[PATCH for-next v3 0/7] memcg,slab: kmalloc_nolock() fixes

["Harry Yoo (Meta)" <harry@kernel.org>]

This patchset fixes three kmalloc_nolock() bugs.

1. obj_cgroup_put() takes spinlocks in the release path when it drops
   the last reference, but it can be called from any context.

2. A spinlock may be taken in the following path and may lead
   to deadlock:

   kmalloc_nolock()
   -> slab_post_alloc_hook()
   -> memcg_slab_post_alloc_hook()
   -> memcg_alloc_abort_single().

3. irq_work_sync() is called without synchronization for rcuwait
   (on PREEMPT_RT or some architectures), potentially causing a
   hang.

Bug 1 was reported by lockdep, and bugs 2 [1] and 3 [2] were
reported by Sashiko.

This series fixes the bugs by:
- 1. Deferring obj_cgroup_release() to an irq work.
- 2. Making slab_free_hook() and memcg_alloc_abort_single() respect
     SLAB_*_NOLOCK
- 3. Serializing irq_work_sync() with a mutex

Patch 1, 4, 5 are bugfixes and others are refactoring and cleanup
patches.

Changes in v3
=============

- Rebased onto the latest slab/for-next.

- New patches and changes to existing patches were written and
  verified with AI assistance and carefully reviewed by Harry Yoo.

- Patch 1: added Vlastimil's Reviewed-by (thanks!).

- Patch 2 (new): pass free_flags to slab_free_hook() instead of adding
  a third bool, as suggested by Vlastimil.

- Patch 3 (patch 2 in v2):
  - Now handles SLAB_FREE_NOLOCK in free_flags, so callers no longer
    need the allow_spin local variables.
  - Updated the subject accordingly.
  - Addressed v2 review comments from Vlastimil (thanks!):
    - dropped the memcg_alloc_abort_single() functional change from
      the changelog, as it does not change until patch 4.

- Patch 4 (patch 4 in v2):
  - Try freeing the object to the percpu sheaves first in both
    contexts, as suggested by Alexei and Vlastimil. Dropped Vlastimil's
    Reviewed-by accordingly.
  - memcg_alloc_abort_single() now takes alloc_flags instead of a bool
    allow_spin, and converts them with a new to_free_flags() helper.

- Patch 5 (patch 5 in v2): added Vlastimil's Acked-by.

- Patch 6 (new): Make free_to_pcs() call can_free_to_pcs() and take
  free_flags instead of allow_spin.

- Patch 7 (patch 3 in v2): moved to the end of the series, after the
  fixes. Reworded the comment.

- Link to v2: https://lore.kernel.org/20261103-kmalloc-nolock-fixes-v2-0-19167cfe4779@kernel.org

[1] https://sashiko.dev/#/patchset/20260610-slab_alloc_flags-v2-0-7190909db118%40kernel.org?part=9
[2] https://sashiko.dev/#/patchset/20260615-kfree_rcu_nolock-v3-0-70a54f3775bb%40kernel.org?part=5

---
Harry Yoo (Meta) (7):
      mm/memcontrol: defer obj_cgroup_release() to irq_work
      mm/slab: pass free_flags to slab_free_hook()
      mm/slab: handle SLAB_FREE_NOLOCK in slab_free_hook() instead of open coding
      mm/slab: fix a deadlock in memcg_alloc_abort_single()
      mm/slab: serialize deferred_work_barrier()
      mm/slab: refactor free_to_pcs()
      mm/slab: call debug_locks and KCSAN checks in kfree_nolock()

 include/linux/memcontrol.h |   2 +
 mm/memcontrol.c            |  27 ++++-
 mm/slab.h                  |  14 ++-
 mm/slub.c                  | 247 ++++++++++++++++++++++++++-------------------
 4 files changed, 180 insertions(+), 110 deletions(-)
---
base-commit: a7cdd0af963a420fc0e6f20b7c8bc8d4784098db
change-id: 20260624-kmalloc-nolock-fixes-c97675328773

Best regards,
--  
Cheers,
Harry / Hyeonggon