From: Chris Down <chris@chrisdown.name>
To: Vlastimil Babka <vbabka@kernel.org>, Harry Yoo <harry@kernel.org>,
Andrew Morton <akpm@linux-foundation.org>
Cc: Hao Li <hao.li@linux.dev>, Christoph Lameter <cl@gentwo.org>,
David Rientjes <rientjes@google.com>,
Roman Gushchin <roman.gushchin@linux.dev>,
Kees Cook <kees@kernel.org>, Marco Elver <elver@google.com>,
GONG Ruiqi <gongruiqi@huaweicloud.com>,
Jan Kiszka <jan.kiszka@siemens.com>,
Kieran Bingham <kbingham@kernel.org>,
Jonathan Corbet <corbet@lwn.net>,
linux-mm@kvack.org, linux-hardening@vger.kernel.org,
linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org,
kernel-team@meta.com
Subject: [PATCH 4/8] slub_kunit: Add a test for slab_freelist_random=
Date: Tue, 27 Oct 2026 15:35:54 +0800 [thread overview]
Message-ID: <0af4fc45ca8e1d7027ceaad079f8f9eaac663c76.1793086056.git.chris@chrisdown.name> (raw)
In-Reply-To: <cover.1793086056.git.chris@chrisdown.name>
Signed-off-by: Chris Down <chris@chrisdown.name>
---
lib/tests/slub_kunit.c | 51 ++++++++++++++++++++++++++++++++++++++++++
mm/slab.h | 3 +++
mm/slub.c | 3 ++-
3 files changed, 56 insertions(+), 1 deletion(-)
diff --git a/lib/tests/slub_kunit.c b/lib/tests/slub_kunit.c
index 5ace73368523..49b9942bc564 100644
--- a/lib/tests/slub_kunit.c
+++ b/lib/tests/slub_kunit.c
@@ -190,6 +190,56 @@ static void test_clobber_redzone_free(struct kunit *test)
kmem_cache_destroy(s);
}
+static void test_freelist_random(struct kunit *test)
+{
+ struct kmem_cache *s = test_kmem_cache_create("TestSlub_freelist_random",
+ 64, SLAB_CONSISTENCY_CHECKS);
+ bool random = false;
+ unsigned int i, nr, nr_linear = 0;
+ void **objs, *first;
+
+#ifdef CONFIG_SLAB_FREELIST_RANDOM
+ random = slab_freelist_random;
+ KUNIT_EXPECT_EQ(test, !!s->random_seq, random);
+#endif
+ kunit_info(test, "freelist randomisation is %s\n", str_on_off(random));
+
+ /*
+ * Caches with debug flags have no sheaves, so objects come straight
+ * off the slab freelist.
+ */
+ first = kmem_cache_alloc(s, GFP_KERNEL);
+ KUNIT_ASSERT_NOT_NULL(test, first);
+ nr = virt_to_slab(first)->objects;
+ objs = kunit_kcalloc(test, nr, sizeof(*objs), GFP_KERNEL);
+ KUNIT_ASSERT_NOT_NULL(test, objs);
+ objs[0] = first;
+
+ for (i = 1; i < nr; i++) {
+ objs[i] = kmem_cache_alloc(s, GFP_KERNEL);
+ KUNIT_ASSERT_NOT_NULL(test, objs[i]);
+ }
+
+ for (i = 1; i < nr; i++) {
+ if (virt_to_slab(objs[i]) != virt_to_slab(objs[0]))
+ break;
+ if (objs[i] == objs[i - 1] + s->size)
+ nr_linear++;
+ }
+
+ if (i == nr) {
+ /* Without randomisation, objects are handed out in address order. */
+ KUNIT_EXPECT_EQ(test, nr_linear == nr - 1, !random);
+ } else {
+ kunit_info(test, "objects were allocated from different slabs\n");
+ }
+
+ for (i = 0; i < nr; i++)
+ kmem_cache_free(s, objs[i]);
+ kmem_cache_destroy(s);
+ KUNIT_EXPECT_EQ(test, 0, slab_errors);
+}
+
static void test_kmalloc_redzone_access(struct kunit *test)
{
struct kmem_cache *s = test_kmem_cache_create("TestSlub_RZ_kmalloc", 32,
@@ -535,6 +585,7 @@ static struct kunit_case test_cases[] = {
#endif
KUNIT_CASE(test_clobber_redzone_free),
+ KUNIT_CASE(test_freelist_random),
KUNIT_CASE(test_kmalloc_redzone_access),
KUNIT_CASE(test_kfree_rcu),
KUNIT_CASE(test_kfree_rcu_wq_destroy),
diff --git a/mm/slab.h b/mm/slab.h
index 8187ddb2face..b648b33f25c3 100644
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -887,6 +887,9 @@ static inline void dump_unreclaimable_slab(void)
void ___cache_free(struct kmem_cache *cache, void *x, unsigned long addr);
#ifdef CONFIG_SLAB_FREELIST_RANDOM
+#if IS_ENABLED(CONFIG_KUNIT)
+extern bool slab_freelist_random;
+#endif
int cache_random_seq_create(struct kmem_cache *cachep, unsigned int count,
gfp_t gfp);
void cache_random_seq_destroy(struct kmem_cache *cachep);
diff --git a/mm/slub.c b/mm/slub.c
index 7e9dadda3d10..8c7b46c2052f 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -3424,7 +3424,8 @@ static inline struct slab *alloc_slab_page(gfp_t flags, int node,
}
#ifdef CONFIG_SLAB_FREELIST_RANDOM
-static bool slab_freelist_random __ro_after_init = true;
+VISIBLE_IF_KUNIT bool slab_freelist_random __ro_after_init = true;
+EXPORT_SYMBOL_IF_KUNIT(slab_freelist_random);
static int __init setup_slab_freelist_random(char *str)
{
--
2.54.0
next prev parent reply other threads:[~2026-10-27 7:35 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-27 7:35 [PATCH 0/8] mm/slab: Support selecting slab hardening features at boot Chris Down
2026-10-27 7:35 ` [PATCH 1/8] mm/slub: Support disabling freelist hardening " Chris Down
2026-10-27 7:35 ` [PATCH 2/8] slub_kunit: Add a test for slab_freelist_hardened= Chris Down
2026-10-27 7:35 ` [PATCH 3/8] mm/slub: Support disabling freelist randomisation at boot Chris Down
2026-10-27 7:35 ` Chris Down [this message]
2026-10-27 7:35 ` [PATCH 5/8] mm/slab: Support disabling SLAB_BUCKETS " Chris Down
2026-10-27 7:36 ` [PATCH 6/8] slub_kunit: Add a test for the slab_buckets boot parameter Chris Down
2026-10-27 7:36 ` [PATCH 7/8] mm/slab: Support disabling KMALLOC_PARTITION_CACHES at boot Chris Down
2026-10-27 7:36 ` [PATCH 8/8] slub_kunit: Add a test for the kmalloc_partition boot parameter Chris Down
2026-10-27 8:10 ` [PATCH 0/8] mm/slab: Support selecting slab hardening features at boot Vlastimil Babka (SUSE)
2026-10-27 18:31 ` Harry Yoo
2026-10-28 15:23 ` Chris Down
2026-10-28 15:06 ` Harry Yoo
2026-10-28 15:27 ` Chris Down
2026-10-28 15:37 ` Harry Yoo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0af4fc45ca8e1d7027ceaad079f8f9eaac663c76.1793086056.git.chris@chrisdown.name \
--to=chris@chrisdown.name \
--cc=akpm@linux-foundation.org \
--cc=cl@gentwo.org \
--cc=corbet@lwn.net \
--cc=elver@google.com \
--cc=gongruiqi@huaweicloud.com \
--cc=hao.li@linux.dev \
--cc=harry@kernel.org \
--cc=jan.kiszka@siemens.com \
--cc=kbingham@kernel.org \
--cc=kees@kernel.org \
--cc=kernel-team@meta.com \
--cc=linux-doc@vger.kernel.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=rientjes@google.com \
--cc=roman.gushchin@linux.dev \
--cc=vbabka@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®