Re: [PATCH] mm/slab: improve kmem_cache_alloc_bulk

[Christoph Hellwig <hch@lst.de>]

On Wed, May 27, 2026 at 07:27:17AM +0000, sashiko-bot@kernel.org wrote:
> Does this omit setting op_ctx->rsvd_page_tables.count to pt_count on success?
> Since op_ctx is initialized via memset previously, the count will remain 0,
> which could lead to memory leaks when these page tables are consumed or
> cleaned up later.

Yes, fixed.

> >  			} else {
> >  				int i;
> > -				for (i = 0; i < ret; i++)
> > +				for (i = 0; i < BULK_SIZE; i++)
> >  					fail |= check_buf(bulk_array[i], size, want_ctor, want_rcu, want_zero);
> >  				kmem_cache_free_bulk(c, ret, bulk_array);
> 
> [Severity: Low]
> Will this cause a compilation error? The local variable ret is removed from
> this scope, but it is still used in the kmem_cache_free_bulk() call above.

Yes, no idea why this didn't get included in my build after
enabling it earlier.

> 
> >  			}
> > @@ -354,17 +352,18 @@ static int __init do_kmem_cache_size_bulk(int size, int *total_failures)
> >  
> >  	c = kmem_cache_create("test_cache", size, size, 0, NULL);
> >  	for (iter = 0; (iter < maxiter) && !fail; iter++) {
> > -		num = kmem_cache_alloc_bulk(c, GFP_KERNEL, ARRAY_SIZE(objects),
> > -					    objects);
> > -		for (i = 0; i < num; i++) {
> > +		if (!kmem_cache_alloc_bulk(c, GFP_KERNEL, ARRAY_SIZE(objects),
> > +				objects))
> > +			continue;
> > +
> > +		for (i = 0; i < ARRAY_SIZE(objects); i++) {
> >  			bytes = count_nonzero_bytes(objects[i], size);
> >  			if (bytes)
> >  				fail = true;
> >  			fill_with_garbage(objects[i], size);
> >  		}
> >  
> > -		if (num)
> > -			kmem_cache_free_bulk(c, num, objects);
> > +		kmem_cache_free_bulk(c, num, objects);
> 
> [Severity: Medium]
> Is num uninitialized here? It's no longer assigned the result of the
> allocation call, so passing it to kmem_cache_free_bulk() might use
> indeterminate stack data and lead to memory corruption.

Yes, this should use ARRAY_SIZE directly as well.

> > +bool kmem_cache_alloc_bulk_noprof(struct kmem_cache *s, gfp_t flags,
> > +		size_t size, void **p)
> >  {
> >  	unsigned int i = 0;
> >  	void *kfence_obj;
> >  
> >  	if (!size)
> > -		return 0;
> > +		return false;
> 
> [Severity: High]
> Does this incorrectly report an allocation failure when size is 0?

It correctly reports one as that's how all callers treat a 0 return.

Update version in git here, not reposting until more human comments
arrive:

https://git.infradead.org/?p=users/hch/misc.git;a=shortlog;h=refs/heads/fix-kmem_cache_alloc_bulk