From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id B7E15C4345F for ; Mon, 29 Apr 2024 08:52:54 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 0C6A46B0085; Mon, 29 Apr 2024 04:52:54 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 04FE26B0087; Mon, 29 Apr 2024 04:52:53 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id DE51E6B0088; Mon, 29 Apr 2024 04:52:53 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id BD9216B0085 for ; Mon, 29 Apr 2024 04:52:53 -0400 (EDT) Received: from smtpin16.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 5A24EC03E5 for ; Mon, 29 Apr 2024 08:52:53 +0000 (UTC) X-FDA: 82061954226.16.636C507 Received: from smtp-out2.suse.de (smtp-out2.suse.de [195.135.223.131]) by imf17.hostedemail.com (Postfix) with ESMTP id D00E840005 for ; Mon, 29 Apr 2024 08:52:50 +0000 (UTC) Authentication-Results: imf17.hostedemail.com; dkim=pass header.d=suse.cz header.s=susede2_rsa header.b=UoXm3SJO; dkim=pass header.d=suse.cz header.s=susede2_ed25519 header.b=YEYHKUm9; dkim=pass header.d=suse.cz header.s=susede2_rsa header.b=UoXm3SJO; dkim=pass header.d=suse.cz header.s=susede2_ed25519 header.b=YEYHKUm9; dmarc=none; spf=pass (imf17.hostedemail.com: domain of vbabka@suse.cz designates 195.135.223.131 as permitted sender) smtp.mailfrom=vbabka@suse.cz ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1714380771; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=Jx6yaNpr8hmPTIwWZh3UfYxX9haWFezt31WoNCFnLlE=; b=c/ZZzE5ESq055w9ypi5M648On63WzlQeevpVUf+ep9KUVTYt0FNY81SsJO6KaILi2PoImi c3NFvpbo4VEvR+Z8pX0ZmZfcqJfn8RQYubBlWAEHIVaIjvfHtai5v745C+F2xhWk3cqlDT a7tBn8m6LbiVk/JXDwZTC+3nu06Dvvc= ARC-Authentication-Results: i=1; imf17.hostedemail.com; dkim=pass header.d=suse.cz header.s=susede2_rsa header.b=UoXm3SJO; dkim=pass header.d=suse.cz header.s=susede2_ed25519 header.b=YEYHKUm9; dkim=pass header.d=suse.cz header.s=susede2_rsa header.b=UoXm3SJO; dkim=pass header.d=suse.cz header.s=susede2_ed25519 header.b=YEYHKUm9; dmarc=none; spf=pass (imf17.hostedemail.com: domain of vbabka@suse.cz designates 195.135.223.131 as permitted sender) smtp.mailfrom=vbabka@suse.cz ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1714380771; a=rsa-sha256; cv=none; b=GdBznUib9a+dE+mieyVTCj3o9yOIviRss3tMBDWiPer59JXU8t+6TIC4hcEf29rR2lK5KK 8QhDcilH9UFuwRp0AGu6TPNUOkQya3mBm+W0U1F3qocQzNqsp3Wqe1c1ZZNK85//3LTSxu pkTZ9ON33t02ffy8yQyrfd2s4bcJlsQ= Received: from imap1.dmz-prg2.suse.org (imap1.dmz-prg2.suse.org [IPv6:2a07:de40:b281:104:10:150:64:97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id 01045203D9; Mon, 29 Apr 2024 08:52:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_rsa; t=1714380769; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:autocrypt:autocrypt; bh=Jx6yaNpr8hmPTIwWZh3UfYxX9haWFezt31WoNCFnLlE=; b=UoXm3SJO1i2QQIjjp0O3vI+EXhdZsHtQ5gPTVHO35ZZr/HEJo+bBQHxLaxi20UITokkzoA pYumOzrxQNxNllXQQ9lXZPHuiOCJ8CD0HznWH3RyuBOFczthFj5jE/WtpuADAJc6Zgtmzc lHFUmArXlBlQToi4tykgeqX84YpvoGE= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_ed25519; t=1714380769; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:autocrypt:autocrypt; bh=Jx6yaNpr8hmPTIwWZh3UfYxX9haWFezt31WoNCFnLlE=; b=YEYHKUm9ZXiEL5jl50Y9vStDzLI4ooVdj1RKVZiQ58v8snhUeazkPk/frNScluZW5MFC4W hDYiByUPdExI04CQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_rsa; t=1714380769; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:autocrypt:autocrypt; bh=Jx6yaNpr8hmPTIwWZh3UfYxX9haWFezt31WoNCFnLlE=; b=UoXm3SJO1i2QQIjjp0O3vI+EXhdZsHtQ5gPTVHO35ZZr/HEJo+bBQHxLaxi20UITokkzoA pYumOzrxQNxNllXQQ9lXZPHuiOCJ8CD0HznWH3RyuBOFczthFj5jE/WtpuADAJc6Zgtmzc lHFUmArXlBlQToi4tykgeqX84YpvoGE= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.cz; s=susede2_ed25519; t=1714380769; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:autocrypt:autocrypt; bh=Jx6yaNpr8hmPTIwWZh3UfYxX9haWFezt31WoNCFnLlE=; b=YEYHKUm9ZXiEL5jl50Y9vStDzLI4ooVdj1RKVZiQ58v8snhUeazkPk/frNScluZW5MFC4W hDYiByUPdExI04CQ== Received: from imap1.dmz-prg2.suse.org (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by imap1.dmz-prg2.suse.org (Postfix) with ESMTPS id DC7DC138A7; Mon, 29 Apr 2024 08:52:48 +0000 (UTC) Received: from dovecot-director2.suse.de ([2a07:de40:b281:106:10:150:64:167]) by imap1.dmz-prg2.suse.org with ESMTPSA id 6YowNeBfL2arEwAAD6G6ig (envelope-from ); Mon, 29 Apr 2024 08:52:48 +0000 Message-ID: <6f977874-2a18-44ef-b207-9eb0baad9d66@suse.cz> Date: Mon, 29 Apr 2024 10:52:48 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] slub: Fixes freepointer encoding for single free Content-Language: en-US To: Chengming Zhou , Nicolas Bouchinet , linux-mm@kvack.org, linux-kernel@vger.kernel.org Cc: cl@linux.com, penberg@kernel.org, rientjes@google.com, iamjoonsoo.kim@lge.com, akpm@linux-foundation.org, roman.gushchin@linux.dev, 42.hyeyoo@gmail.com, Xiongwei Song References: <5c34b253-b476-494a-96c9-fe3c95b9b74d@linux.dev> From: Vlastimil Babka Autocrypt: addr=vbabka@suse.cz; keydata= xsFNBFZdmxYBEADsw/SiUSjB0dM+vSh95UkgcHjzEVBlby/Fg+g42O7LAEkCYXi/vvq31JTB KxRWDHX0R2tgpFDXHnzZcQywawu8eSq0LxzxFNYMvtB7sV1pxYwej2qx9B75qW2plBs+7+YB 87tMFA+u+L4Z5xAzIimfLD5EKC56kJ1CsXlM8S/LHcmdD9Ctkn3trYDNnat0eoAcfPIP2OZ+ 9oe9IF/R28zmh0ifLXyJQQz5ofdj4bPf8ecEW0rhcqHfTD8k4yK0xxt3xW+6Exqp9n9bydiy tcSAw/TahjW6yrA+6JhSBv1v2tIm+itQc073zjSX8OFL51qQVzRFr7H2UQG33lw2QrvHRXqD Ot7ViKam7v0Ho9wEWiQOOZlHItOOXFphWb2yq3nzrKe45oWoSgkxKb97MVsQ+q2SYjJRBBH4 8qKhphADYxkIP6yut/eaj9ImvRUZZRi0DTc8xfnvHGTjKbJzC2xpFcY0DQbZzuwsIZ8OPJCc LM4S7mT25NE5kUTG/TKQCk922vRdGVMoLA7dIQrgXnRXtyT61sg8PG4wcfOnuWf8577aXP1x 6mzw3/jh3F+oSBHb/GcLC7mvWreJifUL2gEdssGfXhGWBo6zLS3qhgtwjay0Jl+kza1lo+Cv BB2T79D4WGdDuVa4eOrQ02TxqGN7G0Biz5ZLRSFzQSQwLn8fbwARAQABzSBWbGFzdGltaWwg QmFia2EgPHZiYWJrYUBzdXNlLmN6PsLBlAQTAQoAPgIbAwULCQgHAwUVCgkICwUWAgMBAAIe AQIXgBYhBKlA1DSZLC6OmRA9UCJPp+fMgqZkBQJkBREIBQkRadznAAoJECJPp+fMgqZkNxIQ ALZRqwdUGzqL2aeSavbum/VF/+td+nZfuH0xeWiO2w8mG0+nPd5j9ujYeHcUP1edE7uQrjOC Gs9sm8+W1xYnbClMJTsXiAV88D2btFUdU1mCXURAL9wWZ8Jsmz5ZH2V6AUszvNezsS/VIT87 AmTtj31TLDGwdxaZTSYLwAOOOtyqafOEq+gJB30RxTRE3h3G1zpO7OM9K6ysLdAlwAGYWgJJ V4JqGsQ/lyEtxxFpUCjb5Pztp7cQxhlkil0oBYHkudiG8j1U3DG8iC6rnB4yJaLphKx57NuQ PIY0Bccg+r9gIQ4XeSK2PQhdXdy3UWBr913ZQ9AI2usid3s5vabo4iBvpJNFLgUmxFnr73SJ KsRh/2OBsg1XXF/wRQGBO9vRuJUAbnaIVcmGOUogdBVS9Sun/Sy4GNA++KtFZK95U7J417/J Hub2xV6Ehc7UGW6fIvIQmzJ3zaTEfuriU1P8ayfddrAgZb25JnOW7L1zdYL8rXiezOyYZ8Fm ZyXjzWdO0RpxcUEp6GsJr11Bc4F3aae9OZtwtLL/jxc7y6pUugB00PodgnQ6CMcfR/HjXlae h2VS3zl9+tQWHu6s1R58t5BuMS2FNA58wU/IazImc/ZQA+slDBfhRDGYlExjg19UXWe/gMcl De3P1kxYPgZdGE2eZpRLIbt+rYnqQKy8UxlszsBNBFsZNTUBCACfQfpSsWJZyi+SHoRdVyX5 J6rI7okc4+b571a7RXD5UhS9dlVRVVAtrU9ANSLqPTQKGVxHrqD39XSw8hxK61pw8p90pg4G /N3iuWEvyt+t0SxDDkClnGsDyRhlUyEWYFEoBrrCizbmahOUwqkJbNMfzj5Y7n7OIJOxNRkB IBOjPdF26dMP69BwePQao1M8Acrrex9sAHYjQGyVmReRjVEtv9iG4DoTsnIR3amKVk6si4Ea X/mrapJqSCcBUVYUFH8M7bsm4CSxier5ofy8jTEa/CfvkqpKThTMCQPNZKY7hke5qEq1CBk2 wxhX48ZrJEFf1v3NuV3OimgsF2odzieNABEBAAHCwXwEGAEKACYCGwwWIQSpQNQ0mSwujpkQ PVAiT6fnzIKmZAUCZAUSmwUJDK5EZgAKCRAiT6fnzIKmZOJGEACOKABgo9wJXsbWhGWYO7mD 8R8mUyJHqbvaz+yTLnvRwfe/VwafFfDMx5GYVYzMY9TWpA8psFTKTUIIQmx2scYsRBUwm5VI EurRWKqENcDRjyo+ol59j0FViYysjQQeobXBDDE31t5SBg++veI6tXfpco/UiKEsDswL1WAr tEAZaruo7254TyH+gydURl2wJuzo/aZ7Y7PpqaODbYv727Dvm5eX64HCyyAH0s6sOCyGF5/p eIhrOn24oBf67KtdAN3H9JoFNUVTYJc1VJU3R1JtVdgwEdr+NEciEfYl0O19VpLE/PZxP4wX PWnhf5WjdoNI1Xec+RcJ5p/pSel0jnvBX8L2cmniYnmI883NhtGZsEWj++wyKiS4NranDFlA HdDM3b4lUth1pTtABKQ1YuTvehj7EfoWD3bv9kuGZGPrAeFNiHPdOT7DaXKeHpW9homgtBxj 8aX/UkSvEGJKUEbFL9cVa5tzyialGkSiZJNkWgeHe+jEcfRT6pJZOJidSCdzvJpbdJmm+eED w9XOLH1IIWh7RURU7G1iOfEfmImFeC3cbbS73LQEFGe1urxvIH5K/7vX+FkNcr9ujwWuPE9b 1C2o4i/yZPLXIVy387EjA6GZMqvQUFuSTs/GeBcv0NjIQi8867H3uLjz+mQy63fAitsDwLmR EP+ylKVEKb0Q2A== In-Reply-To: <5c34b253-b476-494a-96c9-fe3c95b9b74d@linux.dev> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Rspamd-Action: no action X-Rspam-User: X-Rspamd-Server: rspam09 X-Rspamd-Queue-Id: D00E840005 X-Stat-Signature: tz5itnfur8erpgcdeq6r36eq6txhkr8a X-HE-Tag: 1714380770-50201 X-HE-Meta: U2FsdGVkX195My+JsZZWr45b+COyAW4qSCsuvtM1zjAVL0jX9zhx+fqvHjZw7XbUzHSgQY2Zd3dSotsWpWfUvOv5NCCl9TG3FtGpNl5e3Vg16QuxkPvtmweoErCJ8ZEPnU6u9oTxYUDRWbd6X7y+TsquPukdoQ9P2u3QGt7CoeSsSm7TylhUrAzhTOo6UBmcs0hI7WjOfdxuAqK/vaT8laIzA0EhxbhpfBnge8ABEesuuZlMXb6L1tovkYakE5As+VWRyrMjxEZPt2cWmXvqZDQMIEOQqAcCgkCKQrjkYYeyxtuD4wDumGadYZ3U6GzBUjuREXJGYeNcANS7WgMOWTfMDQvMTO16NOCJI2O4CHV16BpmtFyx4am6TTAwOmzpDcYq/DMKXIzpHk0H8CL/UlprDt9QHfbTPk/+yTeLCFGWO88bu8m3RJdQyJoXmXNiNDCqQLFCmGR9MipiZuZwoLTSVtgDeBZd5MEYIrcPYUqJ4uMOvyKFChw3FzmGLM4exCoVF7bEdkY+gqKUS3K0SUY6HGGMPSySXEvkG7K72oj7Vu2RXf9ewapdYtDNu/J59iyGXLRUC1t58YYnZYyMXLXKe0a8GVd3aKIj6EcUu04G18Q4m09GVbS5YGI5/H9YoU4fpdOEUffQnHD6d+cj9IUN1xalJ3tEBwpVZ4aWKjbW7z3Kd5H3AZg2Bc3EZvlqrZ6KHHe7F6P9w5vZyAPnttlUI5ZoVlskIZHQ/zZlf9vn5CFC/5i3jpSxdn42t/mOhJXDntKje4dl1SpXu35I1gFqsqWRnq1OQwT+DS9lgACBOG/EktMLlXPDRmjWGHgZTWWG1eq34L999deVzbvm6ieCaa0P8OMNBsq+f5GgwIX2vUNFyH9vqi45svq7Rzgzpr+1qRd/FS+PAha0FZ5+t+5ytIz45V4VFWAjJeUze1LX2rS3TztBUxl2wI4NJHzAwD8rZgqmNXVpjfYZYKB GQQkuxdQ 90Y2P1/NbQgba9NvayhyQKUvLc8O/SCasUDluBhEOAYU4W1TK+Fevcb8zjBmwVR1qvf+vndGxq6w2Db773xtEpTZBMGRzOCvumEPNaS2ub+C6sjW3H3yKd6IGQ8943o9cdaYpfnc3HQi2fryt9Iub4A1E2L9oc5KfWiDyc4R2EKrsg0VNVcG7b4nC8O1Zx7geUQ+M0tUg8xyVVDJxU8mD/FKAMPIP16vuB4iebpyQ8VMDNrEXKDbsgyQet2wn7OhVTagJX9kX8jxOR3ttdHW9qg5Z2azkRBq6fsiQSNLF87/3Z6w9tCxOuntxGQK6VUjjIUPkOltPAeZ0Hi9ytY4euWgB/vo+6MrhMu38ANAyNnw4/7c= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On 4/25/24 5:14 PM, Chengming Zhou wrote: > On 2024/4/25 23:02, Nicolas Bouchinet wrote: Thanks for finding the bug and the fix! >> Hy, >> >> First of all, thanks a lot for your time. >> >> On 4/25/24 10:36, Chengming Zhou wrote: >>> On 2024/4/24 20:47, Nicolas Bouchinet wrote: >>>> From: Nicolas Bouchinet >>>> >>>> Commit 284f17ac13fe ("mm/slub: handle bulk and single object freeing >>>> separately") splits single and bulk object freeing in two functions >>>> slab_free() and slab_free_bulk() which leads slab_free() to call >>>> slab_free_hook() directly instead of slab_free_freelist_hook(). >>> Right. >>> >>>> If `init_on_free` is set, slab_free_hook() zeroes the object. >>>> Afterward, if `slub_debug=F` and `CONFIG_SLAB_FREELIST_HARDENED` are >>>> set, the do_slab_free() slowpath executes freelist consistency >>>> checks and try to decode a zeroed freepointer which leads to a >>>> "Freepointer corrupt" detection in check_object(). >>> IIUC, the "freepointer" can be checked on the free path only when >>> it's outside the object memory. Here slab_free_hook() zeroed the >>> freepointer and caused the problem. >>> >>> But why we should zero the memory outside the object_size? It seems >>> more reasonable to only zero the object_size when init_on_free is set? >> >> The original purpose was to avoid leaking information through the object and its metadata / tracking information as described in init_on_free initial Commit 6471384af2a6 ("mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options"). >> >> I have to admit I didn't read the entire lore about the original patchset yet, though it could be interesting to know a bit more the threat models, specifically regarding the object metadata init. > > Thank you for the reference! I also don't get why it needs to zero > the metadata and tracking information. Hmm taking a step back, it seems really suboptimal to initialize the outside-object freepointer as part of init_on_free: - the freeing itself will always set it one way or another, in this case free_to_partial_list() will do set_freepointer() after free_debug_processing() - we lose the ability to detect if the allocated slab object's user wrote to it, which is a buffer overflow So the best option to me would be to adjust the init in slab_free_hook() to avoid the outside-object freepointer similarly to how it avoids the red zone. We'll still not have the buffer overflow detection ability for bulk free where slab_free_freelist_hook() will set the free pointer before we reach the checks, but changing that is most likely not worth the trouble, and especially not suitable for a stable-candidate fix we need here. >> >> The patch could also be optimized a bit by restricting set_freepointer() call to the `CONFIG_SLAB_FREELIST_HARDENED` option value. >> > > Yeah. Maybe memcg_alloc_abort_single() needs this too. > > Thanks. > >> Thanks again, Nicolas >> >>> >>> Thanks. >>> >>>> Object's freepointer thus needs to be properly set using >>>> set_freepointer() after init_on_free. >>>> >>>> To reproduce, set `slub_debug=FU init_on_free=1 log_level=7` on the >>>> command line of a kernel build with `CONFIG_SLAB_FREELIST_HARDENED=y`. >>>> >>>> dmesg sample log: >>>> [   10.708715] ============================================================================= >>>> [   10.710323] BUG kmalloc-rnd-05-32 (Tainted: G    B           T ): Freepointer corrupt >>>> [   10.712695] ----------------------------------------------------------------------------- >>>> [   10.712695] >>>> [   10.712695] Slab 0xffffd8bdc400d580 objects=32 used=4 fp=0xffff9d9a80356f80 flags=0x200000000000a00(workingset|slab|node=0|zone=2) >>>> [   10.716698] Object 0xffff9d9a80356600 @offset=1536 fp=0x7ee4f480ce0ecd7c >>>> [   10.716698] >>>> [   10.716698] Bytes b4 ffff9d9a803565f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ >>>> [   10.720703] Object   ffff9d9a80356600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ >>>> [   10.720703] Object   ffff9d9a80356610: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ >>>> [   10.724696] Padding  ffff9d9a8035666c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ >>>> [   10.724696] Padding  ffff9d9a8035667c: 00 00 00 00                                      .... >>>> [   10.724696] FIX kmalloc-rnd-05-32: Object at 0xffff9d9a80356600 not freed >>>> >>>> Signed-off-by: Nicolas Bouchinet >>>> --- >>>>   mm/slub.c | 8 +++++++- >>>>   1 file changed, 7 insertions(+), 1 deletion(-) >>>> >>>> diff --git a/mm/slub.c b/mm/slub.c >>>> index 3aa12b9b323d9..71dbff9ad8f17 100644 >>>> --- a/mm/slub.c >>>> +++ b/mm/slub.c >>>> @@ -4342,10 +4342,16 @@ static __fastpath_inline >>>>   void slab_free(struct kmem_cache *s, struct slab *slab, void *object, >>>>              unsigned long addr) >>>>   { >>>> +    bool init = false; >>>> + >>>>       memcg_slab_free_hook(s, slab, &object, 1); >>>> +    init = slab_want_init_on_free(s); >>>>   -    if (likely(slab_free_hook(s, object, slab_want_init_on_free(s)))) >>>> +    if (likely(slab_free_hook(s, object, init))) { >>>> +        if (init) >>>> +            set_freepointer(s, object, NULL); >>>>           do_slab_free(s, slab, object, object, 1, addr); >>>> +    } >>>>   } >>>>     static __fastpath_inline