The patch titled Subject: mm: kmemleak: use mem_pool_free() to free object has been added to the -mm mm-unstable branch. Its filename is mm-kmemleak-use-mem_pool_free-to-free-object.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/mm-kmemleak-use-mem_pool_free-to-free-object.patch This patch will later appear in the mm-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Liu Shixin <liushixin2@xxxxxxxxxx> Subject: mm: kmemleak: use mem_pool_free() to free object Date: Wed, 18 Oct 2023 18:29:50 +0800 The kmemleak object is allocated by mem_pool_alloc(), which could be from slab or mem_pool[], so it's not suitable using __kmem_cache_free() to free the object, use __mem_pool_free() instead. Link: https://lkml.kernel.org/r/20231018102952.3339837-6-liushixin2@xxxxxxxxxx Fixes: 0647398a8c7b ("mm: kmemleak: simple memory allocation pool for kmemleak objects") Signed-off-by: Liu Shixin <liushixin2@xxxxxxxxxx> Cc: Catalin Marinas <catalin.marinas@xxxxxxx> Cc: Kefeng Wang <wangkefeng.wang@xxxxxxxxxx> Cc: Patrick Wang <patrick.wang.shcn@xxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- mm/kmemleak.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) --- a/mm/kmemleak.c~mm-kmemleak-use-mem_pool_free-to-free-object +++ a/mm/kmemleak.c @@ -668,8 +668,8 @@ static struct kmemleak_object *__alloc_o return object; } -static void __link_object(struct kmemleak_object *object, unsigned long ptr, - size_t size, int min_count, bool is_phys) +static int __link_object(struct kmemleak_object *object, unsigned long ptr, + size_t size, int min_count, bool is_phys) { struct kmemleak_object *parent; @@ -711,14 +711,15 @@ static void __link_object(struct kmemlea * be freed while the kmemleak_lock is held. */ dump_object_info(parent); - kmem_cache_free(object_cache, object); - return; + return -EEXIST; } } rb_link_node(&object->rb_node, rb_parent, link); rb_insert_color(&object->rb_node, is_phys ? &object_phys_tree_root : &object_tree_root); list_add_tail_rcu(&object->object_list, &object_list); + + return 0; } /* @@ -731,14 +732,17 @@ static void __create_object(unsigned lon { struct kmemleak_object *object; unsigned long flags; + int ret; object = __alloc_object(gfp); if (!object) return; raw_spin_lock_irqsave(&kmemleak_lock, flags); - __link_object(object, ptr, size, min_count, is_phys); + ret = __link_object(object, ptr, size, min_count, is_phys); raw_spin_unlock_irqrestore(&kmemleak_lock, flags); + if (ret) + mem_pool_free(object); } /* Create kmemleak object which allocated with virtual address. */ _ Patches currently in -mm which might be from liushixin2@xxxxxxxxxx are mm-vmscan-try-to-reclaim-swapcache-pages-if-no-swap-space.patch mm-vmscan-try-to-reclaim-swapcache-pages-if-no-swap-space-v6.patch bootmem-use-kmemleak_free_part_phys-in-put_page_bootmem.patch bootmem-use-kmemleak_free_part_phys-in-free_bootmem_page.patch mm-kmemleak-fix-print-format-of-pointer-in-pr_debug.patch mm-kmemleak-split-__create_object-into-two-functions.patch mm-kmemleak-use-mem_pool_free-to-free-object.patch mm-kmemleak-add-__find_and_remove_object.patch mm-kmemleak-fix-partially-freeing-unknown-object-warning.patch