diff options
| author | Karl Mehltretter <kmehltretter@gmail.com> | 2026-10-10 22:39:06 +0200 |
|---|---|---|
| committer | Harry Yoo (Meta) <harry@kernel.org> | 2026-10-19 11:57:03 +0100 |
| commit | d15d7703166daf7bd62c844a3cb1b3a6279adb4c (patch) | |
| tree | 1d1680fd54333da59e9e3fba34d8f683ba4988a1 | |
| parent | 088bfdc0d7947d623f4899b9011c866e4445074d (diff) | |
mm/slub: initialize the free pointer of the bootstrap kmem_cache_node
With slub_debug=FZPU, validating kmem_cache_node reports
BUG kmem_cache_node (Not tainted): Freepointer corrupt
Object 0xffff888000140040 @offset=64 fp=0x5a5a5a5a5a5a5a5a
and taints the kernel. Poisoning places the bootstrap object's free
pointer outside the object, where check_object() checks it even while
allocated.
early_kmem_cache_node_alloc() previously took this object from a
freelist with an initialized pointer. It now takes it from the slab
iterator and builds the freelist only for the remaining objects,
leaving its pointer filled with POISON_INUSE.
Initialize the bootstrap object's free pointer to NULL.
Fixes: dc795d4c0282 ("mm/slub: defer freelist construction until after bulk allocation from a new slab")
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Harry Yoo (Meta) <harry@kernel.org>
Link: https://patch.msgid.link/20261010203906.93156-1-kmehltretter@gmail.com
Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Reviewed-by: Shengming Hu <hu.shengming@zte.com.cn>
Tested-by: David Rientjes <rientjes@google.com>
Signed-off-by: Harry Yoo (Meta) <harry@kernel.org>
| -rw-r--r-- | mm/slub.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/mm/slub.c b/mm/slub.c index 1559cbace469..8fbc6bf8ebc5 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -7891,6 +7891,7 @@ static void early_kmem_cache_node_alloc(int node) n = next_slab_obj(kmem_cache_node, &iter); BUG_ON(!n); + set_freepointer(kmem_cache_node, n, NULL); slab->inuse = 1; build_slab_freelist(kmem_cache_node, slab, &iter); |