Re: [PATCH v3 01/10] slab, kunit: pin test slabs by an extra allocation

[Harry Yoo]

On Thu, Nov 05, 2026 at 09:43:50AM +0100, Vlastimil Babka (SUSE) wrote:
> Several of slab kunit tests allocate and free a single object from the
> test cache, perform intentional UAF actions and validation, while
> expecting the empty slab to stay on the partial list.
> 
> This subtly relies on non-zero s->min_partial. It currently compile-time
> defaults to a non-zero value, but in theory a sysfs write racing with
> the kunit test could change it.

> More importantly, the upcoming
> CONFIG_SLUB_TINY changes will make it possible to run the kunit tests
> with s->min_partial being a compile-time zero, which means the tests
> will now do unintended UAF writes on the page allocator level, and also
> report failures, as flagged by sashiko [1].

Makes sense.
 
> To prevent this in a robust way, add an extra object allocation to the
> tests, that will prevent the slab being freed. Use migrate_disable() to
> prevent migration to a different NUMA node, which would place the
> allocation to a different slab.
>
> [1] https://sashiko.dev/#/patchset/20261024-slub_tiny_rework-v2-0-bf1419ab5ffd@xxxxxxxxxx?part=8
> 
> Signed-off-by: Vlastimil Babka (SUSE) <vbabka@xxxxxxxxxx>
> ---

Looks good to me,
Acked-by: Harry Yoo (Meta) <harry@xxxxxxxxxx>

-- 
Cheers,
Harry / Hyeonggon