Re: [PATCH v4 6/7] mm/slab: Let a bucket set handle __GFP_ACCOUNT
From: Harry Yoo <harry@kernel.org>
Date: 2026-09-21 13:25:59
Also in:
linux-hardening, linux-mm, lkml
On Mon, Sep 21, 2026 at 12:58:17AM -0700, Kees Cook wrote:
quoted hunk ↗ jump to hunk
A bucket set holds one row of caches, cloned from KMALLOC_NORMAL, and an allocation of any other kmalloc type falls back to the general caches. Extend this to handle __GFP_ACCOUNT, so that a single bucket user can isolate either GFP_KERNEL or GFP_KERNEL_ACCOUNT allocations, as is needed for skb data, where AF_UNIX uses: sk->sk_allocation = GFP_KERNEL_ACCOUNT; The coverage is selected at bucket creation time: b = kmem_buckets_create_types(name, flags, 0, INT_MAX, NULL, BIT(KMEM_BUCKET_NORMAL) | BIT(KMEM_BUCKET_CGROUP)); The prior kmem_buckets_create() function keeps its name and defaults to only KMEM_BUCKET_NORMAL, leaving existing users as-is. Only the accounted type is offered. Nothing wants a reclaimable or no-obj-ext row, and of the twelve places passing GFP_DMA to an skb allocator, all rare hardware: b44, b43legacy, prestera and s390 ctcm. The choice is made at creation rather than every set getting every type because the rows, when populated, are not free. Each holds 13 caches, and a cache is a 1208 byte struct plus an unconditional per-cpu allocation, a node struct, and an entry in /proc/slabinfo and under /sys/kernel/slab. KMEM_BUCKET_CGROUP collapses to KMEM_BUCKET_NORMAL without CONFIG_MEMCG, exactly as KMALLOC_CGROUP does, so NR_KMEM_BUCKET_TYPES is 1 there and a bucket set is the same single row it is today. Where the type is asked for but the system is not creating caches of it (under "cgroup.memory=nokmem") the row is aliased to the normal one, as new_kmalloc_cache() does for the general caches, so those allocations stay isolated rather than falling back to the general caches. Built and tests pass (and skip as expected) on ARCH=x86_64 defconfig with GCC 16.2.0 in all combinations of CONFIG_SLAB_BUCKETS=y/n and CONFIG_MEMCG=y/n/y+"cgroup.memory=nokmem". Assisted-by: LLM Signed-off-by: Kees Cook <kees@kernel.org> --- Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Harry Yoo <harry@kernel.org> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Hao Li <hao.li@linux.dev> Cc: Christoph Lameter <cl@gentwo.org> Cc: David Rientjes <rientjes@google.com> Cc: Roman Gushchin <roman.gushchin@linux.dev> Cc: <redacted> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Kuniyuki Iwashima <kuniyu@google.com> Cc: <redacted> --- include/linux/slab.h | 45 ++++++++++++- mm/slab.h | 23 ++++++- lib/tests/slub_kunit.c | 65 +++++++++++++++--- mm/slab_common.c | 145 ++++++++++++++++++++++++++++++++--------- 4 files changed, 235 insertions(+), 43 deletions(-)diff --git a/lib/tests/slub_kunit.c b/lib/tests/slub_kunit.c index 823607e06248..58f800582170 100644 --- a/lib/tests/slub_kunit.c +++ b/lib/tests/slub_kunit.c@@ -723,15 +723,63 @@ static void test_kmem_buckets_type_fallback(struct kunit *test) "expected a DMA cache, got %s", c->name); } - /* Nor can one that has to be accounted. */ - if (IS_ENABLED(CONFIG_MEMCG) && !mem_cgroup_kmem_disabled()) {
Didn't take a deeper look at this yet but this is causing an error: MODPOST Module.symvers ERROR: modpost: lib/tests/slub_kunit.ko: symbol 'mem_cgroup_kmem_disabled' undefined! make[3]: *** [../scripts/Makefile.modpost:147: Module.symvers] Error 1 make[2]: *** [/var/lib/jenkins/agent/workspace/harry-linux/ARCH/x86_64/COMPILER/clang/DEBUG/light/PREEMPT/lazy/src/Makefile:2179: modpost] Error 2 make[1]: *** [/var/lib/jenkins/agent/workspace/harry-linux/ARCH/x86_64/COMPILER/clang/DEBUG/light/PREEMPT/lazy/src/Makefile:248: __sub-make] Error 2 make[1]: Leaving directory '/var/lib/jenkins/agent/workspace/harry-linux/ARCH/x86_64/COMPILER/clang/DEBUG/light/PREEMPT/lazy/src/build' make: *** [Makefile:248: __sub-make] Error 2 Build step 'Execute shell' marked build as failure -- Cheers, Harry / Hyeonggon