm@...ck.org,
 linux-kernel@...r.kernel.org, Hao Ge <gehao@...inos.cn>
Subject: Re: [PATCH] slab: Avoid race on slab->obj_exts in alloc_slab_obj_exts

On 10/20/25 04:01, Hao Ge wrote:
> 
>> I think retrying like this should work:
>>
>> +retry:
>>           old_exts = READ_ONCE(slab->obj_exts);
>>           handle_failed_objexts_alloc(old_exts, vec, objects);
>>           if (new_slab) {
>> @@ -2145,8 +2146,7 @@ int alloc_slab_obj_exts(struct slab *slab,
>> struct kmem_cache *s,
>>                    * be simply assigned.
>>                    */
>>                   slab->obj_exts = new_exts;
>> -        } else if ((old_exts & ~OBJEXTS_FLAGS_MASK) ||
>> -                   cmpxchg(&slab->obj_exts, old_exts, new_exts) != old_exts) {
>> +        } else if (old_exts & ~OBJEXTS_FLAGS_MASK) {
>>                   /*
>>                    * If the slab is already in use, somebody can allocate and
>>                    * assign slabobj_exts in parallel. In this case the existing
>> @@ -2158,6 +2158,8 @@ int alloc_slab_obj_exts(struct slab *slab,
>> struct kmem_cache *s,
>>                   else
>>                           kfree(vec);
>>                   return 0;
>> +        } else if (cmpxchg(&slab->obj_exts, old_exts, new_exts) != old_exts) {
>> +                goto retry;
>>           }
> 
> Agree with this. If there are no issues with my comment above,
> 
> I will send V2 based on Suren's suggestion.

Great.
> Additionally, I believe the "Fixes" field should be written as follows:
> 
> Fixes: 09c46563ff6d ("codetag: debug: introduce OBJEXTS_ALLOC_FAIL to 
> mark failed slab_ext allocations")
> 
> Am I wrong?

I think it was safe before this one:

f7381b911640 ("slab: mark slab->obj_exts allocation failures unconditionally")