[PATCH 1/3] kfence: fix pool cleanup on metadata allocation failure

[Marco Elver]

On Mon, 26 Oct 2026 at 13:23, Jackie Liu <liu.yun at linux.dev> wrote:
>
> From: Jackie Liu <liuyun01 at kylinos.cn>
>
> kfence_init_late() saves __kfence_pool in addr before allocating the pool,
> so addr is still NULL if metadata allocation fails. The error path then
> tries to free pages using that address.
>
> Set addr after pool allocation so cleanup frees the allocated pool.
>
> Fixes: cabdf74e6b31 ("mm: kfence: allocate kfence_metadata at runtime")
> Cc: stable at vger.kernel.org
> Signed-off-by: Jackie Liu <liuyun01 at kylinos.cn>

Reviewed-by: Marco Elver <elver at google.com>

> ---
>  mm/kfence/core.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/mm/kfence/core.c b/mm/kfence/core.c
> index 90925c646c4c..6e3d01bccdf1 100644
> --- a/mm/kfence/core.c
> +++ b/mm/kfence/core.c
> @@ -999,7 +999,7 @@ static int kfence_init_late(void)
>  {
>         const unsigned long nr_pages_pool = KFENCE_POOL_SIZE / PAGE_SIZE;
>         const unsigned long nr_pages_meta = KFENCE_METADATA_SIZE / PAGE_SIZE;
> -       unsigned long addr = (unsigned long)__kfence_pool;
> +       unsigned long addr;
>         unsigned long free_size = KFENCE_POOL_SIZE;
>         int err = -ENOMEM;
>
> @@ -1032,6 +1032,7 @@ static int kfence_init_late(void)
>                                                  GFP_KERNEL | __GFP_SKIP_KASAN);
>  #endif
>
> +       addr = (unsigned long)__kfence_pool;
>         if (!kfence_metadata_init)
>                 goto free_pool;
>
> --
> 2.56.0
>