linux-kernel - Re: [PATCH v3] slab: Add check for memcg_data != OBJEXTS_ALLOC_FAIL in folio_memcg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aO9okBEZiA4pCNku@hyeyoo>
Date: Wed, 15 Oct 2025 18:25:36 +0900
From: Harry Yoo <harry.yoo@...cle.com>
To: Suren Baghdasaryan <surenb@...gle.com>
Cc: Hao Ge <hao.ge@...ux.dev>, Vlastimil Babka <vbabka@...e.cz>,
        Alexei Starovoitov <ast@...nel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Johannes Weiner <hannes@...xchg.org>,
        Shakeel Butt <shakeel.butt@...ux.dev>,
        Michal Hocko <mhocko@...nel.org>,
        Roman Gushchin <roman.gushchin@...ux.dev>,
        Muchun Song <muchun.song@...ux.dev>, cgroups@...r.kernel.org,
        linux-mm@...ck.org, linux-kernel@...r.kernel.org,
        Hao Ge <gehao@...inos.cn>
Subject: Re: [PATCH v3] slab: Add check for memcg_data != OBJEXTS_ALLOC_FAIL
 in folio_memcg_kmem

On Tue, Oct 14, 2025 at 09:12:43AM -0700, Suren Baghdasaryan wrote:
> On Tue, Oct 14, 2025 at 8:28 AM Hao Ge <hao.ge@...ux.dev> wrote:
> >
> > From: Hao Ge <gehao@...inos.cn>
> >
> > Since OBJEXTS_ALLOC_FAIL and MEMCG_DATA_OBJEXTS currently share
> > the same bit position, we cannot determine whether memcg_data still
> > points to the slabobj_ext vector simply by checking
> > folio->memcg_data & MEMCG_DATA_OBJEXTS.
> >
> > If obj_exts allocation failed, slab->obj_exts is set to OBJEXTS_ALLOC_FAIL,
> > and during the release of the associated folio, the BUG check is triggered
> > because it was mistakenly assumed that a valid folio->memcg_data
> > was not cleared before freeing the folio.

nit: yesterday I was confused that this is sanity checks in buddy complaining
folio->memcg_data not being cleared, but it's actually folio_memcg_kmem()
complaining that MEMCG_OBJEXTS_DATA flag is set on non-slab folios (in
free_pages_prepare(), if PageMemcgKmem(page) -> __memcg_kmem_uncharge_page()))
So the paragraph above should be updated?

And as a side question, we clear slab->obj_exts when freeing obj_ext array,
but don't clear OBJEXTS_ALLOC_FAIL when freeing a slab? That's not good.

> > So let's check for memcg_data != OBJEXTS_ALLOC_FAIL in folio_memcg_kmem.
> >
> > Fixes: 7612833192d5 ("slab: Reuse first bit for OBJEXTS_ALLOC_FAIL")
> > Suggested-by: Harry Yoo <harry.yoo@...cle.com>
> > Signed-off-by: Hao Ge <gehao@...inos.cn>
> 
> Reviewed-by: Suren Baghdasaryan <surenb@...gle.com>
>
> nit: I think it would be helpful if the changelog explained why we
> need the additional check. We can have the same bit set in two
> different situations:
> 1. object extension vector allocation failure;
> 2. memcg_data pointing to a valid mem_cgroup.
> To distinguish between them, we need to check not only the bit itself
> but also the rest of this field. If the rest is NULL, we have case 1,
> otherwise case 2.

Agreed.

In general LGTM,
Reviewed-by: Harry Yoo <harry.yoo@...cle.com>

By the way, maybe it'd be nice to introduce a new helper function that
properly checks MEMCG_DATA_OBJEXTS flag.

> ~/slab (slab/for-next-fixes)> git grep -n MEMCG_DATA_OBJEXTS
> include/linux/memcontrol.h:337:	MEMCG_DATA_OBJEXTS = (1UL << 0),
> include/linux/memcontrol.h:344:#define __OBJEXTS_ALLOC_FAIL	MEMCG_DATA_OBJEXTS
> include/linux/memcontrol.h:358:	 * MEMCG_DATA_OBJEXTS.

> include/linux/memcontrol.h:400:	VM_BUG_ON_FOLIO(memcg_data & MEMCG_DATA_OBJEXTS, folio);
> include/linux/memcontrol.h:421:	VM_BUG_ON_FOLIO(memcg_data & MEMCG_DATA_OBJEXTS, folio);

these two,

> include/linux/memcontrol.h:492:	if (memcg_data & MEMCG_DATA_OBJEXTS)

this,

> include/linux/memcontrol.h:538:			(folio->memcg_data & MEMCG_DATA_OBJEXTS),
> include/linux/memcontrol.h:1491: * if MEMCG_DATA_OBJEXTS is set.
> mm/kfence/core.c:624:				 MEMCG_DATA_OBJEXTS;

> mm/page_owner.c:513:	if (memcg_data & MEMCG_DATA_OBJEXTS)

this,

> mm/slab.h:541:	 * MEMCG_DATA_OBJEXTS bit set or be equal to OBJEXTS_ALLOC_FAIL.
> mm/slab.h:543:	VM_BUG_ON_PAGE(obj_exts && !(obj_exts & MEMCG_DATA_OBJEXTS) &&
> mm/slub.c:2137:	new_exts |= MEMCG_DATA_OBJEXTS;
> tools/mm/show_page_info.py:55:        MEMCG_DATA_OBJEXTS = prog.constant("MEMCG_DATA_OBJEXTS").value_()

> tools/mm/show_page_info.py:59:        if memcg_data & MEMCG_DATA_OBJEXTS:

and this do not look good.

I mean technically they are fine since OBJEXTS_ALLOC_FAIL is set on
slabs only, but that's just a coincidence.

> > ---
> > v3: Simplify the solution, per Harry's suggestion in the v1 comments
> >     Add Suggested-by: Harry Yoo <harry.yoo@...cle.com>
> > ---
> >  include/linux/memcontrol.h | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
> > index 873e510d6f8d..7ed15f858dc4 100644
> > --- a/include/linux/memcontrol.h
> > +++ b/include/linux/memcontrol.h
> > @@ -534,7 +534,9 @@ static inline struct mem_cgroup *get_mem_cgroup_from_objcg(struct obj_cgroup *ob
> >  static inline bool folio_memcg_kmem(struct folio *folio)
> >  {
> >         VM_BUG_ON_PGFLAGS(PageTail(&folio->page), &folio->page);
> > -       VM_BUG_ON_FOLIO(folio->memcg_data & MEMCG_DATA_OBJEXTS, folio);
> > +       VM_BUG_ON_FOLIO((folio->memcg_data != OBJEXTS_ALLOC_FAIL) &&
> > +                       (folio->memcg_data & MEMCG_DATA_OBJEXTS),
> > +                       folio);
> >         return folio->memcg_data & MEMCG_DATA_KMEM;
> >  }
> >
> > --
> > 2.25.1

-- 
Cheers,
Harry / Hyeonggon