* [PATCH slab/for-next 00/14] mm/slab: mandate SLAB_MAY_ACCOUNT for __GFP_ACCOUNT allocations to avoid wasting memory for slab metadata
@ 2026-10-21 11:46 Harry Yoo (Meta)
2026-10-21 11:46 ` [PATCH slab/for-next 11/14] smack: specify SLAB_MAY_ACCOUNT for smack_rule cache Harry Yoo (Meta)
0 siblings, 1 reply; 7+ messages in thread
From: Harry Yoo (Meta) @ 2026-10-21 11:46 UTC (permalink / raw)
To: Vlastimil Babka, Andrew Morton, Suren Baghdasaryan,
Johannes Weiner, Michal Hocko, Shakeel Butt, Roman Gushchin
Cc: Hao Li, Christoph Lameter, David Rientjes, Muchun Song, Hao Ge,
Pedro Falcato, linux-mm, linux-kernel, kernel-team,
Harry Yoo (Meta), Liam R. Howlett, Alice Ryhl, Andrew Ballance,
maple-tree, Matthew Wilcox, linux-fsdevel, Alexander Viro,
Christian Brauner, Jan Kara, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Jason Xing,
Willem de Bruijn, Mina Almasry, Björn Töpel,
Sebastian Andrzej Siewior, Jiayuan Chen, netdev, Kees Cook,
David Hildenbrand, Lorenzo Stoakes, Mike Rapoport, Michal Hocko,
Ingo Molnar, Peter Zijlstra, Juri Lelli, Vincent Guittot,
Dietmar Eggemann, Steven Rostedt, Ben Segall, Mel Gorman,
Valentin Schneider, K Prateek Nayak, Catalin Marinas, Will Deacon,
Mark Rutland, Anshuman Khandual, linux-arm-kernel,
Madhavan Srinivasan, Michael Ellerman, Nicholas Piggin,
Christophe Leroy (CS GROUP), linuxppc-dev, Robin Murphy,
Joerg Roedel (AMD), Niklas Schnelle, Matthew Rosato,
Gerald Schaefer, Chen-Yu Tsai, Jernej Skrabec, Samuel Holland,
iommu, linux-s390, linux-sunxi, Amir Goldstein, Casey Schaufler,
Paul Moore, James Morris, Serge E. Hallyn, linux-security-module,
Richard Weinberger, Anton Ivanov, Johannes Berg, linux-um,
cgroups
The purpose of this series is to convert existing slab users that
specify __GFP_ACCOUNT on allocations to specify SLAB_MAY_ACCOUNT on
cache creation, to reduce memory waste for slab metadata with
CONFIG_MEMCG=y && CONFIG_MEM_ALLOC_PROFILING=y.
Currently, there are two ways to charge slab objects to memory
cgroups: 1) specify SLAB_ACCOUNT during cache creation, or 2) specify
__GFP_ACCOUNT on allocation. The latter method made it impossible to
assume that certain slab caches are never charged to memory cgroups.
Since commit d4404b0f5b8b ("mm/slab: stop allocating objcg pointers when
unnecessary"), slabobj_ext allocates the space for the objcg pointer
only for caches with SLAB_MAY_ACCOUNT. However, kmem_cache_create() sets
the flag on every cache, because any cache may be used with
__GFP_ACCOUNT.
As a result, sizeof(struct obj_cgroup *) bytes are wasted for each
unaccounted slab object when both memalloc profiling and memcg are
enabled. This is suboptimal when memalloc profiling is used to
profile memory allocations on production.
So, let's make memcg charging opt-in and stop wasting memory!
New rule for slab users: a cache must specify SLAB_MAY_ACCOUNT
(explicitly or implied by SLAB_ACCOUNT) for its objects to be charged
to a memcg. Otherwise __GFP_ACCOUNT is ignored and triggers a warning on
debug kernels (CONFIG_DEBUG_VM=y).
The approach is quite straightforward, but converting all caches that
may pass __GFP_ACCOUNT without SLAB_ACCOUNT at once is not.
As a best-effort approach, I swept the whole tree (with help of an
LLM) for paths that pass __GFP_ACCOUNT into slab allocations either
directly or indirectly.
While I tried to make sure the sweep is exhaustive, there can be a
missing conversion. However that is not a correctness problem:
the objects are just no longer charged to memcgs. Patch 13 adds
VM_WARN_ON_ONCE in __memcg_slab_post_alloc_hook() to catch such a
missing conversion.
Patch 1 allows passing SLAB_MAY_ACCOUNT to kmem_cache_create(),
patches 2-12 specify SLAB_MAY_ACCOUNT for the caches found by
the sweep, and patch 14 stops setting SLAB_MAY_ACCOUNT on all caches.
On an idle x86 VM with both memalloc profiling and memcg enabled,
slabobj_ext memory (the alloc_slab_obj_exts entry in /proc/allocinfo)
drops from 1,280KB to 910KB (-29%) after boot. The savings are expected
to be larger on real workloads, which allocate far more unaccounted slab
objects (8 bytes per unaccounted slab object).
Each tested cache was verified with the warning in patch 13:
I confirmed that 1) the warning is triggered without the conversion,
and 2) specifying SLAB_MAY_ACCOUNT resolves it. However I could not test
io-pgtable_armv7s_l2 and sun50i's pt_pool caches due to lack of the
hardware and emulation support. So they are compile-tested only.
cache tested environment
--------------------- ------ -----------------------
radix_tree_node yes x86
maple_node yes x86
buffer_head yes x86
skbuff_head_cache yes x86
fanotify_*_event yes x86
smack_rule yes x86
io-pgtable_armv7s_l2 no compile-tested only
thread_stack yes ppc64le (64K pages)
pgd_cache (arm64) yes arm64 (64K pages)
PGT_CACHE (powerpc) yes ppc64le
PCI_DMA_*_tables yes s390x (zPCI + vfio)
hostfs_inode_cache yes UML
sun50i pt_pool no compile-tested only
Signed-off-by: Harry Yoo (Meta) <harry@kernel.org>
---
Harry Yoo (Meta) (14):
mm/slab: allow passing SLAB_MAY_ACCOUNT to kmem_cache_create()
lib/maple_tree: specify SLAB_MAY_ACCOUNT for maple_node cache
lib/xarray: specify SLAB_MAY_ACCOUNT for radix_tree_node cache
fs/buffer: specify SLAB_MAY_ACCOUNT for buffer_head cache
net: skbuff: specify SLAB_MAY_ACCOUNT for skbuff_head_cache
kernel/fork: specify SLAB_MAY_ACCOUNT for thread_stack cache
arm64/mm: specify SLAB_MAY_ACCOUNT for pgd_cache
powerpc/mm: specify SLAB_MAY_ACCOUNT for pgtable caches
iommu: specify SLAB_MAY_ACCOUNT for slab-backed page table caches
fanotify: specify SLAB_MAY_ACCOUNT for event caches
smack: specify SLAB_MAY_ACCOUNT for smack_rule cache
hostfs: specify SLAB_MAY_ACCOUNT for inode cache
mm/memcontrol: do not allow charging objects without SLAB_MAY_ACCOUNT
mm/slab: do not set SLAB_MAY_ACCOUNT for all caches
arch/arm64/mm/pgd.c | 2 +-
arch/powerpc/mm/init-common.c | 3 ++-
drivers/iommu/io-pgtable-arm-v7s.c | 2 +-
drivers/iommu/s390-iommu.c | 4 ++--
drivers/iommu/sun50i-iommu.c | 3 ++-
fs/buffer.c | 2 +-
fs/hostfs/hostfs_kern.c | 2 +-
fs/notify/fanotify/fanotify_user.c | 10 ++++++----
include/linux/slab.h | 16 +++++++++++++---
kernel/fork.c | 3 ++-
lib/maple_tree.c | 2 +-
lib/radix-tree.c | 2 +-
mm/memcontrol.c | 6 ++++++
mm/slab.h | 2 +-
mm/slab_common.c | 8 +++-----
net/core/skbuff.c | 2 +-
security/smack/smack_lsm.c | 2 +-
17 files changed, 45 insertions(+), 26 deletions(-)
---
base-commit: d15d7703166daf7bd62c844a3cb1b3a6279adb4c
change-id: 20261014-memalloc-prof-dont-waste-slabobj-ext-metadata-34f943ef9658
Best regards,
--
Cheers,
Harry / Hyeonggon
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH slab/for-next 11/14] smack: specify SLAB_MAY_ACCOUNT for smack_rule cache
2026-10-21 11:46 [PATCH slab/for-next 00/14] mm/slab: mandate SLAB_MAY_ACCOUNT for __GFP_ACCOUNT allocations to avoid wasting memory for slab metadata Harry Yoo (Meta)
@ 2026-10-21 11:46 ` Harry Yoo (Meta)
2026-10-21 16:59 ` Casey Schaufler
2026-10-22 11:48 ` sashiko-bot
0 siblings, 2 replies; 7+ messages in thread
From: Harry Yoo (Meta) @ 2026-10-21 11:46 UTC (permalink / raw)
To: Vlastimil Babka, Andrew Morton, Suren Baghdasaryan,
Johannes Weiner, Michal Hocko, Shakeel Butt, Roman Gushchin
Cc: Hao Li, Christoph Lameter, David Rientjes, Muchun Song, Hao Ge,
Pedro Falcato, linux-mm, linux-kernel, kernel-team,
Harry Yoo (Meta), Casey Schaufler, Paul Moore, James Morris,
Serge E. Hallyn, linux-security-module
smk_copy_rules() allocates rules with the gfp passed from
security_prepare_creds(), which is GFP_KERNEL_ACCOUNT. Specify
SLAB_MAY_ACCOUNT when the object may be charged to a memcg.
__GFP_ACCOUNT without SLAB_MAY_ACCOUNT will not be allowed.
Path: fork() -> copy_creds() -> prepare_creds()
-> security_prepare_creds(GFP_KERNEL_ACCOUNT) -> smack_cred_prepare()
-> smk_copy_rules() -> kmem_cache_zalloc(smack_rule_cache)
Assisted-by: LLM
Cc: Casey Schaufler <casey@schaufler-ca.com>
Cc: Paul Moore <paul@paul-moore.com>
Cc: James Morris <jmorris@namei.org>
Cc: "Serge E. Hallyn" <serge@hallyn.com>
Cc: linux-security-module@vger.kernel.org
Signed-off-by: Harry Yoo (Meta) <harry@kernel.org>
---
security/smack/smack_lsm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 8e88ac65fd7f..8a802578ac29 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -5352,7 +5352,7 @@ static __init int smack_init(void)
struct cred *cred = (struct cred *) current->cred;
struct task_smack *tsp;
- smack_rule_cache = KMEM_CACHE(smack_rule, 0);
+ smack_rule_cache = KMEM_CACHE(smack_rule, SLAB_MAY_ACCOUNT);
if (!smack_rule_cache)
return -ENOMEM;
--
2.54.0
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH slab/for-next 11/14] smack: specify SLAB_MAY_ACCOUNT for smack_rule cache
2026-10-21 11:46 ` [PATCH slab/for-next 11/14] smack: specify SLAB_MAY_ACCOUNT for smack_rule cache Harry Yoo (Meta)
@ 2026-10-21 16:59 ` Casey Schaufler
2026-10-21 18:48 ` Harry Yoo
2026-10-22 11:48 ` sashiko-bot
1 sibling, 1 reply; 7+ messages in thread
From: Casey Schaufler @ 2026-10-21 16:59 UTC (permalink / raw)
To: Harry Yoo (Meta), Vlastimil Babka, Andrew Morton,
Suren Baghdasaryan, Johannes Weiner, Michal Hocko, Shakeel Butt,
Roman Gushchin
Cc: Hao Li, Christoph Lameter, David Rientjes, Muchun Song, Hao Ge,
Pedro Falcato, linux-mm, linux-kernel, kernel-team, Paul Moore,
James Morris, Serge E. Hallyn, linux-security-module,
Casey Schaufler
On 10/21/2026 4:46 AM, Harry Yoo (Meta) wrote:
> smk_copy_rules() allocates rules with the gfp passed from
> security_prepare_creds(), which is GFP_KERNEL_ACCOUNT. Specify
> SLAB_MAY_ACCOUNT when the object may be charged to a memcg.
> __GFP_ACCOUNT without SLAB_MAY_ACCOUNT will not be allowed.
>
> Path: fork() -> copy_creds() -> prepare_creds()
> -> security_prepare_creds(GFP_KERNEL_ACCOUNT) -> smack_cred_prepare()
> -> smk_copy_rules() -> kmem_cache_zalloc(smack_rule_cache)
>
> Assisted-by: LLM
> Cc: Casey Schaufler <casey@schaufler-ca.com>
> Cc: Paul Moore <paul@paul-moore.com>
> Cc: James Morris <jmorris@namei.org>
> Cc: "Serge E. Hallyn" <serge@hallyn.com>
> Cc: linux-security-module@vger.kernel.org
> Signed-off-by: Harry Yoo (Meta) <harry@kernel.org>
How was this change tested?
> ---
> security/smack/smack_lsm.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
> index 8e88ac65fd7f..8a802578ac29 100644
> --- a/security/smack/smack_lsm.c
> +++ b/security/smack/smack_lsm.c
> @@ -5352,7 +5352,7 @@ static __init int smack_init(void)
> struct cred *cred = (struct cred *) current->cred;
> struct task_smack *tsp;
>
> - smack_rule_cache = KMEM_CACHE(smack_rule, 0);
> + smack_rule_cache = KMEM_CACHE(smack_rule, SLAB_MAY_ACCOUNT);
> if (!smack_rule_cache)
> return -ENOMEM;
>
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH slab/for-next 11/14] smack: specify SLAB_MAY_ACCOUNT for smack_rule cache
2026-10-21 16:59 ` Casey Schaufler
@ 2026-10-21 18:48 ` Harry Yoo
2026-10-21 19:14 ` Casey Schaufler
0 siblings, 1 reply; 7+ messages in thread
From: Harry Yoo @ 2026-10-21 18:48 UTC (permalink / raw)
To: Casey Schaufler
Cc: Vlastimil Babka, Andrew Morton, Suren Baghdasaryan,
Johannes Weiner, Michal Hocko, Shakeel Butt, Roman Gushchin,
Hao Li, Christoph Lameter, David Rientjes, Muchun Song, Hao Ge,
Pedro Falcato, linux-mm, linux-kernel, kernel-team, Paul Moore,
James Morris, Serge E. Hallyn, linux-security-module
On Wed, Oct 21, 2026 at 09:59:15AM -0700, Casey Schaufler wrote:
> On 10/21/2026 4:46 AM, Harry Yoo (Meta) wrote:
> > smk_copy_rules() allocates rules with the gfp passed from
> > security_prepare_creds(), which is GFP_KERNEL_ACCOUNT. Specify
> > SLAB_MAY_ACCOUNT when the object may be charged to a memcg.
> > __GFP_ACCOUNT without SLAB_MAY_ACCOUNT will not be allowed.
> >
> > Path: fork() -> copy_creds() -> prepare_creds()
> > -> security_prepare_creds(GFP_KERNEL_ACCOUNT) -> smack_cred_prepare()
> > -> smk_copy_rules() -> kmem_cache_zalloc(smack_rule_cache)
> >
> > Assisted-by: LLM
> > Cc: Casey Schaufler <casey@schaufler-ca.com>
> > Cc: Paul Moore <paul@paul-moore.com>
> > Cc: James Morris <jmorris@namei.org>
> > Cc: "Serge E. Hallyn" <serge@hallyn.com>
> > Cc: linux-security-module@vger.kernel.org
> > Signed-off-by: Harry Yoo (Meta) <harry@kernel.org>
>
> How was this change tested?
From the cover letter:
> Each tested cache was verified with the warning in patch 13:
> I confirmed that 1) the warning is triggered without the conversion,
> and 2) specifying SLAB_MAY_ACCOUNT resolves it. However I could not test
> io-pgtable_armv7s_l2 and sun50i's pt_pool caches due to lack of the
> hardware and emulation support. So they are compile-tested only.
>
> cache tested environment
> --------------------- ------ -----------------------
> radix_tree_node yes x86
> maple_node yes x86
> buffer_head yes x86
> skbuff_head_cache yes x86
> fanotify_*_event yes x86
> smack_rule yes x86
Good, this can be reasonably tested.
Let me write down instructions to replay this testing.
> io-pgtable_armv7s_l2 no compile-tested only
> thread_stack yes ppc64le (64K pages)
> pgd_cache (arm64) yes arm64 (64K pages)
> PGT_CACHE (powerpc) yes ppc64le
> PCI_DMA_*_tables yes s390x (zPCI + vfio)
> hostfs_inode_cache yes UML
> sun50i pt_pool no compile-tested only
# Pull the b4 branch from git.kernel.org and configure the kernel
$ git clone -b b4/memalloc-prof-dont-waste-slabobj-ext-metadata \
https://git.kernel.org/pub/scm/linux/kernel/git/harry/linux.git smack-repro
$ cd smack-repro
$ make defconfig kvm_guest.config
$ ./scripts/config -e MEMCG -e SECURITY_SMACK -e DEBUG_VM -e FUSE_FS -e VIRTIO_FS -e VIRTIO_MMIO
$ make olddefconfig
# Create a script to run in a VM
$ cat > repro.sh << 'EOF'
#!/bin/sh
mountpoint -q /sys/fs/cgroup || mount -t cgroup2 none /sys/fs/cgroup
echo +memory > /sys/fs/cgroup/cgroup.subtree_control
mkdir -p /sys/fs/cgroup/test
echo $$ > /sys/fs/cgroup/test/cgroup.procs # non-root memcg; root is not charged
mountpoint -q /sys/fs/smackfs || mount -t smackfs smackfs /sys/fs/smackfs
echo 'foo bar rwxa' > /sys/fs/smackfs/load-self2
sh -c : # fork -> prepare_creds -> smk_copy_rules(GFP_KERNEL_ACCOUNT)
echo "WARN count: $(dmesg | grep -c 'WARNING:.*__memcg_slab_post_alloc_hook')"
dmesg | sed -n '/cut here/,/end trace/p'
EOF
# Revert this patch, build the kernel, and test
$ git revert --no-edit HEAD~3 # Revert "smack: specify ..."
$ vng --build
$ vng --user root -a lsm=smack -- sh repro.sh
WARN count: 1
[ 1.178905] ------------[ cut here ]------------
[ 1.178913] WARNING: mm/memcontrol.c:3627 at __memcg_slab_post_alloc_hook+0x4a0/0x7b0, CPU#11: sh/434
[ 1.178922] Modules linked in:
[ 1.178925] CPU: 11 UID: 0 PID: 434 Comm: sh Not tainted 7.3.0-rc1-virtme-g121988b3e78d #3 PREEMPT(lazy)
[ 1.178928] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 1.178929] RIP: 0010:__memcg_slab_post_alloc_hook+0x4a0/0x7b0
[ 1.178932] Code: 86 e2 e3 ff e9 2e fe ff ff e8 7c a3 e3 ff 48 8b 53 10 f6 c2 03 0f 85 53 02 00 00 65 48 ff 0a e8 66 e2 e3 ff e9 52 fc ff ff 90 <0f> 0b 90 e9 ff fd ff ff 48 81 c3 bc 00 00 00 48 8b 0c d8 4c 8b a1
[ 1.178933] RSP: 0018:ff7dde988181bbf8 EFLAGS: 00010246
[ 1.178935] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ff4f87a042e55d00
[ 1.178936] RDX: 0000000000400dc0 RSI: 0000000000000000 RDI: ff4f87a041828b00
[ 1.178937] RBP: ff7dde988181bc80 R08: 0000000000000001 R09: ff7dde988181bc80
[ 1.178938] R10: 0000000000000000 R11: ff7dde988181be90 R12: ff4f87a045b600c0
[ 1.178939] R13: 0000000000000000 R14: ff4f87a04b95dc08 R15: ff4f87a041828b00
[ 1.178943] FS: 00007f5efb4e0780(0000) GS:ff4f87a0de940000(0000) knlGS:0000000000000000
[ 1.178945] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1.178946] CR2: 0000555ab8c2dda8 CR3: 000000000594e006 CR4: 0000000000771ef0
[ 1.178947] PKRU: 55555554
[ 1.178948] Call Trace:
[ 1.178950] <TASK>
[ 1.178951] ? srso_alias_return_thunk+0x5/0xfbef5
[ 1.178955] ? __memcg_slab_post_alloc_hook+0x517/0x7b0
[ 1.178957] kmem_cache_alloc_noprof+0x3ac/0x3e0
[ 1.178960] ? smack_cred_prepare+0x84/0x180
[ 1.178964] smack_cred_prepare+0x84/0x180
[ 1.178966] security_prepare_creds+0x49/0xa0
[ 1.178970] prepare_creds+0x168/0x280
[ 1.178974] copy_creds+0x25/0x130
[ 1.178976] copy_process+0x6d4/0x2830
[ 1.178981] kernel_clone+0xd5/0x420
[ 1.178984] __do_sys_clone+0x65/0x90
[ 1.178987] do_syscall_64+0xda/0x4b0
[ 1.178992] ? srso_alias_return_thunk+0x5/0xfbef5
[ 1.178994] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1.178996] RIP: 0033:0x7f5efb5d30e8
[ 1.178998] Code: 7d e0 e8 2b 58 f5 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 70 41 89 c4 85 c0 75 31 64 48 8b 04 25 10 00
[ 1.178999] RSP: 002b:00007ffce2898640 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
[ 1.179001] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f5efb5d30e8
[ 1.179002] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
[ 1.179003] RBP: 00007ffce2898660 R08: 0000000000000000 R09: 0000000000000000
[ 1.179003] R10: 00007f5efb4e0a50 R11: 0000000000000246 R12: 0000555aad43184c
[ 1.179004] R13: 00000000ffffffff R14: 0000000000000000 R15: 0000555ab8c37740
[ 1.179007] </TASK>
[ 1.179008] ---[ end trace 0000000000000000 ]---
# Revert the revert and run the same script in a VM
$ git revert --no-edit HEAD
$ vng --build
$ vng --user root -a lsm=smack -- sh repro.sh
WARN count: 0
Hope this helps.
--
Cheers,
Harry / Hyeonggon
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH slab/for-next 11/14] smack: specify SLAB_MAY_ACCOUNT for smack_rule cache
2026-10-21 18:48 ` Harry Yoo
@ 2026-10-21 19:14 ` Casey Schaufler
2026-10-22 12:54 ` Harry Yoo
0 siblings, 1 reply; 7+ messages in thread
From: Casey Schaufler @ 2026-10-21 19:14 UTC (permalink / raw)
To: Harry Yoo
Cc: Vlastimil Babka, Andrew Morton, Suren Baghdasaryan,
Johannes Weiner, Michal Hocko, Shakeel Butt, Roman Gushchin,
Hao Li, Christoph Lameter, David Rientjes, Muchun Song, Hao Ge,
Pedro Falcato, linux-mm, linux-kernel, kernel-team, Paul Moore,
James Morris, Serge E. Hallyn, linux-security-module,
Casey Schaufler
On 10/21/2026 11:48 AM, Harry Yoo wrote:
> On Wed, Oct 21, 2026 at 09:59:15AM -0700, Casey Schaufler wrote:
>> On 10/21/2026 4:46 AM, Harry Yoo (Meta) wrote:
>>> smk_copy_rules() allocates rules with the gfp passed from
>>> security_prepare_creds(), which is GFP_KERNEL_ACCOUNT. Specify
>>> SLAB_MAY_ACCOUNT when the object may be charged to a memcg.
>>> __GFP_ACCOUNT without SLAB_MAY_ACCOUNT will not be allowed.
>>>
>>> Path: fork() -> copy_creds() -> prepare_creds()
>>> -> security_prepare_creds(GFP_KERNEL_ACCOUNT) -> smack_cred_prepare()
>>> -> smk_copy_rules() -> kmem_cache_zalloc(smack_rule_cache)
>>>
>>> Assisted-by: LLM
>>> Cc: Casey Schaufler <casey@schaufler-ca.com>
>>> Cc: Paul Moore <paul@paul-moore.com>
>>> Cc: James Morris <jmorris@namei.org>
>>> Cc: "Serge E. Hallyn" <serge@hallyn.com>
>>> Cc: linux-security-module@vger.kernel.org
>>> Signed-off-by: Harry Yoo (Meta) <harry@kernel.org>
>> How was this change tested?
Brilliant response. Thank you. Add my
Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
> From the cover letter:
>> Each tested cache was verified with the warning in patch 13:
>> I confirmed that 1) the warning is triggered without the conversion,
>> and 2) specifying SLAB_MAY_ACCOUNT resolves it. However I could not test
>> io-pgtable_armv7s_l2 and sun50i's pt_pool caches due to lack of the
>> hardware and emulation support. So they are compile-tested only.
>>
>> cache tested environment
>> --------------------- ------ -----------------------
>> radix_tree_node yes x86
>> maple_node yes x86
>> buffer_head yes x86
>> skbuff_head_cache yes x86
>> fanotify_*_event yes x86
>> smack_rule yes x86
> Good, this can be reasonably tested.
> Let me write down instructions to replay this testing.
>
>> io-pgtable_armv7s_l2 no compile-tested only
>> thread_stack yes ppc64le (64K pages)
>> pgd_cache (arm64) yes arm64 (64K pages)
>> PGT_CACHE (powerpc) yes ppc64le
>> PCI_DMA_*_tables yes s390x (zPCI + vfio)
>> hostfs_inode_cache yes UML
>> sun50i pt_pool no compile-tested only
> # Pull the b4 branch from git.kernel.org and configure the kernel
>
> $ git clone -b b4/memalloc-prof-dont-waste-slabobj-ext-metadata \
> https://git.kernel.org/pub/scm/linux/kernel/git/harry/linux.git smack-repro
> $ cd smack-repro
> $ make defconfig kvm_guest.config
> $ ./scripts/config -e MEMCG -e SECURITY_SMACK -e DEBUG_VM -e FUSE_FS -e VIRTIO_FS -e VIRTIO_MMIO
> $ make olddefconfig
>
> # Create a script to run in a VM
> $ cat > repro.sh << 'EOF'
> #!/bin/sh
> mountpoint -q /sys/fs/cgroup || mount -t cgroup2 none /sys/fs/cgroup
> echo +memory > /sys/fs/cgroup/cgroup.subtree_control
> mkdir -p /sys/fs/cgroup/test
> echo $$ > /sys/fs/cgroup/test/cgroup.procs # non-root memcg; root is not charged
> mountpoint -q /sys/fs/smackfs || mount -t smackfs smackfs /sys/fs/smackfs
> echo 'foo bar rwxa' > /sys/fs/smackfs/load-self2
> sh -c : # fork -> prepare_creds -> smk_copy_rules(GFP_KERNEL_ACCOUNT)
> echo "WARN count: $(dmesg | grep -c 'WARNING:.*__memcg_slab_post_alloc_hook')"
> dmesg | sed -n '/cut here/,/end trace/p'
> EOF
>
> # Revert this patch, build the kernel, and test
>
> $ git revert --no-edit HEAD~3 # Revert "smack: specify ..."
> $ vng --build
> $ vng --user root -a lsm=smack -- sh repro.sh
> WARN count: 1
> [ 1.178905] ------------[ cut here ]------------
> [ 1.178913] WARNING: mm/memcontrol.c:3627 at __memcg_slab_post_alloc_hook+0x4a0/0x7b0, CPU#11: sh/434
> [ 1.178922] Modules linked in:
> [ 1.178925] CPU: 11 UID: 0 PID: 434 Comm: sh Not tainted 7.3.0-rc1-virtme-g121988b3e78d #3 PREEMPT(lazy)
> [ 1.178928] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
> [ 1.178929] RIP: 0010:__memcg_slab_post_alloc_hook+0x4a0/0x7b0
> [ 1.178932] Code: 86 e2 e3 ff e9 2e fe ff ff e8 7c a3 e3 ff 48 8b 53 10 f6 c2 03 0f 85 53 02 00 00 65 48 ff 0a e8 66 e2 e3 ff e9 52 fc ff ff 90 <0f> 0b 90 e9 ff fd ff ff 48 81 c3 bc 00 00 00 48 8b 0c d8 4c 8b a1
> [ 1.178933] RSP: 0018:ff7dde988181bbf8 EFLAGS: 00010246
> [ 1.178935] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ff4f87a042e55d00
> [ 1.178936] RDX: 0000000000400dc0 RSI: 0000000000000000 RDI: ff4f87a041828b00
> [ 1.178937] RBP: ff7dde988181bc80 R08: 0000000000000001 R09: ff7dde988181bc80
> [ 1.178938] R10: 0000000000000000 R11: ff7dde988181be90 R12: ff4f87a045b600c0
> [ 1.178939] R13: 0000000000000000 R14: ff4f87a04b95dc08 R15: ff4f87a041828b00
> [ 1.178943] FS: 00007f5efb4e0780(0000) GS:ff4f87a0de940000(0000) knlGS:0000000000000000
> [ 1.178945] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 1.178946] CR2: 0000555ab8c2dda8 CR3: 000000000594e006 CR4: 0000000000771ef0
> [ 1.178947] PKRU: 55555554
> [ 1.178948] Call Trace:
> [ 1.178950] <TASK>
> [ 1.178951] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 1.178955] ? __memcg_slab_post_alloc_hook+0x517/0x7b0
> [ 1.178957] kmem_cache_alloc_noprof+0x3ac/0x3e0
> [ 1.178960] ? smack_cred_prepare+0x84/0x180
> [ 1.178964] smack_cred_prepare+0x84/0x180
> [ 1.178966] security_prepare_creds+0x49/0xa0
> [ 1.178970] prepare_creds+0x168/0x280
> [ 1.178974] copy_creds+0x25/0x130
> [ 1.178976] copy_process+0x6d4/0x2830
> [ 1.178981] kernel_clone+0xd5/0x420
> [ 1.178984] __do_sys_clone+0x65/0x90
> [ 1.178987] do_syscall_64+0xda/0x4b0
> [ 1.178992] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 1.178994] entry_SYSCALL_64_after_hwframe+0x77/0x7f
> [ 1.178996] RIP: 0033:0x7f5efb5d30e8
> [ 1.178998] Code: 7d e0 e8 2b 58 f5 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 70 41 89 c4 85 c0 75 31 64 48 8b 04 25 10 00
> [ 1.178999] RSP: 002b:00007ffce2898640 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
> [ 1.179001] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f5efb5d30e8
> [ 1.179002] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
> [ 1.179003] RBP: 00007ffce2898660 R08: 0000000000000000 R09: 0000000000000000
> [ 1.179003] R10: 00007f5efb4e0a50 R11: 0000000000000246 R12: 0000555aad43184c
> [ 1.179004] R13: 00000000ffffffff R14: 0000000000000000 R15: 0000555ab8c37740
> [ 1.179007] </TASK>
> [ 1.179008] ---[ end trace 0000000000000000 ]---
>
> # Revert the revert and run the same script in a VM
>
> $ git revert --no-edit HEAD
> $ vng --build
> $ vng --user root -a lsm=smack -- sh repro.sh
> WARN count: 0
>
> Hope this helps.
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH slab/for-next 11/14] smack: specify SLAB_MAY_ACCOUNT for smack_rule cache
2026-10-21 11:46 ` [PATCH slab/for-next 11/14] smack: specify SLAB_MAY_ACCOUNT for smack_rule cache Harry Yoo (Meta)
2026-10-21 16:59 ` Casey Schaufler
@ 2026-10-22 11:48 ` sashiko-bot
1 sibling, 0 replies; 7+ messages in thread
From: sashiko-bot @ 2026-10-22 11:48 UTC (permalink / raw)
Cc: linux-security-module
> smk_copy_rules() allocates rules with the gfp passed from
> security_prepare_creds(), which is GFP_KERNEL_ACCOUNT. Specify
> SLAB_MAY_ACCOUNT when the object may be charged to a memcg.
> __GFP_ACCOUNT without SLAB_MAY_ACCOUNT will not be allowed.
>
> Path: fork() -> copy_creds() -> prepare_creds()
> -> security_prepare_creds(GFP_KERNEL_ACCOUNT) -> smack_cred_prepare()
> -> smk_copy_rules() -> kmem_cache_zalloc(smack_rule_cache)
>
> Assisted-by: LLM
> Cc: Casey Schaufler <casey@schaufler-ca.com>
> Cc: Paul Moore <paul@paul-moore.com>
> Cc: James Morris <jmorris@namei.org>
> Cc: "Serge E. Hallyn" <serge@hallyn.com>
> Cc: linux-security-module@vger.kernel.org
> Signed-off-by: Harry Yoo (Meta) <harry@kernel.org>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261021-memalloc-prof-dont-waste-slabobj-ext-metadata-v1-0-096800aa3330@kernel.org?part=11
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH slab/for-next 11/14] smack: specify SLAB_MAY_ACCOUNT for smack_rule cache
2026-10-21 19:14 ` Casey Schaufler
@ 2026-10-22 12:54 ` Harry Yoo
0 siblings, 0 replies; 7+ messages in thread
From: Harry Yoo @ 2026-10-22 12:54 UTC (permalink / raw)
To: Casey Schaufler
Cc: Vlastimil Babka, Andrew Morton, Suren Baghdasaryan,
Johannes Weiner, Michal Hocko, Shakeel Butt, Roman Gushchin,
Hao Li, Christoph Lameter, David Rientjes, Muchun Song, Hao Ge,
Pedro Falcato, linux-mm, linux-kernel, kernel-team, Paul Moore,
James Morris, Serge E. Hallyn, linux-security-module
On Wed, Oct 21, 2026 at 12:14:39PM -0700, Casey Schaufler wrote:
> On 10/21/2026 11:48 AM, Harry Yoo wrote:
> > On Wed, Oct 21, 2026 at 09:59:15AM -0700, Casey Schaufler wrote:
> >> On 10/21/2026 4:46 AM, Harry Yoo (Meta) wrote:
> >>> smk_copy_rules() allocates rules with the gfp passed from
> >>> security_prepare_creds(), which is GFP_KERNEL_ACCOUNT. Specify
> >>> SLAB_MAY_ACCOUNT when the object may be charged to a memcg.
> >>> __GFP_ACCOUNT without SLAB_MAY_ACCOUNT will not be allowed.
> >>>
> >>> Path: fork() -> copy_creds() -> prepare_creds()
> >>> -> security_prepare_creds(GFP_KERNEL_ACCOUNT) -> smack_cred_prepare()
> >>> -> smk_copy_rules() -> kmem_cache_zalloc(smack_rule_cache)
> >>>
> >>> Assisted-by: LLM
> >>> Cc: Casey Schaufler <casey@schaufler-ca.com>
> >>> Cc: Paul Moore <paul@paul-moore.com>
> >>> Cc: James Morris <jmorris@namei.org>
> >>> Cc: "Serge E. Hallyn" <serge@hallyn.com>
> >>> Cc: linux-security-module@vger.kernel.org
> >>> Signed-off-by: Harry Yoo (Meta) <harry@kernel.org>
> >> How was this change tested?
>
> Brilliant response. Thank you. Add my
>
> Reviewed-by: Casey Schaufler <casey@schaufler-ca.com>
No problem :)
Thank you, have a nice day!
--
Cheers,
Harry / Hyeonggon
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-10-22 12:54 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-21 11:46 [PATCH slab/for-next 00/14] mm/slab: mandate SLAB_MAY_ACCOUNT for __GFP_ACCOUNT allocations to avoid wasting memory for slab metadata Harry Yoo (Meta)
2026-10-21 11:46 ` [PATCH slab/for-next 11/14] smack: specify SLAB_MAY_ACCOUNT for smack_rule cache Harry Yoo (Meta)
2026-10-21 16:59 ` Casey Schaufler
2026-10-21 18:48 ` Harry Yoo
2026-10-21 19:14 ` Casey Schaufler
2026-10-22 12:54 ` Harry Yoo
2026-10-22 11:48 ` sashiko-bot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox