Hi, I am trying to understand how slab_alloc_node works in mm/slub.c when CONFIG_SLAB_FREELIST_HARDENED=y. It seems like in ___slab_alloc, c->freelist gets assigned the result of get_freepointer, which, when CONFIG_SLAB_FREELIST_HARDENED=y, returns a value XOR'd with a per-cache random number. However, that XOR'd value is never seemingly undone, and slab_alloc_node passes the XOR'd (and thus invalid) pointer directly to get_freepointer. Does anyone know where the XOR reversal is performed? Thanks. -- Derrick McKee
