Thread (23 messages) 23 messages, 5 authors, 1d ago

Re: [PATCH v4 5/7] mm/slab: Provide kmalloc type fallback for bucket allocations

From: Kees Cook <kees@kernel.org>
Date: 2026-10-02 22:27:05
Also in: linux-hardening, linux-mm, lkml

On Tue, Sep 22, 2026 at 11:11:58AM +0100, Pedro Falcato wrote:
Big thanks for continuing this effort :))
Thanks for starting it! :) I've had a few folks wanting it, so I'm happy
to help.
On Mon, Sep 21, 2026 at 12:58:16AM -0700, Kees Cook wrote:
[...]
quoted
+/*
+ * The kmalloc types a bucket set can hold a copy of. This is deliberately not
+ * enum kmalloc_cache_type: the KMALLOC_PARTITION copies are all "normal" to a
+ * bucket set, which already separates what they were there to separate, so
+ * indexing by those would mean up to KMALLOC_PARTITION_CACHES_NR unusable
+ * rows per set. Allocations of any type not listed here are served by the
+ * general caches.
+ */
This sounds odd. Is there a good reason why KMALLOC_PARTITIONs are kmalloc_cache_types?
Perhaps that bit should be reworked instead?
I'm not sure I follow. Do you mean the partition copies themselves
shouldn't be kmalloc_cache_types? That predates this series. For a
bucket set, they're all the same "normal" type, so a set indexed by
kmalloc_cache_type would carry rows it can never use: on x86_64 with
CONFIG_KMALLOC_PARTITION_CACHES=y, that's 20 rows (2240 bytes) per set
instead of 2 (224 bytes). I've put the numbers in the commit log for
v5.
[...]
quoted
+	if (type <= KMALLOC_PARTITION_END)
+		btype = KMEM_BUCKET_NORMAL;
+	else
+		return &kmalloc_caches[type];	/* No set holds a row for it. */
Hitting this case sounds like a bug in the kernel. WARN_ON_ONCE()?
The next patch warns where a set could have held the row but wasn't
created with it (an accounted allocation without KMEM_BUCKET_CGROUP).
What's left here are types no set can hold, like DMA and reclaimable,
and those already come from caches of their own, so falling back
doesn't lose the separation.
Otherwise LGTM.
Thanks!

-- 
Kees Cook
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help