Files
hakmem/core
Moe Charm (CI) f28cafbad3 Fix root cause: slab_index_for() offset calculation error in tiny_free_fast
ROOT CAUSE IDENTIFIED AND FIXED

Problem:
- tiny_free_fast.inc.h line 219 hardcoded 'ptr - 1' for all classes
- But C0/C7 have tiny_user_offset() = 0, C1-6 have = 1
- This caused slab_index_for() to use wrong position
- Result: Returns invalid slab_idx (e.g., 0x45c) for C0/C7 blocks
- Cascaded as: [TLS_SLL_NEXT_INVALID], [FREELIST_INVALID], [NORMALIZE_USERPTR]

Solution:
1. Call slab_index_for(ss, ptr) with USER pointer directly
   - slab_index_for() handles position calculation internally
   - Avoids hardcoded offset errors

2. Then convert USER → BASE using per-class offset
   - tiny_user_offset(class_idx) for accurate conversion
   - tiny_free_fast_ss() needs BASE pointer for next operations

Expected Impact:
 [TLS_SLL_NEXT_INVALID] eliminated
 [FREELIST_INVALID] eliminated
 [NORMALIZE_USERPTR] eliminated
 All 5 defensive layers become unnecessary
 Remove refcount pinning, guards, validations, drops

This single fix addresses the root cause of all symptoms.

Technical Details:
- slab_index_for() (superslab_inline.h line 165-192) internally calculates
  position from ptr and handles the pointer-to-offset conversion correctly
- No need to pre-convert to BASE before calling slab_index_for()
- The hardcoded 'ptr - 1' assumption was incorrect for classes with offset=0

🤖 Generated with Claude Code (https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-04 03:15:39 +09:00
..
2025-11-11 21:49:05 +09:00