Re: [PATCH] kasan: fix quarantine_size accounting during cache removal

[Andrew Morton <akpm@linux-foundation.org>]

On Tue, 11 Aug 2026 15:33:32 +0800 Hui Su <sh_def@163.com> wrote:

> quarantine_size tracks the total number of bytes stored in
> global_quarantine[]. It is incremented when per-CPU quarantine objects
> are moved into the global quarantine and decremented when a global
> batch is evicted by kasan_quarantine_reduce().
> 
> kasan_quarantine_remove_cache() also removes objects from the global
> quarantine. qlist_move_cache() rebuilds the source batch and updates
> its .bytes field, but quarantine_size is not adjusted accordingly.
> 
> As a result, quarantine_size remains over-counted by the size of the
> removed objects. The stale accounting accumulates across cache removals.
> Once the inflated value exceeds quarantine_max_size,
> kasan_quarantine_reduce() can evict a batch even though the actual
> number of bytes in global_quarantine[] is still below
> quarantine_max_size, shortening the quarantine window.
> 
> Fix the accounting by recording each batch's size before
> qlist_move_cache() and subtracting the number of bytes actually removed
> from quarantine_size while holding quarantine_lock.
> 
> A KUnit reproducer used during testing observed the over-count grow by
> 4698864 bytes after one kasan_quarantine_remove_cache() call with the
> fix reverted. With this change applied, the over-count did not grow.
> 

Thanks.

> @@ -365,9 +365,14 @@ void kasan_quarantine_remove_cache(struct kmem_cache *cache)

Sashiko might have found an unrelated pre-existing bug in here.

	https://sashiko.dev/#/patchset/20260811073332.1351893-1-sh_def@163.com