linux-kernel - Re: [PATCH] mm/shrinker: Fix refcount leak in shrink_slab

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <3e59ca4e-2301-48a7-bb8e-d028f07b1446@bytedance.com>
Date: Tue, 3 Feb 2026 16:17:44 +0800
From: "Qi Zheng" <zhengqi.arch@...edance.com>
To: "Altan Hacigumus" <ahacigu.linux@...il.com>, <akpm@...ux-foundation.org>, 
	<david@...morbit.com>
Cc: <roman.gushchin@...ux.dev>, <muchun.song@...ux.dev>, 
	<linux-mm@...ck.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] mm/shrinker: Fix refcount leak in shrink_slab_memcg()

On 2/3/26 3:37 PM, Altan Hacigumus wrote:
> When kmem is disabled for memcg, slab-backed shrinkers are skipped.
> However, shrink_slab_memcg() doesn't drop the reference acquired via
> shrinker_try_get() before continuing.

Good catch!

> 
> Add the missing shrinker_put().
> 
> Fixes: 50d09da8e119 ("mm: shrinker: make memcg slab shrink lockless")
> 
> Signed-off-by: Altan Hacigumus <ahacigu.linux@...il.com>
> ---
>   mm/shrinker.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/mm/shrinker.c b/mm/shrinker.c
> index 4a93fd433689..d0be120488b4 100644
> --- a/mm/shrinker.c
> +++ b/mm/shrinker.c
> @@ -544,8 +544,10 @@ static unsigned long shrink_slab_memcg(gfp_t gfp_mask, int nid,
>   
>   			/* Call non-slab shrinkers even though kmem is disabled */
>   			if (!memcg_kmem_online() &&
> -			    !(shrinker->flags & SHRINKER_NONSLAB))
> +			    !(shrinker->flags & SHRINKER_NONSLAB)) {

Since memcg_kmem_online() and shrinker->flags cannot be changed
dynamically, it's best to remove this shrinker from the bitmap:

				clear_bit(offset, unit->map);

Otherwise LGTM.

Acked-by: Qi Zheng <zhengqi.arch@...edance.com>

Thanks!


> +				shrinker_put(shrinker);
>   				continue;
> +			}
>   
>   			ret = do_shrink_slab(&sc, shrinker, priority);
>   			if (ret == SHRINK_EMPTY) {