Re: [PATCH slab/for-next-fixes v3 0/4] mm/slab: fix unbounded recursion in free path with memalloc profiling

[Hao Ge <hao.ge@linux.dev>]

Hi Shakeel


On 2026/7/17 23:18, Shakeel Butt wrote:
> On Fri, Jul 17, 2026 at 09:16:19AM +0800, Hao Ge wrote:
>> On 2026/7/17 03:37, Shakeel Butt wrote:
>>> On Mon, Jul 13, 2026 at 11:28:48PM +0900, Harry Yoo (Oracle) wrote:
>>>> This is a follow-up fix after the recent discussion [1].
>>>> See patch 4 for the detailed description on the bug.
>>>>
>>>> Based on slab/for-next-fixes (af9ea231c0b45) and is available at
>>>> git.kernel.org [2].
>>>>
>>>> Instead preventing cycles by bumping up the allocation size of obj_exts
>>>> arrays, it introduces a new kmalloc type called KMALLOC_NO_OBJ_EXT and
>>>> disallow formation of cycles between kmalloc types when allocating
>>>> obj_exts arrays. obj_exts arrays of normal kmalloc caches are served
>>>> from KMALLOC_NO_OBJ_EXT caches (that don't have obj_exts), and all other
>>>> obj_exts arrays are served from normal kmalloc caches.
>>>>
>>>> I tried to reuse SLAB_ALLOC_NO_RECURSE to make kmalloc_slab() select
>>>> KMALLOC_NO_OBJ_EXT, but it was not great because it does not allow
>>>> sheaves for those caches. So I introduced a new slab alloc flag
>>>> SLAB_ALLOC_NO_OBJ_EXT.
>>>>
>>>> To avoid huge confusion, I had to decouple "disallowing sheaves"
>>>> semantics from SLAB_NO_OBJ_EXT and introduced SLAB_NO_SHEAVES.
>>>>
>>>> While this cannot be directly backported to v6.18 and v6.12 due to lack
>>>> of SLAB_ALLOC_* flags and kmalloc_flags(), I don't this will be
>>>> particularily challenging to backport it. Instead of a new slab alloc
>>>> flag, we can use __GFP_NO_OBJ_EXT to select KMALLOC_NO_OBJ_EXT as
>>>> kmalloc caches don't have sheaves in v6.18 anyway.
>>>>
>>>> [1] https://lore.kernel.org/linux-mm/9a139365-28e6-4f1e-b35b-7f6091e9aa14@kernel.org
>>>>
>>>> [2] https://git.kernel.org/pub/scm/linux/kernel/git/harry/linux.git/log/?h=kmalloc-no-objext-v3r1
>>>>
>>>> To: Vlastimil Babka <vbabka@kernel.org>
>>>> To: Andrew Morton <akpm@linux-foundation.org>
>>>> To: Hao Li <hao.li@linux.dev>
>>>> To: Christoph Lameter <cl@gentwo.org>
>>>> To: David Rientjes <rientjes@google.com>
>>>> To: Roman Gushchin <roman.gushchin@linux.dev>
>>>> To: Suren Baghdasaryan <surenb@google.com>
>>>> To: Hao Ge <hao.ge@linux.dev>
>>>> To: Kees Cook <kees@kernel.org>
>>>> To: Pedro Falcato <pfalcato@suse.de>
>>>> To: Shakeel Butt <shakeel.butt@linux.dev>
>>>> To: Danielle Constantino <dcostantino@meta.com>
>>>> To: Liam R. Howlett <liam@infradead.org>
>>>> Cc: linux-mm@kvack.org
>>>> Cc: linux-kernel@vger.kernel.org
>>>> Signed-off-by: Harry Yoo (Oracle) <harry@kernel.org>
>>> I tested next-20260716 which has this series against next-20260707 which does
>>> not have the fix. The reproducer were able to trigger the leak/recursion on
>>> next-20260707 but not on next-20260716. So, you can add:
>>
>> Hi Shakeel
>>
>>
>> It seems you have a consistent stable reproduction method or test script.
>>
>> Would you mind sharing it if possible?  I'm sorry if this was provided
>> earlier and I overlooked it.
>>
>> I'd like to thoroughly investigate and learn about this problem.
>>
>> Thank you very much.
>>
>>
>
>  From dcb6ca5c051738d64f7a901402f5f257babbc385 Mon Sep 17 00:00:00 2001
> From: Shakeel Butt <shakeel.butt@linux.dev>
> Date: Fri, 17 Jul 2026 08:12:11 -0700
> Subject: [PATCH] slub: repro unbounded recursion in slub objext array
>   allocation
>
> Signed-off-by: Shakeel Butt <shakeel.butt@linux.dev>
> ---
>   repro_public/Makefile       |   1 +
>   repro_public/README.md      | 128 +++++++++++++++++++++++++
>   repro_public/repro_objext.c | 180 ++++++++++++++++++++++++++++++++++++
>   repro_public/run_repro.sh   |  26 ++++++
>   4 files changed, 335 insertions(+)
>   create mode 100644 repro_public/Makefile
>   create mode 100644 repro_public/README.md
>   create mode 100644 repro_public/repro_objext.c
>   create mode 100755 repro_public/run_repro.sh
>
> diff --git a/repro_public/Makefile b/repro_public/Makefile
> new file mode 100644
> index 000000000000..0629fc5b6fb7
> --- /dev/null
> +++ b/repro_public/Makefile
> @@ -0,0 +1 @@
> +obj-m := repro_objext.o
> diff --git a/repro_public/README.md b/repro_public/README.md
> new file mode 100644
> index 000000000000..21ec3f5c01e6
> --- /dev/null
> +++ b/repro_public/README.md
> @@ -0,0 +1,128 @@
> +# Reproducer: SLUB obj_exts free-recursion / cross-cycle leak
> +
> +With `CONFIG_MEM_ALLOC_PROFILING=y` and profiling enabled, every
> +`KMALLOC_NORMAL` slab gets a `slabobj_ext` (obj_exts) array that is itself
> +`kmalloc()`'d from a `KMALLOC_NORMAL` cache. `sizeof(struct slabobj_ext) == 16`,
> +so with the right slab geometry the arrays reference each other:
> +
> +- `kmalloc-512` with 64 objs/slab -> array is `64*16 = 1024` bytes -> `kmalloc-1k`
> +- `kmalloc-1k`  with 32 objs/slab -> array is `32*16 =  512` bytes -> `kmalloc-512`
> +
> +A `kmalloc-512` slab and a `kmalloc-1k` slab then hold each other's obj_exts
> +array (a 2-cycle). Discarding one frees the other's array, which empties and
> +discards that slab, and so on:
> +
> +```
> +__free_slab() -> unaccount_slab() -> free_slab_obj_exts() -> kfree()
> +             -> discard_slab() -> __free_slab() ...
> +```
> +
> +At production scale this recurses until the 16 KiB kernel stack overflows
> +(stack guard page). In a small VM it deterministically manifests as a *leak*:
> +the mutually-pinned slabs can never be reclaimed, so `kmalloc-512`/`kmalloc-1k`
> +retain thousands of unreclaimable objects after a shrink storm. Same root cause.
> +
> +Related upstream commits:
> +- `4b8736964640` ("mm/slab: add allocation accounting into slab allocation and
> +  free paths") — introduced the obj_exts arrays (Fixes:).
> +- `280ea9c3154b` ("mm/slab: avoid allocating slabobj_ext array from its own
> +  slab") — bumps the size only when the array would come from the *same* cache
> +  (`object_size ==`); does NOT break the `kmalloc-512 <-> kmalloc-1k` cross
> +  cycle, so it is insufficient.
> +
> +## Files
> +
> +- `repro_objext.c` — the reproducer kernel module.
> +- `Makefile`       — out-of-tree module makefile (`obj-m := repro_objext.o`).
> +- `run_repro.sh`   — in-guest driver: enables profiling, prints the slab
> +  geometry, insmods the module, hammers `shrink`, and reports the leftover
> +  object counts (all via `/dev/kmsg` so it survives in `dmesg`).
> +
> +## Requirements
> +
> +Kernel `.config`:
> +
> +```
> +CONFIG_MEM_ALLOC_PROFILING=y      # trigger: obj_exts on KMALLOC_NORMAL slabs
> +CONFIG_MEMCG=y                    # selects CONFIG_SLAB_OBJ_EXT=y
> +CONFIG_MODULES=y
> +CONFIG_MODULE_UNLOAD=y
> +# CONFIG_SLUB is the default allocator
> +```
> +
> +Tools: a kernel build toolchain (`make`, `gcc`/clang, `binutils`, `bison`,
> +`flex`, `libelf-dev`, `libssl-dev`, `bc`, `pahole`) and either
> +[virtme-ng](https://github.com/arighi/virtme-ng) or `qemu-system-x86_64`.
> +
> +## Build
> +
> +```sh
> +# 1. Build the kernel under test (with the config options above).
> +make -C /path/to/kernel -j"$(nproc)" bzImage modules
> +# ('modules' is needed so Module.symvers includes mem_alloc_profiling_key,
> +#  which kmalloc() references when profiling is compiled in.)
> +
> +# 2. Build the reproducer module against that kernel.
> +make -C /path/to/kernel M="$PWD" modules   # produces repro_objext.ko
> +```
> +
> +## Run
> +
> +Boot the kernel with two boot-cmdline parameters:
> +
> +```
> +slub_min_objects=64            # forces kmalloc-512=64 objs/slab and
> +                               # kmalloc-1k=32 objs/slab -> the cross-cycle geometry
> +sysctl.vm.mem_profiling=1      # enables profiling at boot; a runtime
> +                               # `echo 1 > /proc/sys/vm/mem_profiling` is REJECTED
> +                               # unless CONFIG_MEM_ALLOC_PROFILING_ENABLED_BY_DEFAULT=y
> +                               # or this boot param is set.
> +```
> +
> +With virtme-ng:
> +
> +```sh
> +cd /path/to/kernel
> +vng --cpus 8 -m 12G -a "slub_min_objects=64 sysctl.vm.mem_profiling=1" \
> +    -- bash /path/to/run_repro.sh /path/to/repro_objext.ko
> +```
> +
> +Or, by hand inside any guest booted with the params above:
> +
> +```sh
> +insmod repro_objext.ko n=2000000 rounds=4 shrink=1 keep=0 shrink_iters=8
> +for i in $(seq 1 80); do
> +  for c in kmalloc-128 kmalloc-256 kmalloc-512 kmalloc-1k kmalloc-2k kmalloc-4k; do
> +    echo 1 > /sys/kernel/slab/$c/shrink 2>/dev/null
> +  done
> +done
> +cat /sys/kernel/slab/kmalloc-512/objects
> +cat /sys/kernel/slab/kmalloc-1k/objects
> +```
> +
> +The module returns `-ECANCELED` on purpose (it does all its work in init and
> +then unloads itself); the `insmod: Operation canceled` message is expected.
> +
> +## Expected results
> +
> +Verify the geometry printed by the driver is `k512 objs=64` and `k1k objs=32`
> +and `profiling_runtime=1`; otherwise the cross-cycle is not exercised.
> +
> +- **Buggy kernel** (cross-cycle not fixed): after the shrink storm,
> +  `kmalloc-512`/`kmalloc-1k` stay pinned at thousands of objects (e.g. ~8000),
> +  far above the pre-insmod baseline. At production scale/geometry the same
> +  condition overflows the kernel stack instead.
> +- **Fixed kernel**: object counts return to the pre-insmod baseline (a few
> +  hundred); no leak, no recursion.
> +
> +## Module parameters
> +
> +| param          | default   | meaning                                                   |
> +|----------------|-----------|-----------------------------------------------------------|
> +| `n`            | 2000000   | objects per size class per round                          |
> +| `rounds`       | 4         | warm-up rounds to build obj_exts density                  |
> +| `keep`         | 0         | keep 1-in-`keep` objects live per round (0 = free all)    |
> +| `shrink`       | 1         | hammer `kmem_cache_shrink` via sysfs after the churn      |
> +| `shrink_iters` | 8         | shrink passes per round                                   |
> +| `size_lo`      | 384       | small request size (-> kmalloc-512)                       |
> +| `size_hi`      | 768       | large request size (-> kmalloc-1k)                        |
> diff --git a/repro_public/repro_objext.c b/repro_public/repro_objext.c
> new file mode 100644
> index 000000000000..01a53693dbef
> --- /dev/null
> +++ b/repro_public/repro_objext.c
> @@ -0,0 +1,180 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/*
> + * repro_objext.c — reproduce the SLUB obj_exts free-recursion stack overflow.
> + *
> + * Bug: with CONFIG_MEM_ALLOC_PROFILING=y and vm.mem_profiling on,
> + * every KMALLOC_NORMAL slab gets a slabobj_ext (obj_exts) vector allocated from
> + * another KMALLOC_NORMAL slab. sizeof(slabobj_ext)==16, so kmalloc-1k's vector
> + * (objs*16) lands in kmalloc-512 and kmalloc-512's vector lands in kmalloc-1k ->
> + * cross-referencing chains and a kmalloc-1k<->kmalloc-512 2-cycle. When many such
> + * slabs are discarded (per-cpu partial flush __put_partials, or kmem_cache_shrink),
> + * __free_slab()->unaccount_slab()->free_slab_obj_exts()->kfree(vector) empties the
> + * slab that holds the vector, which discards THAT slab, recursing without bound and
> + * overflowing the 16 KiB task stack (VMAP guard page).
> + *
> + * Boot: append `sysctl.vm.mem_profiling=1` (or =1,compressed) to the kernel cmdline,
> + * OR echo 1 > /proc/sys/vm/mem_profiling before insmod.
> + *
> + * WITHOUT fix: "BUG: TASK stack guard page was hit" recursion -> panic/hang/reboot;
> + *              "REPRODUCER DONE" is NEVER printed (note: the overflow may also
> + *              corrupt the console TX path, so the box may just die silently —
> + *              treat a VM that never prints DONE / dies / reboots as a CRASH).
> + * WITH fix:    no obj_exts on KMALLOC_NORMAL slabs -> no recursion ->
> + *              "REPRODUCER DONE no-crash" printed, insmod returns (module unloads).
> + *
> + * Tunables (module params):
> + *   n         objects per size class per round (default 2,000,000)
> + *   rounds    warm-up rounds to build obj_exts density (default 4)
> + *   keep      keep 1-in-`keep` objects live after each round to leave slabs at low
> + *             occupancy (denser cross-referenced partial slabs). 0 = free all.
> + *   shrink    after the churn, hammer kmem_cache_shrink via
> + *             /sys/kernel/slab/<cache>/shrink to force the discard cascade.
> + *   sizes_lo/sizes_hi  the two kmalloc request sizes (default 768 -> kmalloc-1k,
> + *             384 -> kmalloc-512).
> + */
> +#include <linux/module.h>
> +#include <linux/slab.h>
> +#include <linux/vmalloc.h>
> +#include <linux/kernel.h>
> +#include <linux/fs.h>
> +#include <linux/uaccess.h>
> +#include <linux/delay.h>
> +
> +static unsigned long n = 2000000;
> +module_param(n, ulong, 0444);
> +MODULE_PARM_DESC(n, "objects per size class per round");
> +
> +static unsigned int rounds = 4;
> +module_param(rounds, uint, 0444);
> +MODULE_PARM_DESC(rounds, "warm-up rounds");
> +
> +static unsigned int keep;
> +module_param(keep, uint, 0444);
> +MODULE_PARM_DESC(keep, "keep 1-in-keep objects live after each round (0=free all)");
> +
> +static unsigned int shrink = 1;
> +module_param(shrink, uint, 0444);
> +MODULE_PARM_DESC(shrink, "hammer kmem_cache_shrink via sysfs after churn");
> +
> +static unsigned int shrink_iters = 8;
> +module_param(shrink_iters, uint, 0444);
> +MODULE_PARM_DESC(shrink_iters, "how many shrink passes");
> +
> +static unsigned int size_lo = 384;	/* -> kmalloc-512 */
> +module_param(size_lo, uint, 0444);
> +static unsigned int size_hi = 768;	/* -> kmalloc-1k  */
> +module_param(size_hi, uint, 0444);
> +
> +static void **a;	/* kmalloc-1k (size_hi) */
> +static void **b;	/* kmalloc-512 (size_lo) */
> +
> +static void echo_to(const char *path, const char *val)
> +{
> +	struct file *f;
> +	loff_t pos = 0;
> +
> +	f = filp_open(path, O_WRONLY, 0);
> +	if (IS_ERR(f))
> +		return;
> +	kernel_write(f, val, strlen(val), &pos);
> +	filp_close(f, NULL);
> +}
> +
> +/* Force kmem_cache_shrink on the two caches: walks partial lists and discards
> + * empty slabs -> discard_slab -> __free_slab -> free_slab_obj_exts -> kfree.
> + * If the freed obj_exts vectors cross-reference, the recursion fires here. */
> +static void do_shrink(void)
> +{
> +	unsigned int i;
> +	char p1[64], p2[64];
> +
> +	snprintf(p1, sizeof(p1), "/sys/kernel/slab/kmalloc-1k/shrink");
> +	snprintf(p2, sizeof(p2), "/sys/kernel/slab/kmalloc-512/shrink");
> +	for (i = 0; i < shrink_iters; i++) {
> +		echo_to(p1, "1\n");
> +		echo_to(p2, "1\n");
> +	}
> +	/* also the cg variants if present (harmless if absent) */
> +	echo_to("/sys/kernel/slab/kmalloc-rnd-08-1k/shrink", "1\n");
> +	echo_to("/sys/kernel/slab/kmalloc-rnd-07-512/shrink", "1\n");
> +}
> +
> +static void do_round(unsigned long cnt, bool last)
> +{
> +	unsigned long i;
> +
> +	for (i = 0; i < cnt; i++) {
> +		a[i] = kmalloc(size_hi, GFP_KERNEL);
> +		b[i] = kmalloc(size_lo, GFP_KERNEL);
> +		if (a[i])
> +			*(volatile char *)a[i] = 1;
> +		if (b[i])
> +			*(volatile char *)b[i] = 1;
> +	}
> +	if (last)
> +		pr_emerg("REPRODUCER: allocated %lu+%lu objs, starting free-storm (keep=%u)\n",
> +			 cnt, cnt, keep);
> +
> +	/* Free-storm. If keep>0, leave 1-in-keep live to keep slabs partial &
> +	 * densely cross-referenced; those are freed only on the final round. */
> +	for (i = 0; i < cnt; i++) {
> +		if (keep && (i % keep) == 0)
> +			continue;	/* leave this one live for now */
> +		kfree(a[i]);
> +		kfree(b[i]);
> +	}
> +}
> +
> +static int __init repro_init(void)
> +{
> +	unsigned int r;
> +	unsigned long i;
> +
> +	pr_emerg("REPRODUCER START n=%lu rounds=%u keep=%u shrink=%u sizes=%u/%u mem_profiling=%d\n",
> +		 n, rounds, keep, shrink, size_lo, size_hi,
> +		 IS_ENABLED(CONFIG_MEM_ALLOC_PROFILING));
> +
> +	a = vmalloc(n * sizeof(void *));
> +	b = vmalloc(n * sizeof(void *));
> +	if (!a || !b) {
> +		pr_emerg("REPRODUCER: vmalloc failed, reduce n=\n");
> +		goto out;
> +	}
> +
> +	for (r = 0; r < rounds; r++) {
> +		do_round(n, r == rounds - 1);
> +		if (shrink)
> +			do_shrink();
> +	}
> +
> +	/* Free everything that was kept live, then shrink hard: this is the
> +	 * discard-cascade moment most likely to hit the recursion. */
> +	if (keep) {
> +		pr_emerg("REPRODUCER: freeing kept-live objects then shrinking\n");
> +		for (i = 0; i < n; i++) {
> +			if ((i % keep) == 0) {
> +				kfree(a[i]);
> +				kfree(b[i]);
> +			}
> +		}
> +	}
> +	if (shrink) {
> +		pr_emerg("REPRODUCER: final shrink storm\n");
> +		do_shrink();
> +	}
> +
> +	pr_emerg("REPRODUCER DONE no-crash (fix present)\n");
> +out:
> +	vfree(a);
> +	vfree(b);
> +	/* Return error so the module unloads itself; the test only needs init. */
> +	return -ECANCELED;
> +}
> +
> +static void __exit repro_exit(void) { }
> +
> +module_init(repro_init);
> +module_exit(repro_exit);
> +MODULE_LICENSE("GPL");
> +MODULE_DESCRIPTION("Reproducer for SLUB obj_exts free-recursion stack overflow");
> +
> diff --git a/repro_public/run_repro.sh b/repro_public/run_repro.sh
> new file mode 100755
> index 000000000000..08c7e57014bc
> --- /dev/null
> +++ b/repro_public/run_repro.sh
> @@ -0,0 +1,26 @@
> +#!/bin/bash
> +# Branch reproducer driver. Arg1 = path to repro_objext.ko built against this kernel.
> +# All diagnostics go to /dev/kmsg so they survive in the dmesg dump (vng stdout is lossy).
> +set +e
> +KO="$1"
> +L(){ echo "BT| $*" > /dev/kmsg 2>/dev/null; }
> +k(){ awk '{print $1}' /sys/kernel/slab/$1/objects 2>/dev/null; }
> +g(){ cat /sys/kernel/slab/$1/$2 2>/dev/null; }
> +L "===== BRANCHTEST START ====="
> +L "uname=$(uname -r)"
> +L "cmdline=$(cat /proc/cmdline)"
> +echo 1 > /proc/sys/vm/mem_profiling 2>/dev/null
> +L "profiling_runtime=$(cat /proc/sys/vm/mem_profiling 2>/dev/null)"
> +L "GEOM k512 objs=$(g kmalloc-512 objs_per_slab) ord=$(g kmalloc-512 order) | k1k objs=$(g kmalloc-1k objs_per_slab) ord=$(g kmalloc-1k order) | k2k objs=$(g kmalloc-2k objs_per_slab) | k256 objs=$(g kmalloc-256 objs_per_slab)"
> +L "noobjext_caches=$(ls -d /sys/kernel/slab/*no-objext* 2>/dev/null | wc -l)"
> +L "BEFORE k512=$(k kmalloc-512) k1k=$(k kmalloc-1k)"
> +insmod "$KO" n=2000000 rounds=4 shrink=1 keep=0 shrink_iters=8
> +L "insmod_rc=$?"
> +# extra external shrink storm to force the discard cascade
> +for i in $(seq 1 80); do for c in kmalloc-128 kmalloc-256 kmalloc-512 kmalloc-1k kmalloc-2k kmalloc-4k; do echo 1 > /sys/kernel/slab/$c/shrink 2>/dev/null; done; done
> +sleep 1
> +L "AFTER k512=$(k kmalloc-512) k1k=$(k kmalloc-1k)"
> +L "===== BRANCHTEST END ====="
> +echo "=====DMESG DUMP====="
> +dmesg | grep -E "BT\||REPRODUCER|stack guard|BUG:|Oops|Call Trace|Kernel panic|guard page"
> +echo "=====BRANCHTEST_DONE====="


Thanks for sharing the full reproducer. I'll study it and reproduce the 
issue,

which helps me understand the problem greatly.


Thanks

Best Regards

Hao