Re: [linux-next:master] [mm/slub] 8952728641: BUG_kmem_cache:Freepointer_corrupt

Harry wrote:
> Taking a quick look...
>
> On Thu, Apr 30, 2026 at 02:16:37PM +0800, kernel test robot wrote:
> >
> >
> > Hello,
> >
> > kernel test robot noticed "BUG_kmem_cache:Freepointer_corrupt" on:
> >
> > commit: 8952728641305ebcd03e80f79b8d31bb41d6d95f ("mm/slub: defer freelist construction until after bulk allocation from a new slab")
> > https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master
> >
> > [test failed on linux-next/master 9974969c14031a097d6b45bcb7a06bb4aa525c40]
> >
> > in testcase: boot
> >
> > config: x86_64-randconfig-001-20251114
> > compiler: gcc-14
> > test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 32G
> >
> > (please refer to attached dmesg/kmsg for entire log/backtrace)
>
> [...]
>
> > [   53.929047][    T0] =============================================================================
> > [   53.931786][    T0] BUG kmem_cache (Tainted: G                T  ): Freepointer corrupt
> > [   53.934858][    T0] -----------------------------------------------------------------------------
> > [   53.934858][    T0]
> > [   53.934858][    T0] -----------------------------------------------------------------------------
> > [   53.934858][    T0]
> > [   53.939608][    T0] Slab 0xffffea0004001040 objects=9 used=1 fp=0xffff888100041200 flags=0x4000000000000000(zone=2)
> > [   53.944008][    T0] Object 0xffff888100041040 @offset=64 fp=0x64ae22a70baa83ae
> > [   53.944008][    T0]
> > [   53.944008][    T0] Object 0xffff888100041040 @offset=64 fp=0x64ae22a70baa83ae
> > [   53.944008][    T0]
> > [   53.950913][    T0] Redzone  ffff888100041000: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
> > [   53.954703][    T0] Redzone  ffff888100041010: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
> > [   53.957662][    T0] Redzone  ffff888100041020: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
> > [   53.960527][    T0] Redzone  ffff888100041030: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
> > [   53.963607][    T0] Object   ffff888100041040: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
> > [   53.966785][    T0] Object   ffff888100041050: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
> > [   53.969753][    T0] Object   ffff888100041060: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
> > [   53.972621][    T0] Object   ffff888100041070: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
> > [   53.975559][    T0] Object   ffff888100041080: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
> > [   53.978756][    T0] Object   ffff888100041090: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
> > [   53.981898][    T0] Object   ffff8881000410a0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
> > [   53.985140][    T0] Object   ffff8881000410b0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
> > [   53.988289][    T0] Object   ffff8881000410c0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
> > [   53.991279][    T0] Object   ffff8881000410d0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
> > [   53.993987][    T0] Object   ffff8881000410e0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
> > [   53.996539][    T0] Object   ffff8881000410f0: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
> > [   53.999493][    T0] Object   ffff888100041100: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
> > [   54.002253][    T0] Object   ffff888100041110: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5  kkkkkkkkkkkkkkk.
> > [   54.005170][    T0] Redzone  ffff888100041120: bb bb bb bb bb bb bb bb                          ........
> > [   54.007879][    T0] Padding  ffff888100041180: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
> > [   54.010661][    T0] Padding  ffff888100041190: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
> > [   54.013403][    T0] Padding  ffff8881000411a0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
> > [   54.016151][    T0] Padding  ffff8881000411b0: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
>
> the object content has 0x6b (POISON_FREE) and there is no free pointer
> because we skipped it when allocating objects from a new slab.
>

Hi Harry,
Many thanks for the quick review and catching this!

> > [   54.019282][    T0] Disabling lock debugging due to kernel taint
> > [   54.021208][    T0] ------------[ cut here ]------------
> > [   54.022797][    T0] WARNING: mm/slub.c:1231 at object_err+0x6c/0x7f, CPU#0: swapper/0
> > [   54.077963][    T0]  <TASK>
> > [   54.079139][    T0]  check_object.cold+0x4b/0x50
> > [   54.080583][    T0]  alloc_debug_processing+0x9b/0x180
>
> But alloc_debug_processing() always expect a valid free pointer (within
> the slab or NULL.
>
> I think it can be fixed by initializing the free pointer in
> before calling alloc_debug_processing() in alloc_single_from_new_slab().
> (with a comment explaining why)
>
> Could you respin the patch with the issue addressed, Shengming?
>

I have just finished creating the patch and running the tests. I was about to send the patch
with the fix you suggested.I’ll include the change where the free pointer is initialized before
calling alloc_debug_processing() in alloc_single_from_new_slab(), along with a comment
explaining why it's necessary.

> > [   54.082495][    T0]  alloc_single_from_new_slab+0x82/0x200
> > [   54.084323][    T0]  ? alloc_slab_obj_exts_early+0x5/0x2c0
> > [   54.086455][    T0]  ? allocate_slab+0x11b/0x380
> > [   54.087892][    T0]  ___slab_alloc+0x1ad/0x340
> > [   54.089129][    T0]  ? bootstrap+0x20/0xb0
> > [   54.090520][    T0]  kmem_cache_alloc_noprof+0x30b/0x540
> > [   54.092010][    T0]  ? bootstrap+0x20/0xb0
> > [   54.093328][    T0]  bootstrap+0x20/0xb0
> > [   54.094484][    T0]  kmem_cache_init+0xbb/0x330
> > [   54.095786][    T0]  ? preallocate_vmalloc_pages+0x1a4/0x2b0
> > [   54.097485][    T0]  mm_core_init+0x12b/0x170
> > [   54.098935][    T0]  start_kernel+0x173/0x370
> > [   54.100291][    T0]  x86_64_start_reservations+0x28/0x30
> > [   54.101912][    T0]  x86_64_start_kernel+0x131/0x140
> > [   54.103325][    T0]  common_startup_64+0xbd/0xc8
> > [   54.131853][    T0] FIX kmem_cache: Marking all objects used
>
> --
> Cheers,
> Harry / Hyeonggon

--
With Best Regards,
Shengming