linux-kernel - Re: [PATCH v2] slab: Fix obj_ext is mistakenly considered NULL due to race condition

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <8b152d73-ecc4-415c-acdc-3f5105412ac0@suse.cz>
Date: Fri, 24 Oct 2025 11:39:43 +0200
From: Vlastimil Babka <vbabka@...e.cz>
To: Hao Ge <hao.ge@...ux.dev>, Harry Yoo <harry.yoo@...cle.com>
Cc: Andrew Morton <akpm@...ux-foundation.org>,
 Christoph Lameter <cl@...two.org>, David Rientjes <rientjes@...gle.com>,
 Roman Gushchin <roman.gushchin@...ux.dev>,
 Suren Baghdasaryan <surenb@...gle.com>, Shakeel Butt
 <shakeel.butt@...ux.dev>, linux-mm@...ck.org, linux-kernel@...r.kernel.org,
 Hao Ge <gehao@...inos.cn>
Subject: Re: [PATCH v2] slab: Fix obj_ext is mistakenly considered NULL due to
 race condition

On 10/24/25 11:27, Hao Ge wrote:
> Hi Harry
> Hi Vlastimil
> 
> 
> Thank you for adding V2 to your tree. Now, should I resubmit V3,
> 
> or can you assist with making these modifications in your tree?

Massaged it a bit more and now have this:

commit b4bdf6770cadb8bffcf3dce7ad7a346979f79ede
Author: Hao Ge <gehao@...inos.cn>
Date:   Thu Oct 23 22:33:13 2025 +0800

    slab: Fix obj_ext mistakenly considered NULL due to race condition
    
    If two competing threads enter alloc_slab_obj_exts(), and the one that
    allocates the vector wins the cmpxchg(), the other thread that failed
    allocation mistakenly assumes that slab->obj_exts is still empty due to
    its own allocation failure. This will then trigger warnings with
    CONFIG_MEM_ALLOC_PROFILING_DEBUG checks in the subsequent free path.
    
    Therefore, let's check the result of cmpxchg() to see if marking the
    allocation as failed was successful. If it wasn't, check whether the
    winning side has succeeded its allocation (it might have been also
    marking it as failed) and if yes, return success.
    
    Suggested-by: Harry Yoo <harry.yoo@...cle.com>
    Signed-off-by: Hao Ge <gehao@...inos.cn>
    Link: https://patch.msgid.link/20251023143313.1327968-1-hao.ge@linux.dev
    Reviewed-by: Suren Baghdasaryan <surenb@...gle.com>
    Reviewed-by: Harry Yoo <harry.yoo@...cle.com>
    Signed-off-by: Vlastimil Babka <vbabka@...e.cz>

diff --git a/mm/slub.c b/mm/slub.c
index 87a1d2f9de0d..d4367f25b20d 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2052,9 +2052,9 @@ static inline void mark_objexts_empty(struct slabobj_ext *obj_exts)
 	}
 }
 
-static inline void mark_failed_objexts_alloc(struct slab *slab)
+static inline bool mark_failed_objexts_alloc(struct slab *slab)
 {
-	cmpxchg(&slab->obj_exts, 0, OBJEXTS_ALLOC_FAIL);
+	return cmpxchg(&slab->obj_exts, 0, OBJEXTS_ALLOC_FAIL) == 0;
 }
 
 static inline void handle_failed_objexts_alloc(unsigned long obj_exts,
@@ -2076,7 +2076,7 @@ static inline void handle_failed_objexts_alloc(unsigned long obj_exts,
 #else /* CONFIG_MEM_ALLOC_PROFILING_DEBUG */
 
 static inline void mark_objexts_empty(struct slabobj_ext *obj_exts) {}
-static inline void mark_failed_objexts_alloc(struct slab *slab) {}
+static inline bool mark_failed_objexts_alloc(struct slab *slab) { return false; }
 static inline void handle_failed_objexts_alloc(unsigned long obj_exts,
 			struct slabobj_ext *vec, unsigned int objects) {}
 
@@ -2124,8 +2124,14 @@ int alloc_slab_obj_exts(struct slab *slab, struct kmem_cache *s,
 				   slab_nid(slab));
 	}
 	if (!vec) {
-		/* Mark vectors which failed to allocate */
-		mark_failed_objexts_alloc(slab);
+		/*
+		 * Try to mark vectors which failed to allocate.
+		 * If this operation fails, there may be a racing process
+		 * that has already completed the allocation.
+		 */
+		if (!mark_failed_objexts_alloc(slab) &&
+		    slab_obj_exts(slab))
+			return 0;
 
 		return -ENOMEM;
 	}