[PATCH v2 1/1] mm/slab_common: reject zero object_size before calculate_alignment

[PATCH v2 1/1] mm/slab_common: reject zero object_size before calculate_alignment

[Longlong Xia]

From: Longlong Xia <xialonglong@kylinos.cn>

calculate_alignment() with SLAB_HWCACHE_ALIGN halves ralign in a
while (size <= ralign / 2) loop. When size is 0, ralign eventually
reaches 0 and the condition stays true indefinitely, hanging the
kernel.

kmem_cache_sanity_check() rejected size > KMALLOC_MAX_SIZE but not
size == 0. Add !size to the check so a 0-size kmem_cache_create() is
caught on CONFIG_DEBUG_VM builds, where it can be diagnosed when it
surfaces.

Suggested-by: Hao Li <hao.li@linux.dev>
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Longlong Xia <xialonglong@kylinos.cn>
---
Changes in v2:
- Drop the !object_size check in __kmem_cache_create_args() that v1
  added to the always-compiled path, and keep the guard only in the
  debug-only kmem_cache_sanity_check(), as suggested by Hao Li.

Link: https://lore.kernel.org/all/20260824092454.1693745-1-xialonglong2025@163.com/
---
 mm/slab_common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/slab_common.c b/mm/slab_common.c
index 95ddbab290d4..e205a99d85cf 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -102,7 +102,7 @@ static bool kmem_cache_is_duplicate_name(const char *name)
 
 static int kmem_cache_sanity_check(const char *name, unsigned int size)
 {
-	if (!name || in_interrupt() || size > KMALLOC_MAX_SIZE) {
+	if (!name || in_interrupt() || !size || size > KMALLOC_MAX_SIZE) {
 		pr_err("kmem_cache_create(%s) integrity check failed\n", name);
 		return -EINVAL;
 	}
-- 
2.43.0

Re: [PATCH v2 1/1] mm/slab_common: reject zero object_size before calculate_alignment

[Hao Li]

On Wed, Aug 26, 2026 at 09:55:06AM +0800, Longlong Xia wrote:
> From: Longlong Xia <xialonglong@kylinos.cn>
> 
> calculate_alignment() with SLAB_HWCACHE_ALIGN halves ralign in a
> while (size <= ralign / 2) loop. When size is 0, ralign eventually
> reaches 0 and the condition stays true indefinitely, hanging the
> kernel.
> 
> kmem_cache_sanity_check() rejected size > KMALLOC_MAX_SIZE but not
> size == 0. Add !size to the check so a 0-size kmem_cache_create() is
> caught on CONFIG_DEBUG_VM builds, where it can be diagnosed when it
> surfaces.
> 
> Suggested-by: Hao Li <hao.li@linux.dev>
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Longlong Xia <xialonglong@kylinos.cn>
> ---
> Changes in v2:
> - Drop the !object_size check in __kmem_cache_create_args() that v1
>   added to the always-compiled path, and keep the guard only in the
>   debug-only kmem_cache_sanity_check(), as suggested by Hao Li.
> 
> Link: https://lore.kernel.org/all/20260824092454.1693745-1-xialonglong2025@163.com/
> ---
>  mm/slab_common.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/mm/slab_common.c b/mm/slab_common.c
> index 95ddbab290d4..e205a99d85cf 100644
> --- a/mm/slab_common.c
> +++ b/mm/slab_common.c
> @@ -102,7 +102,7 @@ static bool kmem_cache_is_duplicate_name(const char *name)
>  
>  static int kmem_cache_sanity_check(const char *name, unsigned int size)
>  {
> -	if (!name || in_interrupt() || size > KMALLOC_MAX_SIZE) {
> +	if (!name || in_interrupt() || !size || size > KMALLOC_MAX_SIZE) {

Looks good to me. thanks.
Reviewed-by: Hao Li <hao.li@linux.dev>

>  		pr_err("kmem_cache_create(%s) integrity check failed\n", name);
>  		return -EINVAL;
>  	}
> -- 
> 2.43.0
>