From nobody Tue Sep 29 02:01:19 2026 Received: from cstnet.cn (smtp21.cstnet.cn [159.226.251.21]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 41A0A48A8C5; Thu, 13 Aug 2026 16:11:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=159.226.251.21 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786637479; cv=none; b=dJ1is3qQhgS5lpuyanS2OzfVCzsQUkD3d38tjTwrRLlBg7m1O/0dbPDSU2580+CUo5/r+x2McGSvCBQ9pEbOtymGJv8yxtozsdqVxMApUlF93Cq+TinE8NATEn34IADDQY9Q9i5K4AWUtUs9JsGcxJYgFbZkcJSOwwMstLsJzxc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786637479; c=relaxed/simple; bh=5iP7CzUJV1m049+wHStjX4JH34xKMGU8R2P0Aj+GgQ4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Lhvqntg4P7CJVjQdbbNY2t1D2blGfeX8GRMp/XMFmUhldgSFVhiC2PZoxXAHmKCFuQ1qkm8BnO+eIVMcYqMspVSQj/caEwcYqgfMhKOZofYNr1HbsCHXG1W4kVKzp6esfSEBSQYR+kHY4PbS7jC0A8eE6egYpn5Pcm5nJtLxT5Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn; spf=pass smtp.mailfrom=iscas.ac.cn; arc=none smtp.client-ip=159.226.251.21 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iscas.ac.cn Received: from localhost.localdomain (unknown [111.196.241.250]) by APP-01 (Coremail) with SMTP id qwCowAC3i++T7H1qyZF7BQ--.23471S2; Fri, 14 Aug 2026 00:11:00 +0800 (CST) From: Pengpeng Hou To: Vlastimil Babka , Andrew Morton , linux-mm@kvack.org Cc: Harry Yoo , Hao Li , Christoph Lameter , David Rientjes , Roman Gushchin , David Hildenbrand , Lorenzo Stoakes , "Liam R. Howlett" , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Jonathan Corbet , Shuah Khan , linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, Pengpeng Hou Subject: [PATCH v2 1/4] mm/slub: use a track count for user metadata sizing Date: Fri, 14 Aug 2026 00:10:59 +0800 Message-ID: <20260813161059.73855-1-pengpeng@iscas.ac.cn> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260813160825.73031-1-pengpeng@iscas.ac.cn> References: <20260813160825.73031-1-pengpeng@iscas.ac.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: qwCowAC3i++T7H1qyZF7BQ--.23471S2 X-Coremail-Antispam: 1UD129KBjvJXoWxAryrKw4rWF18Jw47uFW3Wrg_yoW5CF18pF W8K3WUAFWDJrW2gws5J397uryfArZakF47JrWIg34Fvr98t3W5XFWjy3yjyFW5Ar97u3Wf AFs5t3WjvrnFyw7anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUU9I14x267AKxVW5JVWrJwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26r4j6ryUM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r4U JVWxJr1l84ACjcxK6I8E87Iv67AKxVW8JVWxJwA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_Gr 0_Gr1UM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40Ex7xfMcIj 6xIIjxv20xvE14v26r126r1DMcIj6I8E87Iv67AKxVWUJVW8JwAm72CE4IkC6x0Yz7v_Jr 0_Gr1lF7xvr2IYc2Ij64vIr41lF7I21c0EjII2zVCS5cI20VAGYxC7M4IIrI8v6xkF7I0E 8cxan2IY04v7MxkF7I0En4kS14v26r4a6rW5MxAIw28IcxkI7VAKI48JMxC20s026xCaFV Cjc4AY6r1j6r4UMI8I3I0E5I8CrVAFwI0_Jr0_Jr4lx2IqxVCjr7xvwVAFwI0_JrI_JrWl x4CE17CEb7AF67AKxVW8ZVWrXwCIc40Y0x0EwIxGrwCI42IY6xIIjxv20xvE14v26r1I6r 4UMIIF0xvE2Ix0cI8IcVCY1x0267AKxVW8Jr0_Cr1UMIIF0xvE42xK8VAvwI8IcIk0rVWU JVWUCwCI42IY6I8E87Iv67AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJb IYCTnIWIevJa73UjIFyTuYvjTRMv31DUUUU X-CM-SenderInfo: pshqw1xhqjqxpvfd2hldfou0/ Content-Type: text/plain; charset="utf-8" SLAB_STORE_USER metadata consists of allocation and free tracks, but the object-layout calculations repeat the literal count at each offset site. Add TRACK_NR to the existing track-item enum and use it for metadata initialization, original-size placement, object-extension offsets, padding checks and cache sizing. This is a behavior-preserving preparation for extending the tracked history. Assisted-by: Codex:gpt-5 Signed-off-by: Pengpeng Hou Reviewed-by: Hao Li Reviewed-by: Harry Yoo (Meta) --- mm/slub.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/mm/slub.c b/mm/slub.c index 0337e60db5ac..0653def0fe36 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -329,7 +329,7 @@ struct track { unsigned long when; /* When did the operation occur */ }; =20 -enum track_item { TRACK_ALLOC, TRACK_FREE }; +enum track_item { TRACK_ALLOC, TRACK_FREE, TRACK_NR }; =20 #ifdef SLAB_SUPPORTS_SYSFS static int sysfs_slab_add(struct kmem_cache *); @@ -753,7 +753,7 @@ static inline void set_orig_size(struct kmem_cache *s, return; =20 p +=3D get_info_end(s); - p +=3D sizeof(struct track) * 2; + p +=3D sizeof(struct track) * TRACK_NR; =20 *(unsigned long *)p =3D orig_size; } @@ -769,7 +769,7 @@ static inline unsigned long get_orig_size(struct kmem_c= ache *s, void *object) return s->object_size; =20 p +=3D get_info_end(s); - p +=3D sizeof(struct track) * 2; + p +=3D sizeof(struct track) * TRACK_NR; =20 return *(unsigned long *)p; } @@ -887,7 +887,7 @@ static unsigned int obj_exts_offset_in_object(struct km= em_cache *s) unsigned int offset =3D get_info_end(s); =20 if (kmem_cache_debug_flags(s, SLAB_STORE_USER)) - offset +=3D sizeof(struct track) * 2; + offset +=3D sizeof(struct track) * TRACK_NR; =20 if (slub_debug_orig_size(s)) offset +=3D sizeof(unsigned long); @@ -1090,7 +1090,7 @@ static void init_tracking(struct kmem_cache *s, void = *object) return; =20 p =3D get_track(s, object, TRACK_ALLOC); - memset(p, 0, 2*sizeof(struct track)); + memset(p, 0, sizeof(struct track) * TRACK_NR); } =20 static void print_track(const char *s, struct track *t, unsigned long pr_t= ime) @@ -1199,7 +1199,7 @@ static void print_trailer(struct kmem_cache *s, struc= t slab *slab, u8 *p) off =3D get_info_end(s); =20 if (s->flags & SLAB_STORE_USER) - off +=3D 2 * sizeof(struct track); + off +=3D sizeof(struct track) * TRACK_NR; =20 if (slub_debug_orig_size(s)) off +=3D sizeof(unsigned long); @@ -1403,7 +1403,7 @@ static int check_pad_bytes(struct kmem_cache *s, stru= ct slab *slab, u8 *p) =20 if (s->flags & SLAB_STORE_USER) { /* We also have user information there */ - off +=3D 2 * sizeof(struct track); + off +=3D sizeof(struct track) * TRACK_NR; =20 if (s->flags & SLAB_KMALLOC) off +=3D sizeof(unsigned long); @@ -7895,7 +7895,7 @@ static int calculate_sizes(struct kmem_cache_args *ar= gs, struct kmem_cache *s) * Need to store information about allocs and frees after * the object. */ - size +=3D 2 * sizeof(struct track); + size +=3D sizeof(struct track) * TRACK_NR; =20 /* Save the original kmalloc request size */ if (flags & SLAB_KMALLOC) --=20 2.50.1 (Apple Git-155) From nobody Tue Sep 29 02:01:19 2026 Received: from cstnet.cn (smtp21.cstnet.cn [159.226.251.21]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7CF433644DB; Thu, 13 Aug 2026 16:12:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=159.226.251.21 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786637585; cv=none; b=bcEDaQlq7nbdjNbn2vhwTws6nbRKfRIcdIHS0Zl66kdfxKb/xUg2Ta0UXAj1NkZqHXCIAAh5H6oIM1aMbRDS9F2wp8m5p9Jehr9/xHAe+665lRqYG40LqmoyK3hVGEqtq+QDi9d4YfiEBj4V8rUXo+VAsnLWACx4l0YWC9OkS3Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786637585; c=relaxed/simple; bh=1ff+wG+sa6Xy4dzpGLnrxgFQcPwOCiE3zi7n1C8cTPk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=VCvpibJTLkW7EB3vYDkgJByyxnJ5oeWsdaQEjXKpOrLYsbwQkIDNLdGm2UKW7PIhZtC8JLwQTM6xBb7UXuxPQ2YMT5ptt1u+4l75JkG5DMDrKIgiJjHLDOwJuZlqTXbi1h62J+cmJRCm0qewXKQoH1AyAioJKNBNW4XiImSkpQ0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn; spf=pass smtp.mailfrom=iscas.ac.cn; arc=none smtp.client-ip=159.226.251.21 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iscas.ac.cn Received: from localhost.localdomain (unknown [111.196.241.250]) by APP-01 (Coremail) with SMTP id qwCowACnffH87H1qu6l7BQ--.41802S2; Fri, 14 Aug 2026 00:12:45 +0800 (CST) From: Pengpeng Hou To: Vlastimil Babka , Andrew Morton , linux-mm@kvack.org Cc: Harry Yoo , Hao Li , Christoph Lameter , David Rientjes , Roman Gushchin , David Hildenbrand , Lorenzo Stoakes , "Liam R. Howlett" , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Jonathan Corbet , Shuah Khan , linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, Pengpeng Hou Subject: [PATCH v2 2/4] mm/slub: preserve one previous object lifetime Date: Fri, 14 Aug 2026 00:12:44 +0800 Message-ID: <20260813161244.74476-1-pengpeng@iscas.ac.cn> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260813160825.73031-1-pengpeng@iscas.ac.cn> References: <20260813160825.73031-1-pengpeng@iscas.ac.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: qwCowACnffH87H1qu6l7BQ--.41802S2 X-Coremail-Antispam: 1UD129KBjvJXoWxAF4fCryrKw1kAFW5JryUAwb_yoWrtryDpF W3G3W7JFWjqr47AFZxJ3ykCr1fA395A343AFWagayruFyYqw1kJFZ7tryjvFWUAryvvasr Aws09r1FkF42vaUanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUU9a14x267AKxVW5JVWrJwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26r4j6ryUM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r4U JVWxJr1l84ACjcxK6I8E87Iv67AKxVW8JVWxJwA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_Gr 1j6F4UJwAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv 7VC0I7IYx2IY67AKxVWUAVWUtwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r 1j6r4UM4x0Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxwACI402YVCY1x02 628vn2kIc2xKxwCY1x0262kKe7AKxVW8ZVWrXwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4 IE7xkEbVWUJVW8JwC20s026c02F40E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1r MI8E67AF67kF1VAFwI0_GFv_WrylIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUCV W8JwCI42IY6xIIjxv20xvEc7CjxVAFwI0_Gr1j6F4UJwCI42IY6xAIw20EY4v20xvaj40_ Jr0_JF4lIxAIcVC2z280aVAFwI0_Jr0_Gr1lIxAIcVC2z280aVCY1x0267AKxVW8JVW8Jr UvcSsGvfC2KfnxnUUI43ZEXa7sRiKsUtUUUUU== X-CM-SenderInfo: pshqw1xhqjqxpvfd2hldfou0/ Content-Type: text/plain; charset="utf-8" SLAB_STORE_USER replaces the allocation track when an object is reused. A later stale free can then replace the free track as well, leaving the report without the completed lifetime that created the stale reference. Store one additional alloc/free pair. Before recording a new allocation, copy the current pair to the previous slots only when both records exist. Keep the current free track intact to preserve existing SLAB_STORE_USER behavior during the reuse window. Print the previous pair when available. These records are diagnostic history and do not infer semantic ownership. Assisted-by: Codex:gpt-5 Signed-off-by: Pengpeng Hou --- mm/slub.c | 45 ++++++++++++++++++++++++++++++++++++--------- 1 file changed, 36 insertions(+), 9 deletions(-) diff --git a/mm/slub.c b/mm/slub.c index 0653def0fe36..355fbffb981f 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -329,7 +329,13 @@ struct track { unsigned long when; /* When did the operation occur */ }; =20 -enum track_item { TRACK_ALLOC, TRACK_FREE, TRACK_NR }; +enum track_item { + TRACK_ALLOC, + TRACK_FREE, + TRACK_PREV_ALLOC, + TRACK_PREV_FREE, + TRACK_NR, +}; =20 #ifdef SLAB_SUPPORTS_SYSFS static int sysfs_slab_add(struct kmem_cache *); @@ -1074,12 +1080,23 @@ static void set_track_update(struct kmem_cache *s, = void *object, p->when =3D jiffies; } =20 -static __always_inline void set_track(struct kmem_cache *s, void *object, - enum track_item alloc, unsigned long addr, gfp_t gfp_flags) +static __always_inline void set_alloc_track(struct kmem_cache *s, void *ob= ject, + unsigned long addr, gfp_t gfp_flags) { depot_stack_handle_t handle =3D set_track_prepare(gfp_flags); + struct track *alloc =3D get_track(s, object, TRACK_ALLOC); + struct track *free =3D get_track(s, object, TRACK_FREE); + struct track *prev_alloc; + struct track *prev_free; + + if (alloc->addr && free->addr) { + prev_alloc =3D get_track(s, object, TRACK_PREV_ALLOC); + prev_free =3D get_track(s, object, TRACK_PREV_FREE); + *prev_alloc =3D *alloc; + *prev_free =3D *free; + } =20 - set_track_update(s, object, alloc, addr, handle); + set_track_update(s, object, TRACK_ALLOC, addr, handle); } =20 static void init_tracking(struct kmem_cache *s, void *object) @@ -1113,12 +1130,22 @@ static void print_track(const char *s, struct track= *t, unsigned long pr_time) =20 void print_tracking(struct kmem_cache *s, void *object) { + struct track *prev_alloc; unsigned long pr_time =3D jiffies; + if (!(s->flags & SLAB_STORE_USER)) return; =20 print_track("Allocated", get_track(s, object, TRACK_ALLOC), pr_time); print_track("Freed", get_track(s, object, TRACK_FREE), pr_time); + + prev_alloc =3D get_track(s, object, TRACK_PREV_ALLOC); + if (!prev_alloc->addr) + return; + + pr_err("Previous object lifetime:\n"); + print_track("Allocated", prev_alloc, pr_time); + print_track("Freed", get_track(s, object, TRACK_PREV_FREE), pr_time); } =20 static void print_slab_info(const struct slab *slab) @@ -1366,8 +1393,8 @@ check_bytes_and_report(struct kmem_cache *s, struct s= lab *slab, * * [Metadata starts at object + s->inuse] * - A. freelist pointer (if freeptr_outside_object) - * - B. alloc tracking (SLAB_STORE_USER) - * - C. free tracking (SLAB_STORE_USER) + * - B. current alloc/free tracking (SLAB_STORE_USER) + * - C. previous alloc/free tracking (SLAB_STORE_USER) * - D. original request size (SLAB_KMALLOC && SLAB_STORE_USER) * - E. KASAN metadata (if enabled) * @@ -2024,8 +2051,8 @@ static inline void slab_pad_check(struct kmem_cache *= s, struct slab *slab) {} static inline int check_object(struct kmem_cache *s, struct slab *slab, void *object, u8 val) { return 1; } static inline depot_stack_handle_t set_track_prepare(gfp_t gfp_flags) { re= turn 0; } -static inline void set_track(struct kmem_cache *s, void *object, - enum track_item alloc, unsigned long addr, gfp_t gfp_flags) {} +static inline void set_alloc_track(struct kmem_cache *s, void *object, + unsigned long addr, gfp_t gfp_flags) {} static inline void add_full(struct kmem_cache *s, struct kmem_cache_node *= n, struct slab *slab) {} static inline void remove_full(struct kmem_cache *s, struct kmem_cache_nod= e *n, @@ -4493,7 +4520,7 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_= t gfpflags, int node, =20 success: if (kmem_cache_debug_flags(s, SLAB_STORE_USER)) - set_track(s, object, TRACK_ALLOC, ac->caller_addr, gfpflags); + set_alloc_track(s, object, ac->caller_addr, gfpflags); =20 return object; } --=20 2.50.1 (Apple Git-155) From nobody Tue Sep 29 02:01:19 2026 Received: from cstnet.cn (smtp21.cstnet.cn [159.226.251.21]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ABD6D483BEA; Thu, 13 Aug 2026 16:15:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=159.226.251.21 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786637710; cv=none; b=jiF1yAG6Z7VWzqHBAHves+viJORrYobhmQ8+cOzih6NBjzyqXfu0B0SdqGe2O7kkHgkD6TkQONfu41xP/83FJXMTgK35EniIAMoIx2/3cnZnkhCyXTpxdVNDXHl9HF0EQR4qLIloYGIM6ZPQSP48vwthQqv2gvWqBzGacTmLz2E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786637710; c=relaxed/simple; bh=/b8dj4WPBJ/BF07nUnl5sh2fz/fbPpitkJRQ3E6aV9Q=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dHY7CbTEhQ3q4/wJ71O4l5HR0rMV88hrVmaIwsyNU7h3d03odB9OEjcaeM/sbNj4RPcDqus/bAVSfh3ck7ZOZ8+E3XyJSmxDedinRJLsg94l2nnPP+FYsas+goG0kth3pyh4xaC8GjxrR5h4d5LJK10F0YstJ7FWQgTn3WB4RFs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn; spf=pass smtp.mailfrom=iscas.ac.cn; arc=none smtp.client-ip=159.226.251.21 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iscas.ac.cn Received: from localhost.localdomain (unknown [111.196.241.250]) by APP-01 (Coremail) with SMTP id qwCowACHWe187X1qrr17BQ--.55428S2; Fri, 14 Aug 2026 00:14:52 +0800 (CST) From: Pengpeng Hou To: Vlastimil Babka , Andrew Morton , linux-mm@kvack.org Cc: Harry Yoo , Hao Li , Christoph Lameter , David Rientjes , Roman Gushchin , David Hildenbrand , Lorenzo Stoakes , "Liam R. Howlett" , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Jonathan Corbet , Shuah Khan , linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, Pengpeng Hou Subject: [PATCH v2 3/4] mm/slub: test previous lifetime tracking Date: Fri, 14 Aug 2026 00:14:52 +0800 Message-ID: <20260813161452.75035-1-pengpeng@iscas.ac.cn> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260813160825.73031-1-pengpeng@iscas.ac.cn> References: <20260813160825.73031-1-pengpeng@iscas.ac.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: qwCowACHWe187X1qrr17BQ--.55428S2 X-Coremail-Antispam: 1UD129KBjvJXoWxJFy7Xw47Xw4kKr1fCrWxWFg_yoWrWw13pF ZakF15Kr4UXF17XrZxCFn2kr1SvF4ktw17ArW2qrWkZr4Yqw1kAF4vkryjqFs7urWkua1a vasrt3WfGr4UZF7anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUU9S14x267AKxVW5JVWrJwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26r4j6ryUM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r4U JVWxJr1l84ACjcxK6I8E87Iv67AKxVW8JVWxJwA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_Gr 1j6F4UJwAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv 7VC0I7IYx2IY67AKxVWUAVWUtwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r 1j6r4UM4x0Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxwACI402YVCY1x02 628vn2kIc2xKxwCY1x0262kKe7AKxVW8ZVWrXwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4 IE7xkEbVWUJVW8JwC20s026c02F40E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1r MI8E67AF67kF1VAFwI0_GFv_WrylIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUCV W8JwCI42IY6xIIjxv20xvEc7CjxVAFwI0_Gr1j6F4UJwCI42IY6xAIw20EY4v20xvaj40_ Jr0_JF4lIxAIcVC2z280aVAFwI0_Jr0_Gr1lIxAIcVC2z280aVCY1x0267AKxVW8Jr0_Cr 1UYxBIdaVFxhVjvjDU0xZFpf9x0pRLIDwUUUUU= X-CM-SenderInfo: pshqw1xhqjqxpvfd2hldfou0/ Content-Type: text/plain; charset="utf-8" Add KUnit coverage for the SLAB_STORE_USER reuse transition. The test creates a non-mergeable cache, pins the task against migration, verifies that a fresh object has no previous lifetime, then frees and immediately reallocates the object and verifies that the completed pair was retained. Exclude KASAN configurations because quarantine can intentionally prevent immediate reuse. Assisted-by: Codex:gpt-5 Signed-off-by: Pengpeng Hou --- lib/tests/slub_kunit.c | 35 +++++++++++++++++++++++++++++++++++ mm/slab.h | 4 ++++ mm/slub.c | 10 ++++++++++ 3 files changed, 49 insertions(+) diff --git a/lib/tests/slub_kunit.c b/lib/tests/slub_kunit.c index fa6d31dbca16..62d0f5e64268 100644 --- a/lib/tests/slub_kunit.c +++ b/lib/tests/slub_kunit.c @@ -6,6 +6,7 @@ #include #include #include +#include #include #include #include "../mm/slab.h" @@ -106,6 +107,38 @@ static void test_first_word(struct kunit *test) kmem_cache_destroy(s); } =20 +static void test_store_user_previous_lifetime(struct kunit *test) +{ + struct kmem_cache *s; + void *p; + void *q; + + s =3D test_kmem_cache_create("TestSlub_prev_lifetime", 64, + SLAB_STORE_USER | SLAB_NO_MERGE); + migrate_disable(); + p =3D kmem_cache_alloc(s, GFP_KERNEL); + if (!p) { + KUNIT_FAIL(test, "failed to allocate the first object"); + goto out_enable; + } + KUNIT_EXPECT_FALSE(test, slab_test_has_previous_lifetime(s, p)); + + kmem_cache_free(s, p); + q =3D kmem_cache_alloc(s, GFP_KERNEL); + if (q !=3D p) { + KUNIT_FAIL(test, "freed object was not immediately reused"); + if (q) + kmem_cache_free(s, q); + goto out_enable; + } + KUNIT_EXPECT_TRUE(test, slab_test_has_previous_lifetime(s, q)); + + kmem_cache_free(s, q); +out_enable: + migrate_enable(); + kmem_cache_destroy(s); +} + static void test_clobber_50th_byte(struct kunit *test) { struct kmem_cache *s =3D test_kmem_cache_create("TestSlub_50th_word_free", @@ -395,6 +428,7 @@ static struct kunit_case test_cases[] =3D { #ifndef CONFIG_KASAN KUNIT_CASE(test_next_pointer), KUNIT_CASE(test_first_word), + KUNIT_CASE(test_store_user_previous_lifetime), KUNIT_CASE(test_clobber_50th_byte), #endif =20 @@ -419,3 +453,4 @@ kunit_test_suite(test_suite); =20 MODULE_DESCRIPTION("Kunit tests for slub allocator"); MODULE_LICENSE("GPL"); +MODULE_IMPORT_NS("EXPORTED_FOR_KUNIT_TESTING"); diff --git a/mm/slab.h b/mm/slab.h index f5e336b6b6b0..15634d9603f8 100644 --- a/mm/slab.h +++ b/mm/slab.h @@ -518,6 +518,10 @@ bool slab_in_kunit_test(void); static inline bool slab_in_kunit_test(void) { return false; } #endif =20 +#if IS_ENABLED(CONFIG_SLUB_KUNIT_TEST) +bool slab_test_has_previous_lifetime(struct kmem_cache *s, void *object); +#endif + /* * slub is about to manipulate internal object metadata. This memory lies * outside the range of the allocated object, so accessing it would normal= ly diff --git a/mm/slub.c b/mm/slub.c index 355fbffb981f..d6b7487fb300 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -46,6 +46,7 @@ #include #include #include +#include #include #include #include @@ -1148,6 +1149,15 @@ void print_tracking(struct kmem_cache *s, void *obje= ct) print_track("Freed", get_track(s, object, TRACK_PREV_FREE), pr_time); } =20 +#if IS_ENABLED(CONFIG_SLUB_KUNIT_TEST) +bool slab_test_has_previous_lifetime(struct kmem_cache *s, void *object) +{ + return get_track(s, object, TRACK_PREV_ALLOC)->addr && + get_track(s, object, TRACK_PREV_FREE)->addr; +} +EXPORT_SYMBOL_IF_KUNIT(slab_test_has_previous_lifetime); +#endif + static void print_slab_info(const struct slab *slab) { pr_err("Slab 0x%p objects=3D%u used=3D%u fp=3D0x%p flags=3D%pGp\n", --=20 2.50.1 (Apple Git-155) From nobody Tue Sep 29 02:01:19 2026 Received: from cstnet.cn (smtp21.cstnet.cn [159.226.251.21]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F01FC473C8B; Thu, 13 Aug 2026 16:18:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=159.226.251.21 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786637891; cv=none; b=HJMWzvwagTEoRXLc07cfi6hiWUpqpnFztZTRw7VN2wKFMdmXj/IX11TrzUR5MNmnO6SdFnQdoeMs0Q5uDxK3YfhKhWzIDJTUuuZCPjViT21iHjFdKhwVmSeiIq5yzegEhxJIgOMo6vYyhURDIrrt1awGLtgXGK+fo1E3n4HB28Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786637891; c=relaxed/simple; bh=/58G+5A4l5buKWSu1/wrFQaCPgjP96LYjGBNlxzj8pY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=u5KpRse1AGEnfZciMOemEkzdw6ETC7USFWkbCYP1E4X46wM5j9/BpUiNsihNRF12CQIkfbmPRNQiczU5Io0t72H6cbSMXl23B6DvYUUmyy38ipwCbrQRu+ze/GhiHM+0IoXbgB8acZo0XmMptx7N8WIKz1MESo0qOZE2jfpqW20= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn; spf=pass smtp.mailfrom=iscas.ac.cn; arc=none smtp.client-ip=159.226.251.21 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iscas.ac.cn Received: from localhost.localdomain (unknown [111.196.241.250]) by APP-01 (Coremail) with SMTP id qwCowAAHofQt7n1qad57BQ--.20463S2; Fri, 14 Aug 2026 00:17:50 +0800 (CST) From: Pengpeng Hou To: Vlastimil Babka , Andrew Morton , linux-mm@kvack.org Cc: Harry Yoo , Hao Li , Christoph Lameter , David Rientjes , Roman Gushchin , David Hildenbrand , Lorenzo Stoakes , "Liam R. Howlett" , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Jonathan Corbet , Shuah Khan , linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, Pengpeng Hou Subject: [PATCH v2 4/4] Documentation/mm: describe SLUB previous lifetime tracking Date: Fri, 14 Aug 2026 00:17:48 +0800 Message-ID: <20260813161748.76447-1-pengpeng@iscas.ac.cn> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20260813160825.73031-1-pengpeng@iscas.ac.cn> References: <20260813160825.73031-1-pengpeng@iscas.ac.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: qwCowAAHofQt7n1qad57BQ--.20463S2 X-Coremail-Antispam: 1UD129KBjvJXoW7WryfuFW5tr1ktw4xuFy8Krg_yoW8ur15pa 9rGw1xta4UGrn2kr95Ar1rKF1Sqan5uay3CF4UKr48uwn8JwnFyF4Fkrn8ZFn5AFWkCaya vrWvv3Wayw1qyrJanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUU9S14x267AKxVW5JVWrJwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26r4j6ryUM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r4U JVWxJr1l84ACjcxK6I8E87Iv67AKxVW8JVWxJwA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_Gr 1j6F4UJwAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv 7VC0I7IYx2IY67AKxVWUAVWUtwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r 1j6r4UM4x0Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxwACI402YVCY1x02 628vn2kIc2xKxwCY1x0262kKe7AKxVW8ZVWrXwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4 IE7xkEbVWUJVW8JwC20s026c02F40E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1r MI8E67AF67kF1VAFwI0_GFv_WrylIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUCV W8JwCI42IY6xIIjxv20xvEc7CjxVAFwI0_Gr1j6F4UJwCI42IY6xAIw20EY4v20xvaj40_ Jr0_JF4lIxAIcVC2z280aVAFwI0_Jr0_Gr1lIxAIcVC2z280aVCY1x0267AKxVW8Jr0_Cr 1UYxBIdaVFxhVjvjDU0xZFpf9x0pRLIDwUUUUU= X-CM-SenderInfo: pshqw1xhqjqxpvfd2hldfou0/ Content-Type: text/plain; charset="utf-8" Document that SLAB_STORE_USER now retains one previous completed allocation/free pair, show the additional report section, and state that address history is diagnostic evidence rather than semantic ownership attribution. Assisted-by: Codex:gpt-5 Signed-off-by: Pengpeng Hou --- Documentation/admin-guide/mm/slab.rst | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/Documentation/admin-guide/mm/slab.rst b/Documentation/admin-gu= ide/mm/slab.rst index 14429ab90611..5f60904b1e0b 100644 --- a/Documentation/admin-guide/mm/slab.rst +++ b/Documentation/admin-guide/mm/slab.rst @@ -49,7 +49,8 @@ Possible debug options are:: Sorry SLAB legacy issues) Z Red zoning P Poisoning (object and padding) - U User tracking (free and alloc) + U User tracking (free and alloc, plus one previous + completed object lifetime) T Trace (please only use on single slabs) A Enable failslab filter mark for the cache O Switch debugging off for caches that would have @@ -245,10 +246,20 @@ into the syslog: cpu> pid=3D INFO: Freed in age=3D cpu=3D pid=3D + INFO: Previous object lifetime: + INFO: Allocated in age=3D cpu= =3D pid=3D + INFO: Freed in age=3D cpu=3D + pid=3D =20 (Object allocation / free information is only available if SLAB_STORE_U= SER is set for the slab. slab_debug sets that option) =20 + If an object with a completed allocation/free pair is reused, user trac= king + also retains that pair as the previous object lifetime. This address hi= story + can help diagnose stale references after reuse, but it does not establi= sh + semantic ownership or identify a use-after-free root cause by itself. + 2. The object contents if an object was involved. =20 Various types of lines can follow the BUG SLUB line: --=20 2.50.1 (Apple Git-155)