]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
slab: don't validate slab pointer in free_debug_processing()
authorVlastimil Babka <vbabka@suse.cz>
Mon, 15 Sep 2025 13:55:13 +0000 (15:55 +0200)
committerVlastimil Babka <vbabka@suse.cz>
Mon, 15 Sep 2025 14:48:03 +0000 (16:48 +0200)
commit3864e4d5a526870e011e6aadc05645bc93ca3dd6
treed43e1e299c3e97af2c8d73f1f1c3944d87ab1432
parenta21fe7b010e32c51c62a86dcba02f9404ed77cac
slab: don't validate slab pointer in free_debug_processing()

The struct slab pointer has been obtained from the object being freed on
all the paths that lead to this function. In all cases this already
includes the test for slab type of the struct page which struct slab is
overlaying. Thus we would not reach this function if it was not a valid
slab pointer in the first place.

One less obvious case is that kmem_cache_free() trusts virt_to_slab()
blindly so it may be NULL if the slab type check is false. But with
SLAB_CONSISTENCY_CHECKS, cache_from_obj() called also from
kmem_cache_free() catches this and returns NULL, which terminates
freeing immediately.

Reviewed-by: Harry Yoo <harry.yoo@oracle.com>
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
mm/slub.c