From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 49DBB3A9601 for ; Fri, 10 Jul 2026 06:04:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783663443; cv=none; b=M3fFmNGk2HNDHLWPbTQF/vpCw8lDoTg72m6sXgVfUGoTyjgC88Tz7zwMKmiM3vGRTAMnnExlw3bkdsNxq5ini0fpQVDo22dVChRG1ey5oy1dElVds1HiIsfcEC1cBh9gK9nwoa6uXztieFR4u+Pu0fZrpZ2AIJNNBWlSAMkvZ2U= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783663443; c=relaxed/simple; bh=Z8zSIMD1uY7VwC3850XNWXHtV/DpyqyVEr6QdDaCjro=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=lJAq07G4CpQS240O1XweqC5Y5f5W8fS3ZXsOGcqByUogBS4cBAQQbbG7yEg3JcqiYTrUAW+u73a/ptjMs4rnburMb8PHfC+TEl+BzhU2n3R0cyuS9B1YZrqb867nQ3asr3MnpgIwtmCDgdXk3mJsQffzPmjPeH0BCThdw2PU9uE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=hW/sGd3j; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="hW/sGd3j" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BB8A41F000E9; Fri, 10 Jul 2026 06:03:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1783663442; bh=wtRyuqLxHec+AIEMCGWYLc5A5j22LJ1kSJp888lWRJ4=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=hW/sGd3j2nK+la3rJ+AhDmiUN7uUN3qE8EOSoXlKtBWTFzSB4ookz5N7RE/N9gfYC t/yaMkwmM3xJdFKya0TnW3G2KYXzr48e9uWU3ZpsTmlBG7obW5iBKuH2Ri4Xb4y4fu bekwnVfWVis1FWdSAGgZd7gIOnw90gMvAvHaOUJj+0p+JpbhOMf6jK5JHOt+dBMRHo JPfDN5FV3FdbWQHSJMH9NMbddPQ53YmHjdErwEfeoocp7h/jekmEemG//5C8osGhCm UF2WJgS0RJAtcTPufP6JcRPZAvBmKxPu1biODxiYqDQvQ7zaZnL5k1rIXlRAN5x7B1 6I/GnMgINrNfg== From: "Harry Yoo (Oracle)" Date: Fri, 10 Jul 2026 15:03:32 +0900 Subject: [PATCH slab/for-next-fixes v2 1/3] mm/slab: fix a memory leak due to bootstrapping sheaves twice Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260710-kmalloc-no-objext-v2-1-2709afb6a030@kernel.org> References: <20260710-kmalloc-no-objext-v2-0-2709afb6a030@kernel.org> In-Reply-To: <20260710-kmalloc-no-objext-v2-0-2709afb6a030@kernel.org> To: Vlastimil Babka , Andrew Morton , Hao Li , Christoph Lameter , David Rientjes , Roman Gushchin , Suren Baghdasaryan , Hao Ge , Kees Cook , Pedro Falcato , Shakeel Butt , Danielle Constantino , "Liam R. Howlett" Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, "Harry Yoo (Oracle)" X-Mailer: b4 0.14.3 When kmalloc caches are aliased, multiple cache pointers reference the same kmem_cache. As a result, iterating over kmalloc indices and bootstrapping sheaves can bootstrap the same cache more than once and leak memory. Currently, this could happen when the architecture specifies minimum alignment for slab caches that is larger than ARCH_KMALLOC_MINALIGN. Bootstrap sheaves only when the cache does not have them already. Add a warning when bootstrap_cache_sheaves() is called for a cache that already has sheaves enabled. Cc: stable@vger.kernel.org Fixes: 913ffd3a1bf5 ("slab: handle kmalloc sheaves bootstrap") Signed-off-by: Harry Yoo (Oracle) --- mm/slub.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/mm/slub.c b/mm/slub.c index 65febe957886..f9461a0c47d3 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -8497,6 +8497,8 @@ static void __init bootstrap_cache_sheaves(struct kmem_cache *s) bool failed = false; int node, cpu; + VM_WARN_ON_ONCE(cache_has_sheaves(s)); + capacity = calculate_sheaf_capacity(s, &empty_args); /* capacity can be 0 due to debugging or SLUB_TINY */ @@ -8548,8 +8550,11 @@ static void __init bootstrap_kmalloc_sheaves(void) for (type = KMALLOC_NORMAL; type <= KMALLOC_PARTITION_END; type++) { for (int idx = 0; idx < KMALLOC_SHIFT_HIGH + 1; idx++) { - if (kmalloc_caches[type][idx]) - bootstrap_cache_sheaves(kmalloc_caches[type][idx]); + struct kmem_cache *s = kmalloc_caches[type][idx]; + + /* Do not bootstrap twice when caches are aliased */ + if (s && !cache_has_sheaves(s)) + bootstrap_cache_sheaves(s); } } } -- 2.53.0