Re: [PATCH v3 01/13] mm/slab: skip kfence objects in allocation profiling

[Hao Li <hao.li@linux.dev>]

On Mon, Jul 27, 2026 at 02:53:55PM +0200, Vlastimil Babka (SUSE) wrote:
> struct kfence_metadata only contains struct slabobj_ext with
> CONFIG_MEMCG, which is then used for the "fake" slab's obj_exts field.
> If CONFIG_MEMCG is enabled, the struct can also end up used for memory
> allocation profiling. If CONFIG_MEMCG is disabled but profiling is
> enabled, it will end up allocating its obj_exts via
> prepare_slab_obj_exts_hook() and assigning them to the fake struct slab.
> These will probably then never be freed.
> 
> So things sorta work, but not always in the intended and optimal way.
> The upcoming changes to slabobj_ext layout would additionally need a
> proper refactoring to keep working.
> 
> However, there's little benefit in accounting KFENCE objects. KFENCE
> allocations are rare and there can be only CONFIG_KFENCE_NUM_OBJECTS
> (default to 255) outstanding ones at any time. For any callsite
> prominent enough in the memory allocation profiling stats, allocations
> served from KFENCE will be lost in the noise.
> 
> Thus let's not complicate things and simply stop accounting KFENCE
> objects in allocation profiling and skip them in the related slab hooks.
> 
> We also need to skip kfence objects in mark_obj_codetag_empty() in case
> a sheaf is allocated from kfence, per earlier sashiko review.
> 
> Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
> ---
>  Documentation/mm/allocation-profiling.rst | 7 +++++++
>  mm/slub.c                                 | 9 +++++++++
>  2 files changed, 16 insertions(+)
> 
> diff --git a/Documentation/mm/allocation-profiling.rst b/Documentation/mm/allocation-profiling.rst
> index 5389d241176a..d02eb54ee8f2 100644
> --- a/Documentation/mm/allocation-profiling.rst
> +++ b/Documentation/mm/allocation-profiling.rst
> @@ -112,3 +112,10 @@ break it out by rhashtable type.
>  
>  - Then, use the following form for your allocations:
>    alloc_hooks_tag(ht->your_saved_tag, kmalloc_noprof(...))
> +
> +Notes
> +=====
> +
> +- When a slab object is allocated from KFENCE, its accounting is skipped.

should this be 'allocation profiling is skipped' instead?

Otherwise, looks good to me.
Reviewed-by: Hao Li <hao.li@linux.dev>

> +  KFENCE allocations are rare and limited to a small number, so this omission
> +  is negligible.
> diff --git a/mm/slub.c b/mm/slub.c
> index 0337e60db5ac..d702d273253c 100644
> --- a/mm/slub.c
> +++ b/mm/slub.c
> @@ -2067,6 +2067,9 @@ static inline void mark_obj_codetag_empty(const void *obj)
>  	struct slab *obj_slab;
>  	unsigned long slab_exts;
>  
> +	if (is_kfence_address(obj))
> +		return;
> +
>  	obj_slab = virt_to_slab(obj);
>  	slab_exts = slab_obj_exts(obj_slab);
>  	if (slab_exts) {
> @@ -2352,6 +2355,9 @@ __alloc_tagging_slab_alloc_hook(struct kmem_cache *s, void *object, gfp_t flags,
>  	if (alloc_flags & SLAB_ALLOC_NO_RECURSE)
>  		return;
>  
> +	if (is_kfence_address(object))
> +		return;
> +
>  	slab = virt_to_slab(object);
>  	obj_exts = prepare_slab_obj_exts_hook(s, slab, flags, alloc_flags, object);
>  	/*
> @@ -2399,6 +2405,9 @@ __alloc_tagging_slab_free_hook(struct kmem_cache *s, struct slab *slab, void **p
>  	for (i = 0; i < objects; i++) {
>  		unsigned int off = obj_to_index(s, slab, p[i]);
>  
> +		if (is_kfence_address(p[i]))
> +			continue;
> +
>  		alloc_tag_sub(&slab_obj_ext(slab, obj_exts, off)->ref, s->size);
>  	}
>  	put_slab_obj_exts(obj_exts);
> 
> -- 
> 2.55.0
> 

-- 
Thanks,
Hao