From: Vlastimil Babka Date: Mon, 15 Sep 2025 13:55:13 +0000 (+0200) Subject: slab: don't validate slab pointer in free_debug_processing() X-Git-Tag: v6.18-rc1~131^2~4 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3864e4d5a526870e011e6aadc05645bc93ca3dd6;p=thirdparty%2Flinux.git slab: don't validate slab pointer in free_debug_processing() The struct slab pointer has been obtained from the object being freed on all the paths that lead to this function. In all cases this already includes the test for slab type of the struct page which struct slab is overlaying. Thus we would not reach this function if it was not a valid slab pointer in the first place. One less obvious case is that kmem_cache_free() trusts virt_to_slab() blindly so it may be NULL if the slab type check is false. But with SLAB_CONSISTENCY_CHECKS, cache_from_obj() called also from kmem_cache_free() catches this and returns NULL, which terminates freeing immediately. Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka --- diff --git a/mm/slub.c b/mm/slub.c index b3b65429e2d79..674c5036a18a0 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -3492,11 +3492,6 @@ static inline bool free_debug_processing(struct kmem_cache *s, int cnt = 0; if (s->flags & SLAB_CONSISTENCY_CHECKS) { - if (!validate_slab_ptr(slab)) { - slab_err(s, slab, "Not a valid slab page"); - goto out; - } - if (!check_slab(s, slab)) goto out; }