From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 21BD037DEBA for ; Thu, 4 Jun 2026 07:58:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780559918; cv=none; b=YfKIkMr5VxX0ZxHuMX8B8+43zQ60kqiktaXc39JEP65slWRbzBwFBrPhPzwaz15RsISrGvo/H4q48WSXJIvqxFsNhV1oeEJjEsyFg0kVh1zaGenYK5535So10RUpsH6Av0TYa1eGwes9k1YastXVbMFKEDRDc4MpSf+Nd8AZRHY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780559918; c=relaxed/simple; bh=Y8VU9tWOpDP1JpRgZBI+KIl5T1aASaWxflxiFgixs8I=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=JpXRLh0Cgc9mJuWSXXCwmaKd6WCtwXKH0dRbNePtx6Wx/AOISyCwbYUHVb9eImd0ucWqjx6xgo3N/Uh3a6LAszJ626hMX3ZYdvguirxMdzBX50/ALfFLmFG/aYL+6pQN6M+sJBuv6OWjcEqP9bQHcr08J2etW3OquFFp7VprDOI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=FpaLIYtj; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="FpaLIYtj" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 61D0A1F00893; Thu, 4 Jun 2026 07:58:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780559916; bh=cI/C7RCRmc8Hsh1eMUTfrVJyDrrbEkoM3eflEXaUTBE=; h=Date:Subject:To:Cc:References:From:In-Reply-To; b=FpaLIYtjwJ/lE1DJA8ORxe7LFYqGYDF+O8gjlNo1owKRCNg2b6VgTWAV+XMio2Xrv HMRMuj5xQ4rwimdfYDCWt79HMeK+3QU6Ub16tsmehrXinULX/oli/WMK+h1olshPWp jftrZ+RL8HFddxEjx8v0LgmawNo7+qPHitptILKCST7+NOp4f9DDbpGmty+YZBo4Ru FIqV06x7qcjL3lsQfKYtyip+7HmXZ2McPWlz7E9LxC7Ntj2t8IRVa3edKTDvoVDdej /RJDkNHt1+gC0GrjM2TG7DkIft/eOJeOLBQYJ53/dEaV7fLcQlptmbQHdS78sDQmIs cr1UnsIoH0Lqw== Message-ID: Date: Thu, 4 Jun 2026 09:58:32 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] mm/slub: preserve original size in _kmalloc_nolock_noprof retry path Content-Language: en-US To: Harry Yoo , hu.shengming@zte.com.cn, akpm@linux-foundation.org Cc: hao.li@linux.dev, cl@gentwo.org, rientjes@google.com, roman.gushchin@linux.dev, linux-mm@kvack.org, linux-kernel@vger.kernel.org, zhang.run@zte.com.cn, cai.qu@zte.com.cn References: <20260603211011530GqLSXP_rgcuQdR47IGQLL@zte.com.cn> <07f55792-c83f-433c-bb16-58a5824d1dd7@kernel.org> From: "Vlastimil Babka (SUSE)" Autocrypt: addr=vbabka@kernel.org; keydata= xsFNBFZdmxYBEADsw/SiUSjB0dM+vSh95UkgcHjzEVBlby/Fg+g42O7LAEkCYXi/vvq31JTB KxRWDHX0R2tgpFDXHnzZcQywawu8eSq0LxzxFNYMvtB7sV1pxYwej2qx9B75qW2plBs+7+YB 87tMFA+u+L4Z5xAzIimfLD5EKC56kJ1CsXlM8S/LHcmdD9Ctkn3trYDNnat0eoAcfPIP2OZ+ 9oe9IF/R28zmh0ifLXyJQQz5ofdj4bPf8ecEW0rhcqHfTD8k4yK0xxt3xW+6Exqp9n9bydiy tcSAw/TahjW6yrA+6JhSBv1v2tIm+itQc073zjSX8OFL51qQVzRFr7H2UQG33lw2QrvHRXqD Ot7ViKam7v0Ho9wEWiQOOZlHItOOXFphWb2yq3nzrKe45oWoSgkxKb97MVsQ+q2SYjJRBBH4 8qKhphADYxkIP6yut/eaj9ImvRUZZRi0DTc8xfnvHGTjKbJzC2xpFcY0DQbZzuwsIZ8OPJCc LM4S7mT25NE5kUTG/TKQCk922vRdGVMoLA7dIQrgXnRXtyT61sg8PG4wcfOnuWf8577aXP1x 6mzw3/jh3F+oSBHb/GcLC7mvWreJifUL2gEdssGfXhGWBo6zLS3qhgtwjay0Jl+kza1lo+Cv BB2T79D4WGdDuVa4eOrQ02TxqGN7G0Biz5ZLRSFzQSQwLn8fbwARAQABzSNWbGFzdGltaWwg QmFia2EgPHZiYWJrYUBrZXJuZWwub3JnPsLBsAQTAQoAWhYhBKlA1DSZLC6OmRA9UCJPp+fM gqZkBQJqFFy6GxSAAAAAAAQADm1hbnUyLDIuNSsxLjEyLDIsMgIbAwUJGtCBUAULCQgHAwUV CgkICwUWAgMBAAIeBQIXgAAKCRAiT6fnzIKmZJIUEADFx/tREzUImHrEwVHeSvDFmA7tJysI UVrlvrM09E7GIuzphzv7jYmo8n3ANpCczLEVr4G0syYQdTigaZgv3+FQDIIzhKih1IHhu1Ei XHlywNWKnQxxQEUNi5Mwx43wQz5XVw9F1A7gtKBKNtfogO511hAbrzagrYajyQacEJ/+sfhZ 9Da8ltHIXD8pcYaHUfQgEusCgmEd9+KrUwrTbckFKmYq5chuE6yJ4J0EmWknL096jIE6CnzF FRslQ3B1UKDjxVsm1ZHfir5NeWszLkTvGFsddFaWTgh8UycESG6VQzKXjjewXu2pG7YQYRpj QKm1W5X2TkwWkXRBZTmfmbhxIUMh3+zf5wQ463rSmDN/8v81tdqBtAW6rH/kzg1GvkaTHXn0 507yEHFzBksk2viAuIxxr7km8+/KARYLIdGtx30EG8cKzAUZOK6WqxtNCsXUJNrVE8CWrCaD icoNu7Fs1c5hmPHdSTnU48ce67449DdnO4neLSNhRiGlMHJgfJUmgrxu/hcYeOZ3haWmEQ2w uW1Mh01OHi8QZHCEyAbABrPs9GUgccc/4eYXX9hIgxfSkYzn8f+8NuIFPWl/0uTvjgqU29FQ SbzOLxHq9439Ox40G5mS5eZXRGxITYR+6TXvRGI6P/264jvflnr/pDGUttaikU+0W+1uxgKH cmYbEc7ATQRbGTU1AQgAn0H6UrFiWcovkh6EXVcl+SeqyO6JHOPm+e9Wu0Vw+VIUvXZVUVVQ La1PQDUi6j00ChlcR66g9/V0sPIcSutacPKfdKYOBvzd4rlhL8rfrdEsQw5ApZxrA8kYZVMh FmBRKAa6wos25moTlMKpCWzTH84+WO5+ziCTsTUZASAToz3RdunTD+vQcHj0GqNTPAHK63sf bAB2I0BslZkXkY1RLb/YhuA6E7JyEd2pilZOrIuBGl/5q2qSakgnAVFWFBR/DO27JuAksYnq +aH8vI0xGvwn75KqSk4UzAkDzWSmO4ZHuahKtQgZNsMYV+PGayRBX9b9zbldzopoLBdqHc4n jQARAQABwsF8BBgBCgAmAhsMFiEEqUDUNJksLo6ZED1QIk+n58yCpmQFAmfIHFQFCRYU6J8A CgkQIk+n58yCpmS2PA//bqN1LfcotmArgElsa+0EGZSQlYgK48pm8WAeTXTngudP9IJ4SuKY HR5RNjHcBeqN+Me0zxRqYzRb8nGanHEkDyf4Im8DQM8d6vbyU+FcPmG4skud4kgS1zMHnlVd SXfSIwKC/hKgdHG8aBV7545Lz9X6Iohea+94wneD0aw/hqF+QWewGZhWJriWAZtvEkzNjQOi 4U9F/trLten/x7bpphDSnDMKJtITbtzATT1Dq7o7VpIUK1nCTQALMuMjKCdi8OdU/+V+R3O4 0PXWvX8qrvqYapVbZ+9KqT74FsuB0Ya9uXwgBF2Q6cRuETZk5vqaqKxzqoQZCO8AOz/58j6O 2RHNy/mZEN+7tJ5Tsq42zVJ4jxsT8b9YplavCMsnBgDeRWhcbYhCyttoL7nYISyWg4kQYZ/P wIV3OuNv2f8iKYsxNsRuClOAF82+gvqOy1/1pprFjy8uo2pkoOrb63aOP3vO5VHnRKgra6dq NcaZ+c6J4H+nEJGi2SkHAUJz5oBzuThvPudLvPA/SK8sKoM01IRxSihev/S/5WLazXB1PGem OCbvzC1IjWJJraxiDJ5IygokapUa2RP7+WBR22skQ3SSl6G107QgWKSyTOGWEaRmV53vxQLV jXuCmzSSasTL60zq5yGrT4/DYQVSNEUiUbG4pYekxJujNeEDkUlky0Y= In-Reply-To: <07f55792-c83f-433c-bb16-58a5824d1dd7@kernel.org> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 6/4/26 07:46, Harry Yoo wrote: > > > On 6/3/26 10:10 PM, hu.shengming@zte.com.cn wrote: >> From: Shengming Hu >> >> _kmalloc_nolock_noprof() retries from the next kmalloc bucket when the >> initial allocation fails. The retry currently reuses `size` as the >> bucket selector and overwrites it with s->object_size + 1. >> >> That value is later passed as the original allocation size to >> __slab_alloc_node(), slab_post_alloc_hook() and kasan_kmalloc(). On a >> successful retry this makes KASAN/slub-debug observe the retry bucket >> selector rather than the caller requested size, potentially widening the >> valid kmalloc range and hiding overflows. > > Good catch! > >> Keep a separate `bucket_size` for choosing the retry cache and preserve >> `size`. >> >> Fixes: ("slab: Introduce kmalloc_nolock() and kfree_nolock()") >> Signed-off-by: Shengming Hu >> --- > > I want to note that this conflicts with Vlastimil's work-in-progress > feature [1] where it separately stores orig_size in struct > slab_alloc_context which naturally solves the problem. Thanks, didn't realize it was solving this problem as a side-effect, hehe. > [1] > https://git.kernel.org/pub/scm/linux/kernel/git/vbabka/linux.git/log/?h=b4/slab_alloc_flags > > No strong opinion on whether to queue this patch and then rebase > Vlastimil's work on top, or wait for Vlastimil's work to solve the > problem instead... It's better to queue fixes separately first, in case someone wants to backport them, even though stable shouldn't be really necessary here. This fix could still go to 7.2 but my series only to 7.3. >> mm/slub.c | 7 ++++--- >> 1 file changed, 4 insertions(+), 3 deletions(-) >> >> diff --git a/mm/slub.c b/mm/slub.c >> index 67abbbf68fc1..6a2b3ade3611 100644 >> --- a/mm/slub.c >> +++ b/mm/slub.c >> @@ -5350,6 +5350,7 @@ EXPORT_SYMBOL(__kmalloc_noprof); >> void *_kmalloc_nolock_noprof(DECL_TOKEN_PARAMS(size, token), gfp_t gfp_flags, int node) >> { >> gfp_t alloc_gfp = __GFP_NOWARN | __GFP_NOMEMALLOC | gfp_flags; >> + size_t bucket_size = size; >> struct kmem_cache *s; >> bool can_retry = true; >> void *ret; > > But in either way, I think it's more straightforward to introduce > orig_size as a variable to keep the original size and pass it to > __slab_alloc_node(). Agree. Because above, we wouldn't initialize bucket_size to a real bucket size, but a <=bucket size so it's misleading. >> @@ -5372,9 +5373,9 @@ void *_kmalloc_nolock_noprof(DECL_TOKEN_PARAMS(size, token), gfp_t gfp_flags, in >> return NULL; >> >> retry: >> - if (unlikely(size > KMALLOC_MAX_CACHE_SIZE)) >> + if (unlikely(bucket_size > KMALLOC_MAX_CACHE_SIZE)) >> return NULL; >> - s = kmalloc_slab(size, NULL, alloc_gfp, PASS_TOKEN_PARAM(token)); >> + s = kmalloc_slab(bucket_size, NULL, alloc_gfp, PASS_TOKEN_PARAM(token)); >> >> if (!(s->flags & __CMPXCHG_DOUBLE) && !kmem_cache_debug(s)) >> /* >> @@ -5408,7 +5409,7 @@ void *_kmalloc_nolock_noprof(DECL_TOKEN_PARAMS(size, token), gfp_t gfp_flags, in >> */ >> if (!ret && can_retry) { >> /* pick the next kmalloc bucket */ >> - size = s->object_size + 1; >> + bucket_size = s->object_size + 1; >> /* >> * Another alternative is to >> * if (memcg) alloc_gfp &= ~__GFP_ACCOUNT; >