[PATCH 1/1] mm/slab_common: reject zero object_size before calculate_alignment

[PATCH 1/1] mm/slab_common: reject zero object_size before calculate_alignment

[Longlong Xia]

From: Longlong Xia <xialonglong@kylinos.cn>

calculate_alignment() with SLAB_HWCACHE_ALIGN halves ralign in a
while (size <= ralign / 2) loop. When size is 0, ralign eventually
reaches 0 and the condition stays true indefinitely, hanging the
kernel.

kmem_cache_sanity_check() rejected size > KMALLOC_MAX_SIZE but not
size == 0, and the sanity check is compiled out without
CONFIG_DEBUG_VM. Add a !object_size check in
__kmem_cache_create_args(), which is always compiled, and add !size
to the DEBUG_VM sanity check for diagnostics.

Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Longlong Xia <xialonglong@kylinos.cn>
---
 mm/slab_common.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/mm/slab_common.c b/mm/slab_common.c
index 657fd75776ea..209fe838fe71 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -102,7 +102,7 @@ static bool kmem_cache_is_duplicate_name(const char *name)
 
 static int kmem_cache_sanity_check(const char *name, unsigned int size)
 {
-	if (!name || in_interrupt() || size > KMALLOC_MAX_SIZE) {
+	if (!name || in_interrupt() || !size || size > KMALLOC_MAX_SIZE) {
 		pr_err("kmem_cache_create(%s) integrity check failed\n", name);
 		return -EINVAL;
 	}
@@ -354,7 +354,7 @@ struct kmem_cache *__kmem_cache_create_args(const char *name,
 		goto out_unlock;
 	}
 
-	if (flags & ~SLAB_FLAGS_PERMITTED) {
+	if (!object_size || flags & ~SLAB_FLAGS_PERMITTED) {
 		err = -EINVAL;
 		goto out_unlock;
 	}
-- 
2.43.0

Re: [PATCH 1/1] mm/slab_common: reject zero object_size before calculate_alignment

[Hao Li]

On Mon, Aug 24, 2026 at 05:24:54PM +0800, Longlong Xia wrote:
> From: Longlong Xia <xialonglong@kylinos.cn>
> 
> calculate_alignment() with SLAB_HWCACHE_ALIGN halves ralign in a
> while (size <= ralign / 2) loop. When size is 0, ralign eventually
> reaches 0 and the condition stays true indefinitely, hanging the
> kernel.
> 
> kmem_cache_sanity_check() rejected size > KMALLOC_MAX_SIZE but not
> size == 0, and the sanity check is compiled out without
> CONFIG_DEBUG_VM. Add a !object_size check in
> __kmem_cache_create_args(), which is always compiled, and add !size
> to the DEBUG_VM sanity check for diagnostics.
> 
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Longlong Xia <xialonglong@kylinos.cn>
> ---
>  mm/slab_common.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/mm/slab_common.c b/mm/slab_common.c
> index 657fd75776ea..209fe838fe71 100644
> --- a/mm/slab_common.c
> +++ b/mm/slab_common.c
> @@ -102,7 +102,7 @@ static bool kmem_cache_is_duplicate_name(const char *name)
>  
>  static int kmem_cache_sanity_check(const char *name, unsigned int size)
>  {
> -	if (!name || in_interrupt() || size > KMALLOC_MAX_SIZE) {
> +	if (!name || in_interrupt() || !size || size > KMALLOC_MAX_SIZE) {
>  		pr_err("kmem_cache_create(%s) integrity check failed\n", name);
>  		return -EINVAL;
>  	}
> @@ -354,7 +354,7 @@ struct kmem_cache *__kmem_cache_create_args(const char *name,
>  		goto out_unlock;
>  	}
>  
> -	if (flags & ~SLAB_FLAGS_PERMITTED) {
> +	if (!object_size || flags & ~SLAB_FLAGS_PERMITTED) {

under !CONFIG_DEBUG_VM, I think we ignore the sanity_check deliberately, so it
seems we don't need to add !object_size check here. right?

>  		err = -EINVAL;
>  		goto out_unlock;
>  	}
> -- 
> 2.43.0
> 

Re: [PATCH 1/1] mm/slab_common: reject zero object_size before calculate_alignment

[Longlong Xia]

在 2026/8/25 20:59, Hao Li 写道:
> On Mon, Aug 24, 2026 at 05:24:54PM +0800, Longlong Xia wrote:
>> From: Longlong Xia <xialonglong@kylinos.cn>
>>
>> calculate_alignment() with SLAB_HWCACHE_ALIGN halves ralign in a
>> while (size <= ralign / 2) loop. When size is 0, ralign eventually
>> reaches 0 and the condition stays true indefinitely, hanging the
>> kernel.
>>
>> kmem_cache_sanity_check() rejected size > KMALLOC_MAX_SIZE but not
>> size == 0, and the sanity check is compiled out without
>> CONFIG_DEBUG_VM. Add a !object_size check in
>> __kmem_cache_create_args(), which is always compiled, and add !size
>> to the DEBUG_VM sanity check for diagnostics.
>>
>> Assisted-by: Codex:gpt-5.6-sol
>> Signed-off-by: Longlong Xia <xialonglong@kylinos.cn>
>> ---
>>   mm/slab_common.c | 4 ++--
>>   1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/mm/slab_common.c b/mm/slab_common.c
>> index 657fd75776ea..209fe838fe71 100644
>> --- a/mm/slab_common.c
>> +++ b/mm/slab_common.c
>> @@ -102,7 +102,7 @@ static bool kmem_cache_is_duplicate_name(const char *name)
>>   
>>   static int kmem_cache_sanity_check(const char *name, unsigned int size)
>>   {
>> -	if (!name || in_interrupt() || size > KMALLOC_MAX_SIZE) {
>> +	if (!name || in_interrupt() || !size || size > KMALLOC_MAX_SIZE) {
>>   		pr_err("kmem_cache_create(%s) integrity check failed\n", name);
>>   		return -EINVAL;
>>   	}
>> @@ -354,7 +354,7 @@ struct kmem_cache *__kmem_cache_create_args(const char *name,
>>   		goto out_unlock;
>>   	}
>>   
>> -	if (flags & ~SLAB_FLAGS_PERMITTED) {
>> +	if (!object_size || flags & ~SLAB_FLAGS_PERMITTED) {
> under !CONFIG_DEBUG_VM, I think we ignore the sanity_check deliberately, so it
> seems we don't need to add !object_size check here. right?

Thanks for the review.

Right, agreed. The !object_size check duplicates what 
kmem_cache_sanity_check()
is for, and that one is intentionally debug-only. I'll drop the
__kmem_cache_create_args() hunk in v2 and keep only the !size addition in
kmem_cache_sanity_check().


Thanks,

Longlong

>>   		err = -EINVAL;
>>   		goto out_unlock;
>>   	}
>> -- 
>> 2.43.0
>>