From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-00082601.pphosted.com (mx0a-00082601.pphosted.com [67.231.145.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2A50A396D06 for ; Wed, 14 Jan 2026 12:22:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=67.231.145.42 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768393371; cv=none; b=Y77gBfBgyyKLBuEeVxYAuvdo6FfdQJ8AgnUUbx3gtFfnPQ/ciOlBw5TvZD3YrVbgNbMphgCZsgleQZlqfrQrJ/Z3/Jjmp2G7SNXqOauoxp0hSS66ayVN/TEuPPYbKoFTjpW/7NgMxhr4AlPKaEoqfwDtEaGl/jbXaT//5LM/0A4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768393371; c=relaxed/simple; bh=zvJMmhdJkoS35AWRBQ9saQA/d0IezBkVDEPrGyB6cc8=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=GiqQ4dVNH1+hYAl5uiJyAGQu8MJdoKwd4ple2B3YOg8yObDD77kRiSp1STfxzs4oITA9yRtmM3mL5TDuDG7+GBA0En1Gs82Qp2iEm/h4JN/vw3350qBBgT/VYcBlqj6FTd/yCfG8HSeEtf93sCsNxEARwdODPRCm7mMUUGVZJhA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=meta.com; spf=pass smtp.mailfrom=meta.com; dkim=pass (2048-bit key) header.d=meta.com header.i=@meta.com header.b=MLrMZEyN; arc=none smtp.client-ip=67.231.145.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=meta.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=meta.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=meta.com header.i=@meta.com header.b="MLrMZEyN" Received: from pps.filterd (m0109333.ppops.net [127.0.0.1]) by mx0a-00082601.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 60EBY4G81562086; Wed, 14 Jan 2026 04:22:27 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=meta.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=s2048-2025-q2; bh=cdnDOBIi9MmsNfktRk6AkexRuBKfttaLQPTXyR4ZCo0=; b=MLrMZEyNSrrG vKhqf4wEdV1b2N4JYt0OOETldkgRoXR/CpmGJHsUwZ3Nh66dFTZ0yUXi7cA8xO4Q yew+ui7BDLtoZ3CRtk+eZ41DLeNmagGlmkpLGQmAB7aFXNL4ml9EvCiX3/davalB LOKyZN1TQ9bz8PUgo4CF7o2bakHyw8ID5ErFjukOsD8fuVJUcV/wcIdh5U6Dzv9m hWNZoaXWCeg0XDreW3LqBlpdsgzGuji8q5mHTCMI/8rjzb/+fTFOB/9luQaQVaXE jln071en/icuJDtzsR22x8Oj58O7yMsJwYoMQ5VliaD3SwBWeRveb7OMsnp/dpjf nck5v3q6VA== Received: from mail.thefacebook.com ([163.114.134.16]) by mx0a-00082601.pphosted.com (PPS) with ESMTPS id 4bpact8a7h-2 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT); Wed, 14 Jan 2026 04:22:27 -0800 (PST) Received: from devbig003.atn7.facebook.com (2620:10d:c085:208::7cb7) by mail.thefacebook.com (2620:10d:c08b:78::c78f) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.2.2562.29; Wed, 14 Jan 2026 12:22:22 +0000 From: Chris Mason To: Dennis Zhou CC: Chris Mason , Tejun Heo , Christoph Lameter , Andrew Morton , , , "Sebastian Andrzej Siewior" Subject: Re: [PATCH] percpu: add basic double free check Date: Wed, 14 Jan 2026 04:22:00 -0800 Message-ID: <20260114122209.1075584-1-clm@meta.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20251220002737.84100-1-dennis@kernel.org> References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-Proofpoint-ORIG-GUID: RmaQIs9xHiqsEAtyGwuoKECAJf0_iZ4S X-Authority-Analysis: v=2.4 cv=d5f4CBjE c=1 sm=1 tr=0 ts=69678a83 cx=c_pps a=CB4LiSf2rd0gKozIdrpkBw==:117 a=CB4LiSf2rd0gKozIdrpkBw==:17 a=vUbySO9Y5rIA:10 a=VkNPw1HP01LnGYTKEx00:22 a=VwQbUJbxAAAA:8 a=E1IHwRy6t-lTkHfHgIAA:9 X-Proofpoint-GUID: RmaQIs9xHiqsEAtyGwuoKECAJf0_iZ4S X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwMTE0MDEwMSBTYWx0ZWRfX3ipYuxGDsbdy SEaa3IItAgOlCcmrVSe7+hIQ/EstsHjW6Hu4nc6U7NOv7/NgLdZ64vEPQ/JVroGmdFoqLlSSV2Y LC0FQp4JVo7fKhBe01rzMemvm41iRmFrgN6X0/GnpXeXpa/qeTEk/+XRVP0dCm8//eUZdRJO32Z fWGX5w1jlLC0o5x6qfBOtaF6p/VMC0LvGoDq170ef4RsUxRwldE4Gst8+sxtp5SDdUAPEyXHE2b YgK8cSP2a3NHOnI4kXZDNjzri71A5fL9qtTuy1qCdCJYrMxHoaDEbTGRo95VhqrrSdNvpT4cn6r Bf10TYAXq7tCLBqY+Uh7tQYdUbUH/iLIUf18mEeYW4eE/Gd5Etj7Jp4NB5hll7CdQBDQo+latlg c/ZvETPlLWuHliSu/YwRUTHwcaxPL+0BnAW9C3+szD1jqzYjzbxe54wNmVa1+iuEGUeRiy9STo6 JP6MGdqa1y0//FdP5Wg== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1121,Hydra:6.1.9,FMLib:17.12.100.49 definitions=2026-01-14_03,2026-01-09_02,2025-10-01_01 On Fri, 19 Dec 2025 16:27:37 -0800 Dennis Zhou wrote: > This adds a basic double free check by validating the first bit of the > allocation in alloc_map and bound_map are set. If the alloc_map bit is > not set, then this means the area is currently unallocated. If the > bound_map bit is not set, then we are not freeing from the beginning of > the allocation. Hi Dennis, I ran mm-new through the AI review prompts, and this one was flagged: > diff --git a/mm/percpu.c b/mm/percpu.c > --- a/mm/percpu.c > +++ b/mm/percpu.c [ ... ] > @@ -1285,6 +1286,11 @@ static int pcpu_free_area(struct pcpu_chunk *chunk, int off) > > bit_off = off / PCPU_MIN_ALLOC_SIZE; > > + /* check double free */ > + if (!test_bit(bit_off, chunk->alloc_map) || > + !test_bit(bit_off, chunk->bound_map)) > + return 0; Does this early return corrupt pcpu_stats.nr_cur_alloc and chunk->nr_alloc? Looking at pcpu_free_area(), earlier in the function (before this new check) there is a call to pcpu_stats_area_dealloc(chunk) which decrements these counters: static int pcpu_free_area(struct pcpu_chunk *chunk, int off) { ... lockdep_assert_held(&pcpu_lock); pcpu_stats_area_dealloc(chunk); <-- decrements counters here ... bit_off = off / PCPU_MIN_ALLOC_SIZE; /* check double free */ if (!test_bit(bit_off, chunk->alloc_map) || !test_bit(bit_off, chunk->bound_map)) return 0; <-- returns without actual free ... } When a double-free is detected: 1. pcpu_stats_area_dealloc() runs, decrementing pcpu_stats.nr_cur_alloc and chunk->nr_alloc 2. The check detects the double-free and returns 0 3. No actual memory is freed, but the counters are now wrong Should pcpu_stats_area_dealloc() be moved after the double-free check, or should there be a compensating increment on the early return path? This could also affect percpu_stats_show() in mm/percpu-stats.c, which uses chunk->nr_alloc via find_max_nr_alloc() to size a buffer: buffer = vmalloc_array(2 * max_nr_alloc + 1, sizeof(int)); If nr_alloc is underreported due to this bug, the buffer may be undersized for the actual number of allocations tracked in alloc_map, which chunk_map_stats() iterates based on the actual bitmap contents.