Re: [PATCH] mm/slab: reject unsupported kmalloc sizes

[Harry Yoo]

On Thu, Aug 27, 2026 at 06:49:33PM +0200, Vlastimil Babka (SUSE) wrote:
> On 8/27/26 17:51, Zi Yan wrote:
> > On Thu Aug 27, 2026 at 3:47 AM EDT, Vlastimil Babka (SUSE) wrote:
> >> On 8/26/26 11:52 PM, Zi Yan wrote:
> >>> On Wed Aug 26, 2026 at 5:47 PM EDT, Harry Yoo wrote:
> >>>> On Wed, Aug 26, 2026 at 11:28:12AM +0000, Vlastimil Babka (SUSE) wrote:
> >>>>> On 8/17/26 22:40, Zi Yan wrote:
> >>>>>> kmalloc is used to allocate physically contiguous memory for kernel
> >>>>>> allocations. For requests larger than KMALLOC_MAX_CACHE_SIZE, kmalloc uses
> >>>>>> the page allocator and can only support up to KMALLOC_MAX_SIZE. For request
> >>>>>> sizes bigger than KMALLOC_MAX_SIZE, the page allocator can emit a WARN
> >>>>>> because kmalloc allocates an order greater than MAX_PAGE_ORDER. Systems
> >>>>>> with panic_on_warn=1 crash because of this WARN. Fix it by rejecting any
> >>>>>> kmalloc size bigger than KMALLOC_MAX_SIZE.
> >>>>>>
> >>>>>> Fixes: aadb4bc4a1f9 ("SLUB: direct pass through of page size or higher kmalloc requests")
> >>>>>> Reported-by: syzbot+805630f1453e490427fa@xxxxxxxxxxxxxxxxxxxxxxxxx
> >>>>>> Closes: https://lore.kernel.org/all/6a820ebc.9ebadd4d.20b15e.001b.GAE@xxxxxxxxxx/
> >>>>>> Tested-by: syzbot+805630f1453e490427fa@xxxxxxxxxxxxxxxxxxxxxxxxx
> >>>>>> Signed-off-by: Zi Yan <ziy@xxxxxxxxxx>
> >>>>>> Cc: stable@xxxxxxxxxxxxxxx
> >>>>>> ---
> >>>>>> It fixes a page allocator warning (order > MAX_PAGE_ORDER) when gadgetfs
> >>>>>> requests excessively large memory from kmalloc. Instead of adding
> >>>>>> __GFP_NOWARN to suppress the warning, as was done for usbfs[1], change
> >>>>>> kmalloc to return NULL without a warning for this specific issue.
> >>>>>>
> >>>>>> [1] commit 4f2629ea67e72 ("USB: usbfs: Don't WARN about excessively large memory allocations")
> >>>>>
> >>>>> So I checked and for kvmalloc() we have in __kvmalloc_node_noprof()
> >>>>>
> >>>>>         /* Don't even allow crazy sizes */
> >>>>>         if (unlikely(size > INT_MAX)) {
> >>>>>                 WARN_ON_ONCE(!(flags & __GFP_NOWARN));
> >>>>>                 return NULL;
> >>>>>         }
> >>>>>
> >>>>> This comes from Linus in commit 7661809d493b4. I'd do the same thing here
> >>>>> then.
> >>>>
> >>>> But the purpose of this patch is to avoid the warning in the page
> >>>> allocator. Should we fix this in the caller (gadgetfs) then? 
> >>> 
> >>> It is fixed by: https://lore.kernel.org/all/20260820223719.A4A3C1F000E9@xxxxxxxxxxxxxxx/
> >>> 
> >>> Please disregard this patch, but we can keep the discussion going.
> >>
> >> I still think this patch has some value if done as proposed above. Yes
> >> in practice it will just replace the page allocator's warning with a
> >> different warning, but IMHO it's "nicer" if kmalloc() sanitizes its own
> > 
> > And SLAB maintainers will be Cc'd. :)
> 
> For some people it doesn't matter if it's SLAB or PAGE ALLOCATOR :D
> 
> >> requests to the page allocator, using the KMALLOC_MAX_SIZE value.
> > 
> > Like this? Or the exact pattern as kvmalloc() is preferred?
> 
> LGTM.

Looks good to me too.

> Should return NULL even with __GFP_NOWARN or if the warning has fired
> and won't again, and AFAICS this does.

Right.

> The kvmalloc() pattern predates WARN_ON_ONCE_GFP addition, I think.
> 
> > diff --git a/mm/slub.c b/mm/slub.c
> > index 0337e60db5ace..b562f2a6fbbee 100644
> > --- a/mm/slub.c
> > +++ b/mm/slub.c
> > @@ -5263,7 +5263,12 @@ static void *___kmalloc_large_node(size_t size, gfp_t flags, int node)
> >  {
> >  	struct page *page;
> >  	void *ptr = NULL;
> > -	unsigned int order = get_order(size);
> > +	unsigned int order;
> > +
> > +	if (WARN_ON_ONCE_GFP(size > KMALLOC_MAX_SIZE, flags))
> > +		return NULL;
> > +
> > +	order = get_order(size);
> >  
> >  	if (unlikely(flags & GFP_SLAB_BUG_MASK))
> >  		flags = kmalloc_fix_flags(flags);
> > 
> > 

-- 
Cheers,
Harry / Hyeonggon