Re: [PATCH v5] kasan/quarantine: fix bugs on qlist_move_cache()

[Andrey Ryabinin]

On 07/06/2016 03:52 AM, js1304@xxxxxxxxx wrote:
> From: Joonsoo Kim <iamjoonsoo.kim@xxxxxxx>
> 
> There are two bugs on qlist_move_cache(). One is that qlist's tail
> isn't set properly. curr->next can be NULL since it is singly linked
> list and NULL value on tail is invalid if there is one item on qlist.
> Another one is that if cache is matched, qlist_put() is called and
> it will set curr->next to NULL. It would cause to stop the loop
> prematurely.
> 
> These problems come from complicated implementation so I'd like to
> re-implement it completely. Implementation in this patch is really
> simple. Iterate all qlist_nodes and put them to appropriate list.
> 
> Unfortunately, I got this bug sometime ago and lose oops message.
> But, the bug looks trivial and no need to attach oops.
> 
> v5: rename some variable for better readability
> v4: fix cache size bug s/cache->size/obj_cache->size/
> v3: fix build warning
> 
> Reviewed-by: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
> Signed-off-by: Joonsoo Kim <iamjoonsoo.kim@xxxxxxx>

Fixes: 55834c59098d ("mm: kasan: initial memory quarantine implementation")
Acked-by: Andrey Ryabinin <aryabinin@xxxxxxxxxxxxx>