Re: [PATCH] mm/slab: reject unsupported kmalloc sizes

["Zi Yan" <ziy@nvidia.com>]

On Thu Aug 27, 2026 at 3:47 AM EDT, Vlastimil Babka (SUSE) wrote:
> On 8/26/26 11:52 PM, Zi Yan wrote:
>> On Wed Aug 26, 2026 at 5:47 PM EDT, Harry Yoo wrote:
>>> On Wed, Aug 26, 2026 at 11:28:12AM +0000, Vlastimil Babka (SUSE) wrote:
>>>> On 8/17/26 22:40, Zi Yan wrote:
>>>>> kmalloc is used to allocate physically contiguous memory for kernel
>>>>> allocations. For requests larger than KMALLOC_MAX_CACHE_SIZE, kmalloc uses
>>>>> the page allocator and can only support up to KMALLOC_MAX_SIZE. For request
>>>>> sizes bigger than KMALLOC_MAX_SIZE, the page allocator can emit a WARN
>>>>> because kmalloc allocates an order greater than MAX_PAGE_ORDER. Systems
>>>>> with panic_on_warn=1 crash because of this WARN. Fix it by rejecting any
>>>>> kmalloc size bigger than KMALLOC_MAX_SIZE.
>>>>>
>>>>> Fixes: aadb4bc4a1f9 ("SLUB: direct pass through of page size or higher kmalloc requests")
>>>>> Reported-by: syzbot+805630f1453e490427fa@syzkaller.appspotmail.com
>>>>> Closes: https://lore.kernel.org/all/6a820ebc.9ebadd4d.20b15e.001b.GAE@google.com/
>>>>> Tested-by: syzbot+805630f1453e490427fa@syzkaller.appspotmail.com
>>>>> Signed-off-by: Zi Yan <ziy@nvidia.com>
>>>>> Cc: stable@vger.kernel.org
>>>>> ---
>>>>> It fixes a page allocator warning (order > MAX_PAGE_ORDER) when gadgetfs
>>>>> requests excessively large memory from kmalloc. Instead of adding
>>>>> __GFP_NOWARN to suppress the warning, as was done for usbfs[1], change
>>>>> kmalloc to return NULL without a warning for this specific issue.
>>>>>
>>>>> [1] commit 4f2629ea67e72 ("USB: usbfs: Don't WARN about excessively large memory allocations")
>>>>
>>>> So I checked and for kvmalloc() we have in __kvmalloc_node_noprof()
>>>>
>>>>         /* Don't even allow crazy sizes */
>>>>         if (unlikely(size > INT_MAX)) {
>>>>                 WARN_ON_ONCE(!(flags & __GFP_NOWARN));
>>>>                 return NULL;
>>>>         }
>>>>
>>>> This comes from Linus in commit 7661809d493b4. I'd do the same thing here
>>>> then.
>>>
>>> But the purpose of this patch is to avoid the warning in the page
>>> allocator. Should we fix this in the caller (gadgetfs) then? 
>> 
>> It is fixed by: https://lore.kernel.org/all/20260820223719.A4A3C1F000E9@smtp.kernel.org/
>> 
>> Please disregard this patch, but we can keep the discussion going.
>
> I still think this patch has some value if done as proposed above. Yes
> in practice it will just replace the page allocator's warning with a
> different warning, but IMHO it's "nicer" if kmalloc() sanitizes its own

And SLAB maintainers will be Cc'd. :)

> requests to the page allocator, using the KMALLOC_MAX_SIZE value.

Like this? Or the exact pattern as kvmalloc() is preferred?


diff --git a/mm/slub.c b/mm/slub.c
index 0337e60db5ace..b562f2a6fbbee 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -5263,7 +5263,12 @@ static void *___kmalloc_large_node(size_t size, gfp_t flags, int node)
 {
 	struct page *page;
 	void *ptr = NULL;
-	unsigned int order = get_order(size);
+	unsigned int order;
+
+	if (WARN_ON_ONCE_GFP(size > KMALLOC_MAX_SIZE, flags))
+		return NULL;
+
+	order = get_order(size);
 
 	if (unlikely(flags & GFP_SLAB_BUG_MASK))
 		flags = kmalloc_fix_flags(flags);


-- 
Best Regards,
Yan, Zi