On Fri, 7 Aug 2020 at 21:06, Pekka Enberg <penberg@xxxxxxxxx> wrote: ... > Yeah, it reproduces with defconfig too, as long as you remember to > pass "slub_debug=Z"... :-/ > > The following seems to be the culprit: > > commit 3202fa62fb43087387c65bfa9c100feffac74aa6 > Author: Kees Cook <keescook@xxxxxxxxxxxx> > Date: Wed Apr 1 21:04:27 2020 -0700 > > slub: relocate freelist pointer to middle of object > > Reverting this commit and one of it's follow up fixes from Kees from > v5.8 makes the issue go away for me. Btw, please note that caches with > size 24 and larger do not trigger this bug, so the issue is that with > small enough object size, we're stomping on allocator metadata (I > assume part of the freelist). Was there a patch to fix this? Checking, just in case I missed it. Thanks, -- Marco
