Re: [PATCH] mm: shrinker: Fix double-free in alloc_shrinker_info error path

[Hongling Zeng]

在 2026年07月11日 13:31, Qi Zheng 写道:
> Hi Hongling,
>
> On 7/11/26 12:19 PM, Hongling Zeng wrote:
> > In alloc_shrinker_info(), when shrinker_unit_alloc() fails for a node,
> > the error handler calls free_shrinker_info() which iterates over ALL
> > nodes and tries to free their shrinker_info. For the failed node,
> > rcu_assign_pointer() was skipped, so its shrinker_info still points
> > to old data. This causes double-free of valid shrinker_info structures.
>
> No, it will be NULL, not old data. Therefore, the double-free you
> mentioned doesn't exist. Before sending the fix, please verify the
> problem exists and your fix actually works.
 Sorry, You're absolutely right. After carefully re-examining the code, 
I now see that:
  1. alloc_mem_cgroup_per_node_info() allocates with __GFP_ZERO, so 
shrinker_info is initialized to NULL, not old data
  2. The error handler in alloc_shrinker_info() correctly bounds 
cleanup with if (nid >= failed_nid) break;, so it only frees 
successfully allocated structures
  My analysis was incorrect - there is no double-free issue in this 
code path, I apologize for submitting this patch without proper 
verification.
> And as a reminder, please don't repeatedly send identical patches:
>
> 1. 
> https://lore.kernel.org/all/20260711041509.92926-1-zenghongling@xxxxxxxxxx/
> 2. 
> https://lore.kernel.org/all/20260711041823.95135-1-zenghongling@xxxxxxxxxx/
> 3. 
> https://lore.kernel.org/all/20260711041954.95749-1-zenghongling@xxxxxxxxxx/
>
> One last thing, please make sure to base your changes on the latest
> tree.
>
> Thanks,
> Qi
I also apologize for the multiple identical submissions ，my email 
client was reporting errors when sending, so I retried thinking the 
emails weren't going through。
> > Fix by tracking which node failed and only freeing shrinker_info
> > structures that were successfully assigned via rcu_assign_pointer()
> > in this call. Failed/unhandled nodes are left untouched.
> >
> > Fixes: 15e8156713cc ("mm: shrinker: avoid memleak in 
> > alloc_shrinker_info")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Hongling Zeng <zenghongling@xxxxxxxxxx>
> > ---
> >   mm/shrinker.c | 13 ++++++++++++-
> >   1 file changed, 12 insertions(+), 1 deletion(-)
> >
> > diff --git a/mm/shrinker.c b/mm/shrinker.c
> > index 7082d01c8c9d..92c6cb455fc9 100644
> > --- a/mm/shrinker.c
> > +++ b/mm/shrinker.c
> > @@ -78,6 +78,7 @@ int alloc_shrinker_info(struct mem_cgroup *memcg)
> >   {
> >       int nid, ret = 0;
> >       int array_size = 0;
> > +    int failed_nid;
> >         mutex_lock(&shrinker_mutex);
> >       array_size = shrinker_unit_size(shrinker_nr_max);
> > @@ -98,8 +99,18 @@ int alloc_shrinker_info(struct mem_cgroup *memcg)
> >       return ret;
> >     err:
> > +    failed_nid = nid;
> > +    for_each_node(nid) {
> > +        struct shrinker_info *info;
> > +
> > +        if (nid >= failed_nid)
> > +            break;
> > +        info = shrinker_info_protected(memcg, nid);
> > + rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_info, NULL);
> > +        shrinker_unit_free(info, 0);
> > +        kvfree(info);
> > +    }
> >       mutex_unlock(&shrinker_mutex);
> > -    free_shrinker_info(memcg);
> >       return -ENOMEM;
> >   }