Technical Root Cause Analysis

1. Functions, Structs, and Files Involved

• Source File: mm/slub.c
• Functions:
  • __refill_objects_node() (mm/slub.c:7265)
  • get_freelist_nofreeze() (mm/slub.c:4442)
  • get_freepointer() (mm/slub.c:557)
  • refill_objects() (mm/slub.c:7398)
  • refill_sheaf() (mm/slub.c:2876)
  • alloc_from_pcs() (mm/slub.c:4827)
• Caller Context: l2cap_chan_create() in net/bluetooth/l2cap_core.c:447 allocating a struct l2cap_chan via kzalloc_obj() from the kmalloc-2k slab cache (s->offset = 0x400 / 1024, s->size = 2048).
• Structs and Fields:
  • struct kmem_cache: s->offset (freepointer byte offset, 0x400 / 1024 for kmalloc-2k).
  • struct slab: slab->freelist and slab->counters (inuse, objects, frozen).
  • struct freelist_counters: counters union holding inuse:16, objects:15, and frozen:1.
  • struct slub_percpu_sheaves: per-CPU sheaf cache structure managing batch allocations.

2. Failure Mechanism and Invariant Violation

1. Trigger Path: A userspace process issues a socket(AF_BLUETOOTH, ...) syscall. In l2cap_chan_create(), the kernel calls kzalloc_obj(*chan, GFP_ATOMIC) to allocate struct l2cap_chan. This invokes alloc_from_pcs() in the SLUB allocator to fetch an object from the local per-CPU sheaf (PCS). Because the sheaf is empty, alloc_from_pcs() calls __pcs_replace_empty_main() $\to$ refill_sheaf() $\to$ refill_objects() $\to$ __refill_objects_node().

2. Detaching Freelist via get_freelist_nofreeze(): __refill_objects_node() calls get_partial_node_bulk() to grab partial slabs from n->partial into a local list pc.slabs. For the slab at 0xfffffdffc322ee00, get_freelist_nofreeze() is called:

   static inline void *get_freelist_nofreeze(struct kmem_cache *s, struct slab *slab,
                                             unsigned int *count)
   {
       ...
       do {
           old.freelist = slab->freelist;
           old.counters = slab->counters;
   
           new.freelist = NULL;
           new.counters = old.counters;
           new.inuse = old.objects;
       } while (!slab_update_freelist(s, slab, &old, &new, "get_freelist_nofreeze"));
   
       *count = old.objects - old.inuse;
       return old.freelist;
   }
   

   At the crash site, old.counters was 0x00080002 (objects = 8, inuse = 2), and new.counters was 0x00080008 (objects = 8, inuse = 8). Based on the counters, get_freelist_nofreeze() computed *count = old.objects - old.inuse = 6.

3. Loop Invariant Violation in __refill_objects_node(): __refill_objects_node() iterates over the detached freelist:

   object = get_freelist_nofreeze(s, slab, &count);
   
   while (count && refilled < max) {
       p[refilled] = object;
       object = get_freepointer(s, object);
       maybe_wipe_obj_freeptr(s, p[refilled]);
   
       refilled++;
       count--;
   }
   

   The loop invariant assumes that the singly-linked object freelist chain contains at least count valid objects. However:

   • On this slab, after popping 3 objects (refilled = 0, 1, 2), the third object contained 0x0 (NULL) at offset 0x400, causing object to become NULL prematurely, while 3 free objects were still accounted for by count.
   • The loop condition while (count && refilled < max) only verifies count != 0 and refilled < max, without verifying object != NULL.
   • On the 4th iteration (refilled = 3, max = 4, count > 0), p[3] = object writes NULL into the sheaf array, and the code immediately invokes:

     object = get_freepointer(s, object);
     

   • In get_freepointer():

     ptr_addr = (unsigned long)object + s->offset; // 0 + 0x400 = 0x400
     p = *(freeptr_t *)(ptr_addr);                 // ldr x28, [x8, x27] where x27=0, x8=0x400
     

   • The CPU dereferences address 0x0000000000000400, triggering a kernel translation fault / Data Abort (ESR = 0x96000005, FSC = 0x05: level 1 translation fault).

3. Direct Consequences in Production

• Memory Corruption (MemoryCorruption: true): The defect stems from slab freelist / counter corruption: the freelist pointer chain terminated prematurely while the accounting metadata (slab->objects - slab->inuse) indicated objects were still free. Furthermore, if execution did not fault at get_freepointer(), storing NULL into p[refilled] would propagate a NULL pointer into the per-CPU sheaf as a valid allocated object. A subsequent allocator caller retrieving this slot receives a NULL pointer that is treated as an active heap object, causing severe data structure inconsistency and memory corruption.
• Denial of Service (RawDenialOfService: true): The invalid memory access occurs in kernel mode during syscall processing (sys_socket), resulting in an immediate kernel oops/panic. In production kernels, this fatal data abort halts execution or crashes the active task holding critical locks.
• Information Leak (InfoLeak: "none"): Execution halts abruptly on the invalid load at 0x400. No kernel memory contents are exposed or returned to userspace.
• Network Candidate (IsNetCandidate: true): The crash occurs during network socket creation for Bluetooth L2CAP (bt_sock_create() / l2cap_sock_create() / l2cap_chan_create()).
• KVM Candidate (IsKVMCandidate: false): The issue is purely within core kernel slab memory management and the Bluetooth socket subsystem, with no relation to virtualization or KVM.