Re: [PATCH v3 02/10] kasan, kunit: pin test slabs by an extra allocation

[Harry Yoo]

On Thu, Nov 05, 2026 at 09:43:51AM +0100, Vlastimil Babka (SUSE) wrote:
> The tests kmem_cache_double_free() and kmem_cache_rcu_reuse() create a
> scenario where a slab becomes empty, but rely on the implementation not
> immediately freeing it.
> 
> This subtly relies on non-zero s->min_partial. It currently compile-time
> defaults to a non-zero value, but in theory a sysfs write racing with
> the kunit test could change it. More importantly, the upcoming
> CONFIG_SLUB_TINY changes will make it possible to run the kunit tests
> with s->min_partial being a compile-time zero, which means the tests can
> cause a NULL pointer dereference, or fail, respectively, as flagged by
> sashiko [1].
> 
> To prevent this in a robust way, add an extra object allocation to the
> tests, that will prevent the slab being freed. Use migrate_disable() to
> prevent migration to a different NUMA node, which would place the
> allocation to a different slab. kmem_cache_rcu_reuse() already uses
> that.
> 
> [1] https://sashiko.dev/#/patchset/20261024-slub_tiny_rework-v2-0-bf1419ab5ffd@xxxxxxxxxx?part=8
> 
> Signed-off-by: Vlastimil Babka (SUSE) <vbabka@xxxxxxxxxx>
> ---
>  mm/kasan/kasan_test_c.c | 24 +++++++++++++++++++++---
>  1 file changed, 21 insertions(+), 3 deletions(-)
> 
> diff --git a/mm/kasan/kasan_test_c.c b/mm/kasan/kasan_test_c.c
> index b9e167ed5be3..580a9bf007ec 100644
> --- a/mm/kasan/kasan_test_c.c
> +++ b/mm/kasan/kasan_test_c.c
> @@ -1152,7 +1160,7 @@ static void kmem_cache_rcu_uaf(struct kunit *test)
>   */
>  static void kmem_cache_rcu_reuse(struct kunit *test)
>  {
> -	char *p, *p2;
> +	char *p, *p2, *pin;
>  	struct kmem_cache *cache;
>  
>  	KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_SLUB_RCU_DEBUG);
> @@ -1162,6 +1170,12 @@ static void kmem_cache_rcu_reuse(struct kunit *test)
>  	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, cache);
>  
>  	migrate_disable();
> +	pin = kmem_cache_alloc(cache, GFP_KERNEL);
> +	if (!pin) {
> +		kunit_err(test, "Allocation failed: %s\n", __func__);
> +		goto destroy;

destroy path doesn't re-enable migration?
otherwise LGTM.

> +	}
> +
>  	p = kmem_cache_alloc(cache, GFP_KERNEL);
>  	if (!p) {
>  		kunit_err(test, "Allocation failed: %s\n", __func__);
> @@ -1178,8 +1192,12 @@ static void kmem_cache_rcu_reuse(struct kunit *test)
>  
>  	kmem_cache_free(cache, p2);
>  
> +
>  out:
>  	migrate_enable();
> +	kmem_cache_free(cache, pin);
> +
> +destroy:
>  	kmem_cache_destroy(cache);
>  }

-- 
Cheers,
Harry / Hyeonggon