Re: [PATCH v4 6/7] mm/slab: Let a bucket set handle __GFP_ACCOUNT

[Harry Yoo]

On Mon, Sep 21, 2026 at 12:58:17AM -0700, Kees Cook wrote:
> A bucket set holds one row of caches, cloned from KMALLOC_NORMAL, and an
> allocation of any other kmalloc type falls back to the general caches.
> Extend this to handle __GFP_ACCOUNT, so that a single bucket user can
> isolate either GFP_KERNEL or GFP_KERNEL_ACCOUNT allocations, as is
> needed for skb data, where AF_UNIX uses:
> 
> 	sk->sk_allocation = GFP_KERNEL_ACCOUNT;
> 
> The coverage is selected at bucket creation time:
> 
> 	b = kmem_buckets_create_types(name, flags, 0, INT_MAX, NULL,
> 				      BIT(KMEM_BUCKET_NORMAL) |
> 				      BIT(KMEM_BUCKET_CGROUP));
> 
> The prior kmem_buckets_create() function keeps its name and defaults
> to only KMEM_BUCKET_NORMAL, leaving existing users as-is.
> 
> Only the accounted type is offered. Nothing wants a reclaimable or
> no-obj-ext row, and of the twelve places passing GFP_DMA to an skb
> allocator, all rare hardware: b44, b43legacy, prestera and s390 ctcm.
> 
> The choice is made at creation rather than every set getting every type
> because the rows, when populated, are not free. Each holds 13 caches, and
> a cache is a 1208 byte struct plus an unconditional per-cpu allocation,
> a node struct, and an entry in /proc/slabinfo and under /sys/kernel/slab.
> 
> KMEM_BUCKET_CGROUP collapses to KMEM_BUCKET_NORMAL without CONFIG_MEMCG,
> exactly as KMALLOC_CGROUP does, so NR_KMEM_BUCKET_TYPES is 1 there and a
> bucket set is the same single row it is today. Where the type is asked for
> but the system is not creating caches of it (under "cgroup.memory=nokmem")
> the row is aliased to the normal one, as new_kmalloc_cache() does for the
> general caches, so those allocations stay isolated rather than falling
> back to the general caches.
> 
> Built and tests pass (and skip as expected) on ARCH=x86_64 defconfig
> with GCC 16.2.0 in all combinations of CONFIG_SLAB_BUCKETS=y/n and
> CONFIG_MEMCG=y/n/y+"cgroup.memory=nokmem".
> 
> Assisted-by: LLM
> Signed-off-by: Kees Cook <kees@xxxxxxxxxx>
> ---
> Cc: Vlastimil Babka <vbabka@xxxxxxxxxx>
> Cc: Harry Yoo <harry@xxxxxxxxxx>
> Cc: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
> Cc: Hao Li <hao.li@xxxxxxxxx>
> Cc: Christoph Lameter <cl@xxxxxxxxxx>
> Cc: David Rientjes <rientjes@xxxxxxxxxx>
> Cc: Roman Gushchin <roman.gushchin@xxxxxxxxx>
> Cc: <linux-mm@xxxxxxxxx>
> Cc: Pedro Falcato <pfalcato@xxxxxxx>
> Cc: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
> Cc: <linux-hardening@xxxxxxxxxxxxxxx>
> ---
>  include/linux/slab.h   |  45 ++++++++++++-
>  mm/slab.h              |  23 ++++++-
>  lib/tests/slub_kunit.c |  65 +++++++++++++++---
>  mm/slab_common.c       | 145 ++++++++++++++++++++++++++++++++---------
>  4 files changed, 235 insertions(+), 43 deletions(-)
> 
> diff --git a/lib/tests/slub_kunit.c b/lib/tests/slub_kunit.c
> index 823607e06248..58f800582170 100644
> --- a/lib/tests/slub_kunit.c
> +++ b/lib/tests/slub_kunit.c
> @@ -723,15 +723,63 @@ static void test_kmem_buckets_type_fallback(struct kunit *test)
>  				      "expected a DMA cache, got %s", c->name);
>  	}
>  
> -	/* Nor can one that has to be accounted. */
> -	if (IS_ENABLED(CONFIG_MEMCG) && !mem_cgroup_kmem_disabled()) {


Didn't take a deeper look at this yet but this is causing an error:

MODPOST Module.symvers
ERROR: modpost: lib/tests/slub_kunit.ko: symbol 'mem_cgroup_kmem_disabled' undefined!
make[3]: *** [../scripts/Makefile.modpost:147: Module.symvers] Error 1
make[2]: *** [/var/lib/jenkins/agent/workspace/harry-linux/ARCH/x86_64/COMPILER/clang/DEBUG/light/PREEMPT/lazy/src/Makefile:2179: modpost] Error 2
make[1]: *** [/var/lib/jenkins/agent/workspace/harry-linux/ARCH/x86_64/COMPILER/clang/DEBUG/light/PREEMPT/lazy/src/Makefile:248: __sub-make] Error 2
make[1]: Leaving directory '/var/lib/jenkins/agent/workspace/harry-linux/ARCH/x86_64/COMPILER/clang/DEBUG/light/PREEMPT/lazy/src/build'
make: *** [Makefile:248: __sub-make] Error 2
Build step 'Execute shell' marked build as failure

-- 
Cheers,
Harry / Hyeonggon