In the Linux kernel, the following vulnerability has been resolved:
mm, slab: clean up slab->obj_exts always
When memory allocation profiling is disabled at runtime or due to an error, shutdownmemprofiling() is called: slab->objexts which previously allocated remains. It won't be cleared by unaccountslab() because of memallocprofilingenabled() not true. It's incorrect, slab->objexts should always be cleaned up in unaccount_slab() to avoid following error:
[...]BUG: Bad page state in process... .. [...]page dumped because: page still charged to cgroup
[andriy.shevchenko@linux.intel.com: fold needslabobj_ext() into its only user]