From e95e2d3f34642d1bfd97c703c23c9c282a64d686 Mon Sep 17 00:00:00 2001 From: Ran Xiaokai Date: Tue, 30 Sep 2025 06:38:31 +0000 Subject: slab: Add allow_spin check to eliminate kmemleak warnings In slab_post_alloc_hook(), kmemleak check is skipped when gfpflags_allow_spinning() returns false since commit af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") Therefore, unconditionally calling kmemleak_not_leak() in alloc_slab_obj_exts() would trigger the following warning: kmemleak: Trying to color unknown object at 0xffff8881057f5000 as Grey Call Trace: alloc_slab_obj_exts+0x1b5/0x370 __alloc_tagging_slab_alloc_hook+0x9f/0x2d0 __kmalloc_cache_noprof+0x1c4/0x5c0 __set_page_owner+0x10d/0x1c0 post_alloc_hook+0x84/0xf0 get_page_from_freelist+0x73b/0x1380 __alloc_frozen_pages_noprof+0x110/0x2c0 alloc_pages_mpol+0x44/0x140 alloc_slab_page+0xac/0x150 allocate_slab+0x78/0x3a0 ___slab_alloc+0x76b/0xed0 __slab_alloc.constprop.0+0x5a/0xb0 Add the allow_spin check in alloc_slab_obj_exts() to eliminate the above warning. Fixes: af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") Signed-off-by: Ran Xiaokai Reviewed-by: Harry Yoo Acked-by: Alexei Starovoitov Link: https://lore.kernel.org/r/20250930063831.782815-1-ranxiaokai627@163.com Signed-off-by: Vlastimil Babka --- mm/slub.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'mm') diff --git a/mm/slub.c b/mm/slub.c index 584a5ff1828b16..1433f5b988f7bf 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -2152,7 +2152,8 @@ int alloc_slab_obj_exts(struct slab *slab, struct kmem_cache *s, return 0; } - kmemleak_not_leak(vec); + if (allow_spin) + kmemleak_not_leak(vec); return 0; } -- cgit 1.2.3-korg From 83d59d81b20c09c256099d1c15d7da21969581bd Mon Sep 17 00:00:00 2001 From: Ran Xiaokai Date: Tue, 30 Sep 2025 08:34:02 +0000 Subject: slab: Fix using this_cpu_ptr() in preemptible context defer_free() maybe called in preemptible context, this will trigger the below warning message: BUG: using smp_processor_id() in preemptible [00000000] code: swapper/0/1 caller is defer_free+0x1b/0x60 Call Trace: dump_stack_lvl+0xac/0xc0 check_preemption_disabled+0xbe/0xe0 defer_free+0x1b/0x60 kfree_nolock+0x1eb/0x2b0 alloc_slab_obj_exts+0x356/0x390 __alloc_tagging_slab_alloc_hook+0xa0/0x300 __kmalloc_cache_noprof+0x1c4/0x5c0 __set_page_owner+0x10d/0x1c0 post_alloc_hook+0x84/0xf0 get_page_from_freelist+0x73b/0x1380 __alloc_frozen_pages_noprof+0x110/0x2c0 alloc_pages_mpol+0x44/0x140 alloc_slab_page+0xac/0x150 allocate_slab+0x78/0x3a0 ___slab_alloc+0x76b/0xed0 __slab_alloc.constprop.0+0x5a/0xb0 __kmalloc_noprof+0x3dc/0x6d0 __list_lru_init+0x6c/0x210 alloc_super+0x3b6/0x470 sget_fc+0x5f/0x3a0 get_tree_nodev+0x27/0x90 vfs_get_tree+0x26/0xc0 vfs_kern_mount.part.0+0xb6/0x140 kern_mount+0x24/0x40 init_pipe_fs+0x4f/0x70 do_one_initcall+0x62/0x2e0 kernel_init_freeable+0x25b/0x4b0 kernel_init+0x1a/0x1c0 ret_from_fork+0x290/0x2e0 ret_from_fork_asm+0x11/0x20 Disable preemption in defer_free() and also defer_deactivate_slab() to make it safe. [vbabka@suse.cz: disable preemption instead of using raw_cpu_ptr() per the discussion ] Fixes: af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") Signed-off-by: Ran Xiaokai Link: https://lore.kernel.org/r/20250930083402.782927-1-ranxiaokai627@163.com Acked-by: Alexei Starovoitov Signed-off-by: Vlastimil Babka --- mm/slub.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) (limited to 'mm') diff --git a/mm/slub.c b/mm/slub.c index 1433f5b988f7bf..44aa0e3f48eed3 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -6432,17 +6432,24 @@ static void free_deferred_objects(struct irq_work *work) static void defer_free(struct kmem_cache *s, void *head) { - struct defer_free *df = this_cpu_ptr(&defer_free_objects); + struct defer_free *df; + guard(preempt)(); + + df = this_cpu_ptr(&defer_free_objects); if (llist_add(head + s->offset, &df->objects)) irq_work_queue(&df->work); } static void defer_deactivate_slab(struct slab *slab, void *flush_freelist) { - struct defer_free *df = this_cpu_ptr(&defer_free_objects); + struct defer_free *df; slab->flush_freelist = flush_freelist; + + guard(preempt)(); + + df = this_cpu_ptr(&defer_free_objects); if (llist_add(&slab->llnode, &df->slabs)) irq_work_queue(&df->work); } -- cgit 1.2.3-korg From f7dfa0f31b13ee5f2ba598cdfcab9a831ed8a6b8 Mon Sep 17 00:00:00 2001 From: Kuniyuki Iwashima Date: Tue, 7 Oct 2025 05:25:33 +0000 Subject: slub: Don't call lockdep_unregister_key() for immature kmem_cache. syzbot reported the lockdep splat below in __kmem_cache_release(). [0] The problem is that __kmem_cache_release() could be called from do_kmem_cache_create() before init_kmem_cache_cpus() registers the lockdep key. Let's perform lockdep_unregister_key() only when init_kmem_cache_cpus() has been done, which we can determine by checking s->cpu_slab [0]: WARNING: CPU: 1 PID: 6128 at kernel/locking/lockdep.c:6606 lockdep_unregister_key+0x2ca/0x310 kernel/locking/lockdep.c:6606 Modules linked in: CPU: 1 UID: 0 PID: 6128 Comm: syz.4.21 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:lockdep_unregister_key+0x2ca/0x310 kernel/locking/lockdep.c:6606 Code: 50 e4 0f 48 3b 44 24 10 0f 84 26 fe ff ff e8 bd cd 17 09 e8 e8 ce 17 09 41 f7 c7 00 02 00 00 74 bd fb 40 84 ed 75 bc eb cd 90 <0f> 0b 90 e9 19 ff ff ff 90 0f 0b 90 e9 2a ff ff ff 48 c7 c7 d0 ac RSP: 0018:ffffc90003e870d0 EFLAGS: 00010002 RAX: eb1525397f5bdf00 RBX: ffff88803c121148 RCX: 1ffff920007d0dfc RDX: 0000000000000000 RSI: ffffffff8acb1500 RDI: ffffffff8b1dd0e0 RBP: 00000000ffffffea R08: ffffffff8eb5aa37 R09: 1ffffffff1d6b546 R10: dffffc0000000000 R11: fffffbfff1d6b547 R12: 0000000000000000 R13: ffff88814d1b8900 R14: 0000000000000000 R15: 0000000000000203 FS: 00007f773f75e6c0(0000) GS:ffff88812712f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffdaea3af52 CR3: 000000003a5ca000 CR4: 00000000003526f0 Call Trace: __kmem_cache_release+0xe3/0x1e0 mm/slub.c:7696 do_kmem_cache_create+0x74e/0x790 mm/slub.c:8575 create_cache mm/slab_common.c:242 [inline] __kmem_cache_create_args+0x1ce/0x330 mm/slab_common.c:340 nfsd_file_cache_init+0x1d6/0x530 fs/nfsd/filecache.c:816 nfsd_startup_generic fs/nfsd/nfssvc.c:282 [inline] nfsd_startup_net fs/nfsd/nfssvc.c:377 [inline] nfsd_svc+0x393/0x900 fs/nfsd/nfssvc.c:786 nfsd_nl_threads_set_doit+0x84a/0x960 fs/nfsd/nfsctl.c:1639 genl_family_rcv_msg_doit+0x212/0x300 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:742 ____sys_sendmsg+0x508/0x820 net/socket.c:2630 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2684 __sys_sendmsg net/socket.c:2716 [inline] __do_sys_sendmsg net/socket.c:2721 [inline] __se_sys_sendmsg net/socket.c:2719 [inline] __x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2719 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f77400eeec9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f773f75e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f7740345fa0 RCX: 00007f77400eeec9 RDX: 0000000000008004 RSI: 0000200000000180 RDI: 0000000000000006 RBP: 00007f7740171f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f7740346038 R14: 00007f7740345fa0 R15: 00007ffce616f8d8 [alexei.starovoitov@gmail.com: simplify the fix] Link: https://lore.kernel.org/all/20251007052534.2776661-1-kuniyu@google.com/ Fixes: 83382af9ddc3 ("slab: Make slub local_(try)lock more precise for LOCKDEP") Reported-by: syzbot+a6f4d69b9b23404bbabf@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68e4a3d1.a00a0220.298cc0.0471.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Signed-off-by: Vlastimil Babka --- mm/slub.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'mm') diff --git a/mm/slub.c b/mm/slub.c index 44aa0e3f48eed3..135c408e051528 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -7701,7 +7701,8 @@ void __kmem_cache_release(struct kmem_cache *s) pcs_destroy(s); #ifndef CONFIG_SLUB_TINY #ifdef CONFIG_PREEMPT_RT - lockdep_unregister_key(&s->lock_key); + if (s->cpu_slab) + lockdep_unregister_key(&s->lock_key); #endif free_percpu(s->cpu_slab); #endif -- cgit 1.2.3-korg