linux-kernel - Re: [PATCH] mm/shrinker: Fix refcount leak in shrink_slab

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CALjTKDkir0WvFKCfJquwxO-qfYa6CT+5ECa49SbRiUrexRpyrA@mail.gmail.com>
Date: Tue, 3 Feb 2026 01:10:14 -0800
From: Altan Hacigumus <ahacigu.linux@...il.com>
To: Qi Zheng <zhengqi.arch@...edance.com>
Cc: akpm@...ux-foundation.org, david@...morbit.com, roman.gushchin@...ux.dev, 
	muchun.song@...ux.dev, linux-mm@...ck.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] mm/shrinker: Fix refcount leak in shrink_slab_memcg()

Sure, makes sense.
Will send a v2 with the bitmap clearing.

Thanks,
Altan


On Tue, Feb 3, 2026 at 12:18 AM Qi Zheng <zhengqi.arch@...edance.com> wrote:
>
> On 2/3/26 3:37 PM, Altan Hacigumus wrote:
> > When kmem is disabled for memcg, slab-backed shrinkers are skipped.
> > However, shrink_slab_memcg() doesn't drop the reference acquired via
> > shrinker_try_get() before continuing.
>
> Good catch!
>
> >
> > Add the missing shrinker_put().
> >
> > Fixes: 50d09da8e119 ("mm: shrinker: make memcg slab shrink lockless")
> >
> > Signed-off-by: Altan Hacigumus <ahacigu.linux@...il.com>
> > ---
> >   mm/shrinker.c | 4 +++-
> >   1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/mm/shrinker.c b/mm/shrinker.c
> > index 4a93fd433689..d0be120488b4 100644
> > --- a/mm/shrinker.c
> > +++ b/mm/shrinker.c
> > @@ -544,8 +544,10 @@ static unsigned long shrink_slab_memcg(gfp_t gfp_mask, int nid,
> >
> >                       /* Call non-slab shrinkers even though kmem is disabled */
> >                       if (!memcg_kmem_online() &&
> > -                         !(shrinker->flags & SHRINKER_NONSLAB))
> > +                         !(shrinker->flags & SHRINKER_NONSLAB)) {
>
> Since memcg_kmem_online() and shrinker->flags cannot be changed
> dynamically, it's best to remove this shrinker from the bitmap:
>
>                                 clear_bit(offset, unit->map);
>
> Otherwise LGTM.
>
> Acked-by: Qi Zheng <zhengqi.arch@...edance.com>
>
> Thanks!
>
>
> > +                             shrinker_put(shrinker);
> >                               continue;
> > +                     }
> >
> >                       ret = do_shrink_slab(&sc, shrinker, priority);
> >                       if (ret == SHRINK_EMPTY) {