The patch titled
Subject: kasan: fix slab double free when cpu-hotplug
has been removed from the -mm tree. Its filename was
kasan-fix-object-remaining-in-offline-per-cpu-quarantine-fix.patch
This patch was dropped because it was folded into kasan-fix-object-remain-in-offline-per-cpu-quarantine.patch
------------------------------------------------------
From: Zqiang <qiang.zhang@xxxxxxxxxxxxx>
Subject: kasan: fix slab double free when cpu-hotplug
When a CPU offline, the per-cpu quarantine's offline be set true, after
this, if the quarantine_put be called in this CPU, the objects will be
free and return false, free objects doesn't to be done, due to return
false, the slab memory manager will free this objects.
Link: https://lkml.kernel.org/r/20201204102206.20237-1-qiang.zhang@xxxxxxxxxxxxx
Fixes: 41ab1aae781f ("kasan: fix object remaining in offline per-cpu quarantine")
Signed-off-by: Zqiang <qiang.zhang@xxxxxxxxxxxxx>
Cc: Kuan-Ying Lee <Kuan-Ying.Lee@xxxxxxxxxxxx>
Cc: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
Cc: Guangye Yang <guangye.yang@xxxxxxxxxxxx>
Cc: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
Cc: Andrey Ryabinin <aryabinin@xxxxxxxxxxxxx>
Cc: Alexander Potapenko <glider@xxxxxxxxxx>
Cc: Matthias Brugger <matthias.bgg@xxxxxxxxx>
Cc: Nicholas Tang <nicholas.tang@xxxxxxxxxxxx>
Cc: Miles Chen <miles.chen@xxxxxxxxxxxx>
Cc: Qian Cai <qcai@xxxxxxxxxx>
Cc: Stephen Rothwell <sfr@xxxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
mm/kasan/quarantine.c | 1 -
1 file changed, 1 deletion(-)
--- a/mm/kasan/quarantine.c~kasan-fix-object-remaining-in-offline-per-cpu-quarantine-fix
+++ a/mm/kasan/quarantine.c
@@ -191,7 +191,6 @@ void quarantine_put(struct kasan_free_me
q = this_cpu_ptr(&cpu_quarantine);
if (q->offline) {
- qlink_free(&info->quarantine_link, cache);
local_irq_restore(flags);
return;
}
_
Patches currently in -mm which might be from qiang.zhang@xxxxxxxxxxxxx are
kasan-fix-object-remain-in-offline-per-cpu-quarantine.patch
