linux-kernel - Re: [PATCH v2] slab: fix kmalloc_nolock() context check for PREEMPT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAADnVQ+no23M8x-00yZXHo=0BqwwR0kyq8Z=oE9OK8G71PO5Yw@mail.gmail.com>
Date: Tue, 13 Jan 2026 15:34:04 -0800
From: Alexei Starovoitov <alexei.starovoitov@...il.com>
To: Sebastian Andrzej Siewior <bigeasy@...utronix.de>
Cc: Swaraj Gaikwad <swarajgaikwad1925@...il.com>, Vlastimil Babka <vbabka@...e.cz>, 
	Andrew Morton <akpm@...ux-foundation.org>, Christoph Lameter <cl@...two.org>, 
	David Rientjes <rientjes@...gle.com>, Roman Gushchin <roman.gushchin@...ux.dev>, 
	Harry Yoo <harry.yoo@...cle.com>, Clark Williams <clrkwllms@...nel.org>, 
	Steven Rostedt <rostedt@...dmis.org>, Alexei Starovoitov <ast@...nel.org>, 
	"open list:SLAB ALLOCATOR" <linux-mm@...ck.org>, open list <linux-kernel@...r.kernel.org>, 
	"open list:Real-time Linux (PREEMPT_RT):Keyword:PREEMPT_RT" <linux-rt-devel@...ts.linux.dev>, Shuah Khan <skhan@...uxfoundation.org>, 
	david.hunter.linux@...il.com, 
	syzbot+b1546ad4a95331b2101e@...kaller.appspotmail.com
Subject: Re: [PATCH v2] slab: fix kmalloc_nolock() context check for PREEMPT_RT

On Tue, Jan 13, 2026 at 10:00 AM Sebastian Andrzej Siewior
<bigeasy@...utronix.de> wrote:
>
> On 2026-01-13 20:36:39 [+0530], Swaraj Gaikwad wrote:
> > On PREEMPT_RT kernels, local_lock becomes a sleeping lock. The current
> > check in kmalloc_nolock() only verifies we're not in NMI or hard IRQ
> > context, but misses the case where preemption is disabled.
>
> The reasoning was different back then.
>
> > When a BPF program runs from a tracepoint with preemption disabled
> > (preempt_count > 0), kmalloc_nolock() proceeds to call
> > local_lock_irqsave() which attempts to acquire a sleeping lock,
> > triggering:
> >
> >   BUG: sleeping function called from invalid context
> >   in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6128
> >   preempt_count: 2, expected: 0
> >
> > Fix this by checking !preemptible() on PREEMPT_RT, which directly
> > expresses the constraint that we cannot take a sleeping lock when
> > preemption is disabled. This encompasses the previous checks for NMI
> > and hard IRQ contexts while also catching cases where preemption is
> > disabled.
> >
> > Fixes: af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().")
> > Reported-by: syzbot+b1546ad4a95331b2101e@...kaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=b1546ad4a95331b2101e
> > Signed-off-by: Swaraj Gaikwad <swarajgaikwad1925@...il.com>
> > ---
>
> Acked-by: Sebastian Andrzej Siewior <bigeasy@...utronix.de>
>
> for now.
>
> > Changes in v2:
> > - Simplified condition from (in_nmi() || in_hardirq() || preempt_count())
> >   to !preemptible() as suggested by Luis Claudio R. Goncalves and agreed
> >   by Vlastimil Babka
> > - Updated comment to reflect the more descriptive check
> >
> > Tested by building with syz config and running the syzbot
> > reproducer - kernel no longer crashes.
> >
> >  mm/slub.c | 8 ++++++--
> >  1 file changed, 6 insertions(+), 2 deletions(-)
> >
> > diff --git a/mm/slub.c b/mm/slub.c
> > index 2acce22590f8..642f4744d5c6 100644
> > --- a/mm/slub.c
> > +++ b/mm/slub.c
> > @@ -5689,8 +5689,12 @@ void *kmalloc_nolock_noprof(size_t size, gfp_t gfp_flags, int node)
> >       if (unlikely(!size))
> >               return ZERO_SIZE_PTR;
> >
> > -     if (IS_ENABLED(CONFIG_PREEMPT_RT) && (in_nmi() || in_hardirq()))
> > -             /* kmalloc_nolock() in PREEMPT_RT is not supported from irq */
> > +     if (IS_ENABLED(CONFIG_PREEMPT_RT) && !preemptible())
> > +             /*
> > +              * kmalloc_nolock() in PREEMPT_RT is not supported from
> > +              * non-preemptible context because local_lock becomes a
> > +              * sleeping lock on RT.
>
> I would say that despite the _nolock() suffix a local_lock() is still
> acquired. The !PREEMPT_RT does a trylock.
>
> As I noticed this myself today while looking at other patches, was the
> trylock removed on RT by accident, was it there only in an earlier
> version which was never merged and will it ever come back so we can go
> back to !nmi || !hardirq?

The root cause of this syzbot splat is preempt_disable() in
trace_virtio_transport_alloc_pkt() that is being fixed separately.
I guess this patch doesn't hurt, but I suspect with tracepoints
moving to srcu_fast syzbot won't be able to find
preempt_disable() + kmalloc_nolock() case

Acked-by: Alexei Starovoitov <ast@...nel.org>

for now :)
until shaves come.