Re: [PATCH] mm: shrinker: fix double-free in alloc_shrinker_info error path
From: kernel test robot
Date: Sat Jul 11 2026 - 05:47:37 EST
Hi Hongling,
kernel test robot noticed the following build warnings:
[auto build test WARNING on v7.2-rc2]
[cannot apply to akpm-mm/mm-everything linus/master next-20260710]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Hongling-Zeng/mm-shrinker-fix-double-free-in-alloc_shrinker_info-error-path/20260711-122040
base: v7.2-rc2
patch link: https://lore.kernel.org/r/20260711041823.95135-1-zenghongling%40kylinos.cn
patch subject: [PATCH] mm: shrinker: fix double-free in alloc_shrinker_info error path
config: nios2-allmodconfig (https://download.01.org/0day-ci/archive/20260711/202607111736.7pLPe0yR-lkp@xxxxxxxxx/config)
compiler: nios2-linux-gcc (GCC) 11.5.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260711/202607111736.7pLPe0yR-lkp@xxxxxxxxx/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@xxxxxxxxx>
| Closes: https://lore.kernel.org/oe-kbuild-all/202607111736.7pLPe0yR-lkp@xxxxxxxxx/
All warnings (new ones prefixed by >>):
mm/shrinker.c: In function 'alloc_shrinker_info':
mm/shrinker.c:108:24: error: implicit declaration of function 'shrinker_info_protected' [-Werror=implicit-function-declaration]
108 | info = shrinker_info_protected(memcg, nid);
| ^~~~~~~~~~~~~~~~~~~~~~~
>> mm/shrinker.c:108:22: warning: assignment to 'struct shrinker_info *' from 'int' makes pointer from integer without a cast [-Wint-conversion]
108 | info = shrinker_info_protected(memcg, nid);
| ^
mm/shrinker.c: At top level:
mm/shrinker.c:117:30: error: conflicting types for 'shrinker_info_protected'; have 'struct shrinker_info *(struct mem_cgroup *, int)'
117 | static struct shrinker_info *shrinker_info_protected(struct mem_cgroup *memcg,
| ^~~~~~~~~~~~~~~~~~~~~~~
mm/shrinker.c:108:24: note: previous implicit declaration of 'shrinker_info_protected' with type 'int()'
108 | info = shrinker_info_protected(memcg, nid);
| ^~~~~~~~~~~~~~~~~~~~~~~
cc1: some warnings being treated as errors
vim +108 mm/shrinker.c
76
77 int alloc_shrinker_info(struct mem_cgroup *memcg)
78 {
79 int nid, ret = 0;
80 int array_size = 0;
81 int failed_nid;
82
83 mutex_lock(&shrinker_mutex);
84 array_size = shrinker_unit_size(shrinker_nr_max);
85 for_each_node(nid) {
86 struct shrinker_info *info = kvzalloc_node(sizeof(*info) + array_size,
87 GFP_KERNEL, nid);
88 if (!info)
89 goto err;
90 info->map_nr_max = shrinker_nr_max;
91 if (shrinker_unit_alloc(info, NULL, nid)) {
92 kvfree(info);
93 goto err;
94 }
95 rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_info, info);
96 }
97 mutex_unlock(&shrinker_mutex);
98
99 return ret;
100
101 err:
102 failed_nid = nid;
103 for_each_node(nid) {
104 struct shrinker_info *info;
105
106 if (nid >= failed_nid)
107 break;
> 108 info = shrinker_info_protected(memcg, nid);
109 rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_info, NULL);
110 shrinker_unit_free(info, 0);
111 kvfree(info);
112 }
113 mutex_unlock(&shrinker_mutex);
114 return -ENOMEM;
115 }
116
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki