* Re: [PATCH v2 1/1] mm/slab_common: reject zero object_size before calculate_alignment
2026-08-26 1:55 [PATCH v2 1/1] mm/slab_common: reject zero object_size before calculate_alignment Longlong Xia
@ 2026-08-26 2:58 ` Hao Li
2026-08-30 15:11 ` Harry Yoo
2026-08-31 10:06 ` Vlastimil Babka (SUSE)
2 siblings, 0 replies; 4+ messages in thread
From: Hao Li @ 2026-08-26 2:58 UTC (permalink / raw)
To: Longlong Xia
Cc: vbabka, harry, akpm, cl, rientjes, roman.gushchin, linux-mm,
linux-kernel, Longlong Xia
On Wed, Aug 26, 2026 at 09:55:06AM +0800, Longlong Xia wrote:
> From: Longlong Xia <xialonglong@kylinos.cn>
>
> calculate_alignment() with SLAB_HWCACHE_ALIGN halves ralign in a
> while (size <= ralign / 2) loop. When size is 0, ralign eventually
> reaches 0 and the condition stays true indefinitely, hanging the
> kernel.
>
> kmem_cache_sanity_check() rejected size > KMALLOC_MAX_SIZE but not
> size == 0. Add !size to the check so a 0-size kmem_cache_create() is
> caught on CONFIG_DEBUG_VM builds, where it can be diagnosed when it
> surfaces.
>
> Suggested-by: Hao Li <hao.li@linux.dev>
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Longlong Xia <xialonglong@kylinos.cn>
> ---
> Changes in v2:
> - Drop the !object_size check in __kmem_cache_create_args() that v1
> added to the always-compiled path, and keep the guard only in the
> debug-only kmem_cache_sanity_check(), as suggested by Hao Li.
>
> Link: https://lore.kernel.org/all/20260824092454.1693745-1-xialonglong2025@163.com/
> ---
> mm/slab_common.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/mm/slab_common.c b/mm/slab_common.c
> index 95ddbab290d4..e205a99d85cf 100644
> --- a/mm/slab_common.c
> +++ b/mm/slab_common.c
> @@ -102,7 +102,7 @@ static bool kmem_cache_is_duplicate_name(const char *name)
>
> static int kmem_cache_sanity_check(const char *name, unsigned int size)
> {
> - if (!name || in_interrupt() || size > KMALLOC_MAX_SIZE) {
> + if (!name || in_interrupt() || !size || size > KMALLOC_MAX_SIZE) {
Looks good to me. thanks.
Reviewed-by: Hao Li <hao.li@linux.dev>
> pr_err("kmem_cache_create(%s) integrity check failed\n", name);
> return -EINVAL;
> }
> --
> 2.43.0
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH v2 1/1] mm/slab_common: reject zero object_size before calculate_alignment
2026-08-26 1:55 [PATCH v2 1/1] mm/slab_common: reject zero object_size before calculate_alignment Longlong Xia
2026-08-26 2:58 ` Hao Li
@ 2026-08-30 15:11 ` Harry Yoo
2026-08-31 10:06 ` Vlastimil Babka (SUSE)
2 siblings, 0 replies; 4+ messages in thread
From: Harry Yoo @ 2026-08-30 15:11 UTC (permalink / raw)
To: Longlong Xia
Cc: vbabka, akpm, hao.li, cl, rientjes, roman.gushchin, linux-mm,
linux-kernel, Longlong Xia
On Wed, Aug 26, 2026 at 09:55:06AM +0800, Longlong Xia wrote:
> From: Longlong Xia <xialonglong@kylinos.cn>
>
> calculate_alignment() with SLAB_HWCACHE_ALIGN halves ralign in a
> while (size <= ralign / 2) loop. When size is 0, ralign eventually
> reaches 0 and the condition stays true indefinitely, hanging the
> kernel.
>
> kmem_cache_sanity_check() rejected size > KMALLOC_MAX_SIZE but not
> size == 0. Add !size to the check so a 0-size kmem_cache_create() is
> caught on CONFIG_DEBUG_VM builds, where it can be diagnosed when it
> surfaces.
>
> Suggested-by: Hao Li <hao.li@linux.dev>
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Longlong Xia <xialonglong@kylinos.cn>
> ---
> Changes in v2:
> - Drop the !object_size check in __kmem_cache_create_args() that v1
> added to the always-compiled path, and keep the guard only in the
> debug-only kmem_cache_sanity_check(), as suggested by Hao Li.
>
> Link: https://lore.kernel.org/all/20260824092454.1693745-1-xialonglong2025@163.com/
> ---
The patch is small and benign enough, so:
Reviewed-by: Harry Yoo (Meta) <harry@kernel.org>
However, to be honest I don't understand why anyone would ever try to
create a kmem_cache with size == 0. It doesn't make any sense.
I'd strongly encourage not addressing every theoretical issue raised
by an LLM that doesn't bother you or somebody else.
--
Cheers,
Harry / Hyeonggon
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2 1/1] mm/slab_common: reject zero object_size before calculate_alignment
2026-08-26 1:55 [PATCH v2 1/1] mm/slab_common: reject zero object_size before calculate_alignment Longlong Xia
2026-08-26 2:58 ` Hao Li
2026-08-30 15:11 ` Harry Yoo
@ 2026-08-31 10:06 ` Vlastimil Babka (SUSE)
2 siblings, 0 replies; 4+ messages in thread
From: Vlastimil Babka (SUSE) @ 2026-08-31 10:06 UTC (permalink / raw)
To: Longlong Xia, harry, akpm
Cc: hao.li, cl, rientjes, roman.gushchin, linux-mm, linux-kernel,
Longlong Xia
On 8/26/26 03:55, Longlong Xia wrote:
> From: Longlong Xia <xialonglong@kylinos.cn>
>
> calculate_alignment() with SLAB_HWCACHE_ALIGN halves ralign in a
> while (size <= ralign / 2) loop. When size is 0, ralign eventually
> reaches 0 and the condition stays true indefinitely, hanging the
> kernel.
>
> kmem_cache_sanity_check() rejected size > KMALLOC_MAX_SIZE but not
> size == 0. Add !size to the check so a 0-size kmem_cache_create() is
> caught on CONFIG_DEBUG_VM builds, where it can be diagnosed when it
> surfaces.
>
> Suggested-by: Hao Li <hao.li@linux.dev>
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Longlong Xia <xialonglong@kylinos.cn>
Applied to mm/slab.git slab/for-next, thanks.
I however support Harry's suggestion wrt (not) adressing theoretical issues
like this going forward.
> ---
> Changes in v2:
> - Drop the !object_size check in __kmem_cache_create_args() that v1
> added to the always-compiled path, and keep the guard only in the
> debug-only kmem_cache_sanity_check(), as suggested by Hao Li.
>
> Link: https://lore.kernel.org/all/20260824092454.1693745-1-xialonglong2025@163.com/
> ---
> mm/slab_common.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/mm/slab_common.c b/mm/slab_common.c
> index 95ddbab290d4..e205a99d85cf 100644
> --- a/mm/slab_common.c
> +++ b/mm/slab_common.c
> @@ -102,7 +102,7 @@ static bool kmem_cache_is_duplicate_name(const char *name)
>
> static int kmem_cache_sanity_check(const char *name, unsigned int size)
> {
> - if (!name || in_interrupt() || size > KMALLOC_MAX_SIZE) {
> + if (!name || in_interrupt() || !size || size > KMALLOC_MAX_SIZE) {
> pr_err("kmem_cache_create(%s) integrity check failed\n", name);
> return -EINVAL;
> }
^ permalink raw reply [flat|nested] 4+ messages in thread