Re: [PATCH v2 2/4] mm/slub: preserve one previous object lifetime

[Harry Yoo]

On Mon, Aug 17, 2026 at 06:30:51PM +0800, Hao Li wrote:
> On Fri, Aug 14, 2026 at 12:12:44AM +0800, Pengpeng Hou wrote:
> > SLAB_STORE_USER replaces the allocation track when an object is reused.  A
> > later stale free can then replace the free track as well, leaving the
> > report without the completed lifetime that created the stale reference.

Can we explicitly mention "double free" to make it more straightforward?
It confused me twice already ;-)

> > Store one additional alloc/free pair.  Before recording a new allocation,
> > copy the current pair to the previous slots only when both records exist.

Hmm we should probably instead:

1. Copy TRACK_ALLOC to TRACK_PREV_ALLOC before updating TRACK_ALLOC
2. Copy TRACK_FREE to TRACK_PREV_FREE before updating TRACK_FREE

I feel thinking of one pair as one 'lifetime' adds quite some confusion
because TRACK_ALLOC/TRACK_FREE sometimes form a 'lifetime', but
sometimes span more than one lifetime.

> > Keep the current free track intact to preserve existing SLAB_STORE_USER
> > behavior during the reuse window.
> >
> > Print the previous pair when available.  These records are diagnostic
> > history and do not infer semantic ownership.
> > 
> > Assisted-by: Codex:gpt-5
> > Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
> > ---
> >  mm/slub.c | 45 ++++++++++++++++++++++++++++++++++++---------
> >  1 file changed, 36 insertions(+), 9 deletions(-)
> > 
> > diff --git a/mm/slub.c b/mm/slub.c
> > index 0653def0fe36..355fbffb981f 100644
> > --- a/mm/slub.c
> > +++ b/mm/slub.c
> > @@ -1113,12 +1130,22 @@ static void print_track(const char *s, struct track *t, unsigned long pr_time)
> >  
> >  void print_tracking(struct kmem_cache *s, void *object)
> >  {
> > +	struct track *prev_alloc;
> >  	unsigned long pr_time = jiffies;
> > +
> >  	if (!(s->flags & SLAB_STORE_USER))
> >  		return;
> >  
> >  	print_track("Allocated", get_track(s, object, TRACK_ALLOC), pr_time);
> >  	print_track("Freed", get_track(s, object, TRACK_FREE), pr_time);
> 
> When object is in allocated state, under normal case, this "Freed" line
> duplicates with the "Freed" line under "Previous object lifetime:"

Good catch!

> Would it make sense to add a check here? something like:
> 
> if ("free track" isn't the same as "prev_free track")

Perhaps it's better to never make this condition true to avoid
confusion?

> 	print_track("Freed", get_track(s, object, TRACK_FREE), pr_time);

Pengpeng, do you plan to respin this?

-- 
Cheers,
Harry / Hyeonggon