Re: [PATCH] mm: shrinker: fix double-free in alloc_shrinker_info error path
From: kernel test robot
Date: Sat Jul 11 2026 - 09:29:34 EST
Hi Hongling,
kernel test robot noticed the following build errors:
[auto build test ERROR on v7.2-rc2]
[cannot apply to akpm-mm/mm-everything linus/master next-20260710]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Hongling-Zeng/mm-shrinker-fix-double-free-in-alloc_shrinker_info-error-path/20260711-122040
base: v7.2-rc2
patch link: https://lore.kernel.org/r/20260711041823.95135-1-zenghongling%40kylinos.cn
patch subject: [PATCH] mm: shrinker: fix double-free in alloc_shrinker_info error path
config: x86_64-kexec (https://download.01.org/0day-ci/archive/20260711/202607111559.uTGMAUhC-lkp@xxxxxxxxx/config)
compiler: clang version 22.1.8 (https://github.com/llvm/llvm-project ca7933e47d3a3451d81e72ac174dcb5aa28b59d1)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260711/202607111559.uTGMAUhC-lkp@xxxxxxxxx/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@xxxxxxxxx>
| Closes: https://lore.kernel.org/oe-kbuild-all/202607111559.uTGMAUhC-lkp@xxxxxxxxx/
All errors (new ones prefixed by >>):
>> mm/shrinker.c:108:10: error: call to undeclared function 'shrinker_info_protected'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
108 | info = shrinker_info_protected(memcg, nid);
| ^
>> mm/shrinker.c:108:8: error: incompatible integer to pointer conversion assigning to 'struct shrinker_info *' from 'int' [-Wint-conversion]
108 | info = shrinker_info_protected(memcg, nid);
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> mm/shrinker.c:117:30: error: conflicting types for 'shrinker_info_protected'
117 | static struct shrinker_info *shrinker_info_protected(struct mem_cgroup *memcg,
| ^
mm/shrinker.c:108:10: note: previous implicit declaration is here
108 | info = shrinker_info_protected(memcg, nid);
| ^
3 errors generated.
vim +/shrinker_info_protected +108 mm/shrinker.c
76
77 int alloc_shrinker_info(struct mem_cgroup *memcg)
78 {
79 int nid, ret = 0;
80 int array_size = 0;
81 int failed_nid;
82
83 mutex_lock(&shrinker_mutex);
84 array_size = shrinker_unit_size(shrinker_nr_max);
85 for_each_node(nid) {
86 struct shrinker_info *info = kvzalloc_node(sizeof(*info) + array_size,
87 GFP_KERNEL, nid);
88 if (!info)
89 goto err;
90 info->map_nr_max = shrinker_nr_max;
91 if (shrinker_unit_alloc(info, NULL, nid)) {
92 kvfree(info);
93 goto err;
94 }
95 rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_info, info);
96 }
97 mutex_unlock(&shrinker_mutex);
98
99 return ret;
100
101 err:
102 failed_nid = nid;
103 for_each_node(nid) {
104 struct shrinker_info *info;
105
106 if (nid >= failed_nid)
107 break;
> 108 info = shrinker_info_protected(memcg, nid);
109 rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_info, NULL);
110 shrinker_unit_free(info, 0);
111 kvfree(info);
112 }
113 mutex_unlock(&shrinker_mutex);
114 return -ENOMEM;
115 }
116
> 117 static struct shrinker_info *shrinker_info_protected(struct mem_cgroup *memcg,
118 int nid)
119 {
120 return rcu_dereference_protected(memcg->nodeinfo[nid]->shrinker_info,
121 lockdep_is_held(&shrinker_mutex));
122 }
123
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki