[RFC PATCH] ipc/msg: Use dedicated slab buckets for msg_msgseg

[Philipp Weber <kernel@phwe.de>]

System V message queues already allocate struct msg_msg from dedicated
kmem buckets, so user-controlled variable-sized message allocations do
not share generic kmalloc buckets.

Large messages allocate additional struct msg_msgseg objects for the
remaining payload. These allocations are also user-controlled in size
and contents, but still come from generic kmalloc-cg buckets.

Allocate msg_msgseg objects from a dedicated bucket set as well, so the
segmented payload path follows the same heap-isolation model as the
main msg_msg allocation.

The free path remains unchanged because these allocations are freed
with kfree(), matching the existing msg_msg bucket allocation.

Signed-off-by: Philipp Weber <kernel@phwe.de>
---
 ipc/msgutil.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/ipc/msgutil.c b/ipc/msgutil.c
index e28f0cecb2ec..8aa8ac180317 100644
--- a/ipc/msgutil.c
+++ b/ipc/msgutil.c
@@ -40,6 +40,7 @@ struct msg_msgseg {
 #define DATALEN_SEG	((size_t)PAGE_SIZE-sizeof(struct msg_msgseg))
 
 static kmem_buckets *msg_buckets __ro_after_init;
+static kmem_buckets *msgseg_buckets __ro_after_init;
 
 static int __init init_msg_buckets(void)
 {
@@ -47,6 +48,10 @@ static int __init init_msg_buckets(void)
 					  sizeof(struct msg_msg),
 					  DATALEN_MSG, NULL);
 
+	msgseg_buckets = kmem_buckets_create("msg_msgseg", SLAB_ACCOUNT,
+					     sizeof(struct msg_msgseg),
+					     DATALEN_SEG, NULL);
+
 	return 0;
 }
 subsys_initcall(init_msg_buckets);
@@ -73,7 +78,8 @@ static struct msg_msg *alloc_msg(size_t len)
 		cond_resched();
 
 		alen = min(len, DATALEN_SEG);
-		seg = kmalloc(sizeof(*seg) + alen, GFP_KERNEL_ACCOUNT);
+		seg = kmem_buckets_alloc(msgseg_buckets,
+					 sizeof(*seg) + alen, GFP_KERNEL);
 		if (seg == NULL)
 			goto out_err;
 		*pseg = seg;

base-commit: 5200f5f493f79f14bbdc349e402a40dfb32f23c8
-- 
2.53.0