Re: [PATCH] kasan: fix quarantine_size accounting during cache removal

[Andrey Ryabinin]

Hui Su <sh_def@xxxxxxx> writes:

> quarantine_size tracks the total number of bytes stored in
> global_quarantine[]. It is incremented when per-CPU quarantine objects
> are moved into the global quarantine and decremented when a global
> batch is evicted by kasan_quarantine_reduce().
>
> kasan_quarantine_remove_cache() also removes objects from the global
> quarantine. qlist_move_cache() rebuilds the source batch and updates
> its .bytes field, but quarantine_size is not adjusted accordingly.
>
> As a result, quarantine_size remains over-counted by the size of the
> removed objects. The stale accounting accumulates across cache removals.
> Once the inflated value exceeds quarantine_max_size,
> kasan_quarantine_reduce() can evict a batch even though the actual
> number of bytes in global_quarantine[] is still below
> quarantine_max_size, shortening the quarantine window.
>
> Fix the accounting by recording each batch's size before
> qlist_move_cache() and subtracting the number of bytes actually removed
> from quarantine_size while holding quarantine_lock.
>
> A KUnit reproducer used during testing observed the over-count grow by
> 4698864 bytes after one kasan_quarantine_remove_cache() call with the
> fix reverted. With this change applied, the over-count did not grow.
>
> Fixes: 64abdcb24351 ("kasan: eliminate long stalls during quarantine reduction")
> Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
> Closes: https://sashiko.dev/#/patchset/20260808031459.3032812-1-sh_def%40163.com
> Signed-off-by: Hui Su <sh_def@xxxxxxx>

Reviewed-by: Andrey Ryabinin <ryabinin.a.a@xxxxxxxxx>