From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5EF8D3E9C18; Wed, 10 Jun 2026 10:36:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781087806; cv=none; b=apiSW5tfJP78AijE8D69spllE+XI8AMMhbyw3Cg+ia30w7lQfQNBifxFuuM8BNDDPd2+hXQ1ybzXZYGFQIvveo8Z6SPcWh80pAipHp2qO2aQLYk38RMUdzw/j+LUw/JqkFu0UWqyRVaZVvuEIKWYT4UlSNXlzCIS9D2SEIgkqak= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781087806; c=relaxed/simple; bh=nnqv+N/OudUnPGE7kT0lADsRi6M3gduRPYodgTuWVVE=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=JyrMlIq0g3mzBntEuPvwqUyIJYb3BtpHlk+J0xaTJShBc75c5Rk8r/kND/ZyMzw5OPZlGUGQnD5C1wi2ttnWypRHLl7jy26P/c0l4kCDnjoSlHbj1ZSi6XWHpoxm0c62fAbcZGH1lizP5MC5DCPWh7USnKO+a/7FFPMbSHaIXDA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=EZ6Qtz5g; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="EZ6Qtz5g" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6D1821F00898; Wed, 10 Jun 2026 10:36:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1781087805; bh=CQTUqMitfqK5SwCaGpDybdGAV/jF7E+YCtgF5UZzAMY=; h=Date:Subject:To:Cc:References:From:In-Reply-To; b=EZ6Qtz5gdMn6joD4fDvudVD1fDvvX0o+8W89oZW7JfLsZpzbLBCwlOA8Voq9iO/kr aA14LfnEBNTbSyb1xHTkXJqMoGDF22+Bf9h1BARo8/KUGW8pA1nI6GHcXGjCV4yXhF YFcBaCbIEYsFWokpBZyTpNxNofl4tKiy5is7YfjRBsgsycoY7oU9oFWX6nbh0KvZwE mikZKysht9uP2cvN0kQd0mKgq7MUe9MaMTVbTq1bIWtHpe5Ohd/fFqdhAr+pXWVkKA jk+otMGHmjLlbM3VfnjBA7Kd1vMIMNFApuCKn4FVask8SpRTVlp8sRns6tfAKlXWiu 7mkbtuQaCXBkw== Message-ID: Date: Wed, 10 Jun 2026 12:36:39 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH RFC 01/15] mm/slab: always zero only requested size on alloc Content-Language: en-US To: Harry Yoo Cc: Hao Li , Christoph Lameter , David Rientjes , Roman Gushchin , Suren Baghdasaryan , Alexei Starovoitov , Andrew Morton , Johannes Weiner , Michal Hocko , Shakeel Butt , Alexander Potapenko , Marco Elver , Dmitry Vyukov , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, cgroups@vger.kernel.org References: <20260609-slab_alloc_flags-v1-0-2bf4a4b9b526@kernel.org> <20260609-slab_alloc_flags-v1-1-2bf4a4b9b526@kernel.org> From: "Vlastimil Babka (SUSE)" Autocrypt: addr=vbabka@kernel.org; keydata= xsFNBFZdmxYBEADsw/SiUSjB0dM+vSh95UkgcHjzEVBlby/Fg+g42O7LAEkCYXi/vvq31JTB KxRWDHX0R2tgpFDXHnzZcQywawu8eSq0LxzxFNYMvtB7sV1pxYwej2qx9B75qW2plBs+7+YB 87tMFA+u+L4Z5xAzIimfLD5EKC56kJ1CsXlM8S/LHcmdD9Ctkn3trYDNnat0eoAcfPIP2OZ+ 9oe9IF/R28zmh0ifLXyJQQz5ofdj4bPf8ecEW0rhcqHfTD8k4yK0xxt3xW+6Exqp9n9bydiy tcSAw/TahjW6yrA+6JhSBv1v2tIm+itQc073zjSX8OFL51qQVzRFr7H2UQG33lw2QrvHRXqD Ot7ViKam7v0Ho9wEWiQOOZlHItOOXFphWb2yq3nzrKe45oWoSgkxKb97MVsQ+q2SYjJRBBH4 8qKhphADYxkIP6yut/eaj9ImvRUZZRi0DTc8xfnvHGTjKbJzC2xpFcY0DQbZzuwsIZ8OPJCc LM4S7mT25NE5kUTG/TKQCk922vRdGVMoLA7dIQrgXnRXtyT61sg8PG4wcfOnuWf8577aXP1x 6mzw3/jh3F+oSBHb/GcLC7mvWreJifUL2gEdssGfXhGWBo6zLS3qhgtwjay0Jl+kza1lo+Cv BB2T79D4WGdDuVa4eOrQ02TxqGN7G0Biz5ZLRSFzQSQwLn8fbwARAQABzSNWbGFzdGltaWwg QmFia2EgPHZiYWJrYUBrZXJuZWwub3JnPsLBsAQTAQoAWhYhBKlA1DSZLC6OmRA9UCJPp+fM gqZkBQJqFFy6GxSAAAAAAAQADm1hbnUyLDIuNSsxLjEyLDIsMgIbAwUJGtCBUAULCQgHAwUV CgkICwUWAgMBAAIeBQIXgAAKCRAiT6fnzIKmZJIUEADFx/tREzUImHrEwVHeSvDFmA7tJysI UVrlvrM09E7GIuzphzv7jYmo8n3ANpCczLEVr4G0syYQdTigaZgv3+FQDIIzhKih1IHhu1Ei XHlywNWKnQxxQEUNi5Mwx43wQz5XVw9F1A7gtKBKNtfogO511hAbrzagrYajyQacEJ/+sfhZ 9Da8ltHIXD8pcYaHUfQgEusCgmEd9+KrUwrTbckFKmYq5chuE6yJ4J0EmWknL096jIE6CnzF FRslQ3B1UKDjxVsm1ZHfir5NeWszLkTvGFsddFaWTgh8UycESG6VQzKXjjewXu2pG7YQYRpj QKm1W5X2TkwWkXRBZTmfmbhxIUMh3+zf5wQ463rSmDN/8v81tdqBtAW6rH/kzg1GvkaTHXn0 507yEHFzBksk2viAuIxxr7km8+/KARYLIdGtx30EG8cKzAUZOK6WqxtNCsXUJNrVE8CWrCaD icoNu7Fs1c5hmPHdSTnU48ce67449DdnO4neLSNhRiGlMHJgfJUmgrxu/hcYeOZ3haWmEQ2w uW1Mh01OHi8QZHCEyAbABrPs9GUgccc/4eYXX9hIgxfSkYzn8f+8NuIFPWl/0uTvjgqU29FQ SbzOLxHq9439Ox40G5mS5eZXRGxITYR+6TXvRGI6P/264jvflnr/pDGUttaikU+0W+1uxgKH cmYbEc7ATQRbGTU1AQgAn0H6UrFiWcovkh6EXVcl+SeqyO6JHOPm+e9Wu0Vw+VIUvXZVUVVQ La1PQDUi6j00ChlcR66g9/V0sPIcSutacPKfdKYOBvzd4rlhL8rfrdEsQw5ApZxrA8kYZVMh FmBRKAa6wos25moTlMKpCWzTH84+WO5+ziCTsTUZASAToz3RdunTD+vQcHj0GqNTPAHK63sf bAB2I0BslZkXkY1RLb/YhuA6E7JyEd2pilZOrIuBGl/5q2qSakgnAVFWFBR/DO27JuAksYnq +aH8vI0xGvwn75KqSk4UzAkDzWSmO4ZHuahKtQgZNsMYV+PGayRBX9b9zbldzopoLBdqHc4n jQARAQABwsF8BBgBCgAmAhsMFiEEqUDUNJksLo6ZED1QIk+n58yCpmQFAmfIHFQFCRYU6J8A CgkQIk+n58yCpmS2PA//bqN1LfcotmArgElsa+0EGZSQlYgK48pm8WAeTXTngudP9IJ4SuKY HR5RNjHcBeqN+Me0zxRqYzRb8nGanHEkDyf4Im8DQM8d6vbyU+FcPmG4skud4kgS1zMHnlVd SXfSIwKC/hKgdHG8aBV7545Lz9X6Iohea+94wneD0aw/hqF+QWewGZhWJriWAZtvEkzNjQOi 4U9F/trLten/x7bpphDSnDMKJtITbtzATT1Dq7o7VpIUK1nCTQALMuMjKCdi8OdU/+V+R3O4 0PXWvX8qrvqYapVbZ+9KqT74FsuB0Ya9uXwgBF2Q6cRuETZk5vqaqKxzqoQZCO8AOz/58j6O 2RHNy/mZEN+7tJ5Tsq42zVJ4jxsT8b9YplavCMsnBgDeRWhcbYhCyttoL7nYISyWg4kQYZ/P wIV3OuNv2f8iKYsxNsRuClOAF82+gvqOy1/1pprFjy8uo2pkoOrb63aOP3vO5VHnRKgra6dq NcaZ+c6J4H+nEJGi2SkHAUJz5oBzuThvPudLvPA/SK8sKoM01IRxSihev/S/5WLazXB1PGem OCbvzC1IjWJJraxiDJ5IygokapUa2RP7+WBR22skQ3SSl6G107QgWKSyTOGWEaRmV53vxQLV jXuCmzSSasTL60zq5yGrT4/DYQVSNEUiUbG4pYekxJujNeEDkUlky0Y= In-Reply-To: <20260609-slab_alloc_flags-v1-1-2bf4a4b9b526@kernel.org> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 6/9/26 11:17, Vlastimil Babka (SUSE) wrote: > When zeroing on alloc is requested (by __GFP_ZERO or the init_on_alloc > parameter), we have been trying to zero the whole kmalloc bucket size > and not just requested size, if possible. > > This probably comes from the past where ksize() could be used to > discover the bucket size and use it opportunistically beyond the > requested size. This is now forbidden and enabling debugging such as > KASAN or slab's red zoning would catch this misuse. Therefore, nobody > can be relying on __GFP_ZERO zeroing beyond requested size. Well, Sashiko says I'm wrong because krealloc() might be used later and then the initially unused part might become used and we won't clear it because we don't (unless slab debugging is enabled) know the original requested size anymore. So we have to keep zeroing the full s->object_size in the cases we currently do that. > Theoretically it might still improve hardening in case of unintended > accesses beond requested size accessing some sensitive data from a > previous allocation. But then, init_on_free is probably used also for > hardening and would have cleared that. > > So the usefullness of zeroing beyond requested size is practically none > nowadays. The disadvantages for doing it are: > > - Interaction with KFENCE, which perfoms the zeroing on its own because > it has its own redzone beyond requested size. As a consequence > slab_post_alloc_hook() has an 'init' parameter which has to be > evaluated in all callers (via slab_want_init_on_alloc()). > > For kfence allocations in slab_alloc_node() this evaluation is subtly > skipped over in order to do the right thing. Other callers (i.e. > kmem_cache_alloc_bulk_noprof()) evaluate it unconditionally even if > they do end up with a kfence allocation. This is only subtly not a > problem, as those are not kmalloc allocations and are using > s->object_size as requested size, so it doesn't interfere with kfence's > redzone. There's just a unnecessary double zeroing (in both kfence and > slab_post_alloc_hook()), but it's all very fragile and contradicts the > comment in kfence_guarded_alloc(). > > - Interaction with slab's redzoning where we have to limit the zeroing > to requested size. > > We can make the code much more simple by always zeroing only up to the > requested size. Move slab_want_init_on_alloc() call to > slab_post_alloc_hook(), removing the parameter. Remove the red zone > handling. > > For kfence's zeroing code, update the comment. We could remove it > completely, but due to possible interactions with KASAN, there are > configurations where neither slab or KASAN would zero the object, > so simply do it in kfence. At worst the zeroing will happen twice, but > kfence allocations are rare by design so the cost is negligible. > > Signed-off-by: Vlastimil Babka (SUSE)