Danilo Krummrich's patch [1] raised one problem about krealloc() that its caller doesn't pass the old request size, say the object is 64 bytes kmalloc one, but caller originally only requested 48 bytes. Then when krealloc() shrinks or grows in the same object, or allocate a new bigger object, it lacks this 'original size' information to do accurate data preserving or zeroing (when __GFP_ZERO is set). Thus with slub debug redzone and object tracking enabled, parts of the object after krealloc() might contain redzone data instead of zeroes, which is violating the __GFP_ZERO guarantees. Good thing is in this case, kmalloc caches do have this 'orig_size' feature, which could be used to improve the situation here. To make the 'orig_size' accurate, we adjust some kasan/slub meta data handling. Also add a slub kunit test case for krealloc(). This patchset has dependency over patches in both -mm tree and -slab trees, so it is written based on linux-next tree '20240910' version. [1]. https://lore.kernel.org/lkml/20240812223707.32049-1-dakr@xxxxxxxxxx/ Thanks, Feng Changelog: Since v1: * Drop the patch changing generic kunit code from this patchset, and will send it separately. * Separate the krealloc moving form slab_common.c to slub.c to a new patch for better review (Danilo/Vlastimil) * Improve commit log and comments (Vlastimil/Danilo) * Rework the kunit test case to remove its dependency over slub_debug (which is incomplete in v1) (Vlastimil) * Add ack and review tag from developers. Feng Tang (5): mm/kasan: Don't store metadata inside kmalloc object when slub_debug_orig_size is on mm/slub: Consider kfence case for get_orig_size() mm/slub: Move krealloc() and related code to slub.c mm/slub: Improve redzone check and zeroing for krealloc() mm/slub, kunit: Add testcase for krealloc redzone and zeroing lib/slub_kunit.c | 42 +++++++++++++++ mm/kasan/generic.c | 7 ++- mm/slab.h | 6 +++ mm/slab_common.c | 84 ------------------------------ mm/slub.c | 125 ++++++++++++++++++++++++++++++++++++++------- 5 files changed, 160 insertions(+), 104 deletions(-) -- 2.34.1
