Re: [PATCH V1 2/2] lib/tests/slub_kunit: add a test case for {kmalloc,kfree}_nolock

Vlastimil Babka (SUSE)
2026-04-02T14:37:03Z

On 3/30/26 2:05 PM, Harry Yoo (Oracle) wrote:
> Testing invocation of {kmalloc,kfree}_nolock() during kmalloc() or
> kfree() is tricky, and it is even harder to ensure that slowpaths are
> properly tested. Lack of such testing has led to late discovery of
> the bug fixed by commit a1e244a9f177 ("mm/slab: use prandom if
> !allow_spin").
>
> Add a slub_kunit test that allocates and frees objects in a tight loop
> while a perf event triggers NMIs on the same task, invoking
> {kmalloc,kfree}_nolock() from the NMI handler.
>
> Signed-off-by: Harry Yoo (Oracle) <harry@kernel.org>

perf_event_create_kernel_counter() seems to only exist with
CONFIG_PERF_EVENTS, there's not even some "return -EINVAL" skeleton
otherwise, AFAICS. Didn't check the various other definitions, but guess
we'll need to put some/all of this behind #ifdef's then?

> ---
> lib/tests/slub_kunit.c | 88 ++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 88 insertions(+)
>
> diff --git a/lib/tests/slub_kunit.c b/lib/tests/slub_kunit.c
> index 848b682a2d70..2ed5f90a748a 100644
> --- a/lib/tests/slub_kunit.c
> +++ b/lib/tests/slub_kunit.c
> @@ -7,6 +7,7 @@
> #include <linux/kernel.h>
> #include <linux/rcupdate.h>
> #include <linux/delay.h>
> +#include <linux/perf_event.h>
> #include "../mm/slab.h"
>
> static struct kunit_resource resource;
> @@ -291,6 +292,92 @@ static void test_krealloc_redzone_zeroing(struct kunit *test)
> kmem_cache_destroy(s);
> }
>
> +#define REPEAT_TIMES 1000
> +#define LOOP_SIZE 1000
> +static void *objects[LOOP_SIZE];
> +
> +struct nmi_context {
> + struct kunit *test;
> + int callback_count;
> + int alloc_ok;
> + int alloc_fail;
> + struct perf_event *event;
> +};
> +
> +static struct perf_event_attr nmi_hw_attr = {
> + .type = PERF_TYPE_HARDWARE,
> + .config = PERF_COUNT_HW_CPU_CYCLES,
> + .size = sizeof(struct perf_event_attr),
> + .pinned = 1,
> + .disabled = 1,
> + .freq = 1,
> + .sample_freq = 100000,
> +};
> +
> +static void kmalloc_kfree_nolock_in_nmi(struct perf_event *event,
> + struct perf_sample_data *data,
> + struct pt_regs *regs)
> +{
> + void *objp;
> + gfp_t gfp;
> + struct nmi_context *ctx = event->overflow_handler_context;
> +
> + /* __GFP_ACCOUNT to test kmalloc_nolock() in alloc_slab_obj_exts() */
> + gfp = (ctx->callback_count % 2) ? 0 : __GFP_ACCOUNT;
> + objp = kmalloc_nolock(64, gfp, NUMA_NO_NODE);
> +
> + if (objp)
> + ctx->alloc_ok++;
> + else
> + ctx->alloc_fail++;
> +
> + kfree_nolock(objp);
> + ctx->callback_count++;
> +}
> +
> +static void test_kmalloc_kfree_nolock(struct kunit *test)
> +{
> + int i, j;
> + struct nmi_context ctx = { .test = test };
> + struct perf_event *event;
> + bool alloc_fail = false;
> +
> + event = perf_event_create_kernel_counter(&nmi_hw_attr, -1, current,
> + kmalloc_kfree_nolock_in_nmi,
> + &ctx);
> + if (IS_ERR(event))
> + kunit_skip(test, "Failed to create perf event");
> + ctx.event = event;
> + perf_event_enable(ctx.event);
> + for (i = 0; i < REPEAT_TIMES; i++) {
> + for (j = 0; j < LOOP_SIZE; j++) {
> + gfp_t gfp = (i % 2) ? 0 : __GFP_ACCOUNT;
> +
> + objects[j] = kmalloc(64, gfp);
> + if (!objects[j]) {
> + j--;
> + while (j >= 0)
> + kfree(objects[j--]);
> + alloc_fail = true;
> + goto cleanup;
> + }
> + }
> + for (j = 0; j < LOOP_SIZE; j++)
> + kfree(objects[j]);
> + }
> +
> +cleanup:
> + perf_event_disable(ctx.event);
> + perf_event_release_kernel(ctx.event);
> +
> + kunit_info(test, "callback_count: %d, alloc_ok: %d, alloc_fail: %d\n",
> + ctx.callback_count, ctx.alloc_ok, ctx.alloc_fail);
> +
> + if (alloc_fail)
> + kunit_skip(test, "Allocation failed");
> + KUNIT_EXPECT_EQ(test, 0, slab_errors);
> +}
> +
> static int test_init(struct kunit *test)
> {
> slab_errors = 0;
> @@ -315,6 +402,7 @@ static struct kunit_case test_cases[] = {
> KUNIT_CASE(test_kfree_rcu_wq_destroy),
> KUNIT_CASE(test_leak_destroy),
> KUNIT_CASE(test_krealloc_redzone_zeroing),
> + KUNIT_CASE_SLOW(test_kmalloc_kfree_nolock),
> {}
> };
>