[PATCH] mm, slab: clean up slab->obj_exts always

[PATCH] mm, slab: clean up slab->obj_exts always

[Zhenhua Huang]

When memory allocation profiling is disabled at runtime or due to an
error, shutdown_mem_profiling() is called: slab->obj_exts which
previously allocated remains.
It won't be cleared by unaccount_slab() because of
mem_alloc_profiling_enabled() not true. It's incorrect, slab->obj_exts
should always be cleaned up in unaccount_slab() to avoid following error:

[...]BUG: Bad page state in process...
..
[...]page dumped because: page still charged to cgroup

Fixes: 21c690a349baa ("mm: introduce slabobj_ext to support slab object extensions")
Signed-off-by: Zhenhua Huang <quic_zhenhuah@quicinc.com>
---
 mm/slub.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/mm/slub.c b/mm/slub.c
index dac149df1be1..b42ce3a88806 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2023,7 +2023,7 @@ int alloc_slab_obj_exts(struct slab *slab, struct kmem_cache *s,
 	return 0;
 }
 
-/* Should be called only if mem_alloc_profiling_enabled() */
+/* Should be called if slab_obj_exts(slab) */
 static noinline void free_slab_obj_exts(struct slab *slab)
 {
 	struct slabobj_ext *obj_exts;
@@ -2592,7 +2592,11 @@ static __always_inline void account_slab(struct slab *slab, int order,
 static __always_inline void unaccount_slab(struct slab *slab, int order,
 					   struct kmem_cache *s)
 {
-	if (memcg_kmem_online() || need_slab_obj_ext())
+	/*
+	 * The slab object extensions should now be freed regardless of
+	 * whether mem_alloc_profiling_enabled() or not now.
+	 */
+	if (memcg_kmem_online() || slab_obj_exts(slab))
 		free_slab_obj_exts(slab);
 
 	mod_node_page_state(slab_pgdat(slab), cache_vmstat_idx(s),
-- 
2.25.1

Re: [PATCH] mm, slab: clean up slab->obj_exts always

[Harry Yoo]

On Fri, Apr 18, 2025 at 02:14:59PM +0800, Zhenhua Huang wrote:
> When memory allocation profiling is disabled at runtime or due to an
> error, shutdown_mem_profiling() is called: slab->obj_exts which
> previously allocated remains.
> It won't be cleared by unaccount_slab() because of
> mem_alloc_profiling_enabled() not true. It's incorrect, slab->obj_exts
> should always be cleaned up in unaccount_slab() to avoid following error:
> 
> [...]BUG: Bad page state in process...
> ..
> [...]page dumped because: page still charged to cgroup
> 
> Fixes: 21c690a349baa ("mm: introduce slabobj_ext to support slab object extensions")
> Signed-off-by: Zhenhua Huang <quic_zhenhuah@quicinc.com>
> ---

Acked-by: Harry Yoo <harry.yoo@oracle.com>

I reproduced the issue locally and confirmed that this patch fixes
the issue.

Tested-by: Harry Yoo <harry.yoo@oracle.com>

By the way, I think this should probably be backported to -stable?

-- 
Cheers,
Harry / Hyeonggon

>  mm/slub.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/mm/slub.c b/mm/slub.c
> index dac149df1be1..b42ce3a88806 100644
> --- a/mm/slub.c
> +++ b/mm/slub.c
> @@ -2023,7 +2023,7 @@ int alloc_slab_obj_exts(struct slab *slab, struct kmem_cache *s,
>  	return 0;
>  }
>  
> -/* Should be called only if mem_alloc_profiling_enabled() */
> +/* Should be called if slab_obj_exts(slab) */
>  static noinline void free_slab_obj_exts(struct slab *slab)
>  {
>  	struct slabobj_ext *obj_exts;
> @@ -2592,7 +2592,11 @@ static __always_inline void account_slab(struct slab *slab, int order,
>  static __always_inline void unaccount_slab(struct slab *slab, int order,
>  					   struct kmem_cache *s)
>  {
> -	if (memcg_kmem_online() || need_slab_obj_ext())
> +	/*
> +	 * The slab object extensions should now be freed regardless of
> +	 * whether mem_alloc_profiling_enabled() or not now.
> +	 */
> +	if (memcg_kmem_online() || slab_obj_exts(slab))
>  		free_slab_obj_exts(slab);
>  
>  	mod_node_page_state(slab_pgdat(slab), cache_vmstat_idx(s),
> -- 
> 2.25.1
> 
> 

Re: [PATCH] mm, slab: clean up slab->obj_exts always

[Suren Baghdasaryan]

On Fri, Apr 18, 2025 at 8:17 AM Harry Yoo <harry.yoo@oracle.com> wrote:
>
> On Fri, Apr 18, 2025 at 02:14:59PM +0800, Zhenhua Huang wrote:
> > When memory allocation profiling is disabled at runtime or due to an
> > error, shutdown_mem_profiling() is called: slab->obj_exts which
> > previously allocated remains.
> > It won't be cleared by unaccount_slab() because of
> > mem_alloc_profiling_enabled() not true. It's incorrect, slab->obj_exts
> > should always be cleaned up in unaccount_slab() to avoid following error:
> >
> > [...]BUG: Bad page state in process...
> > ..
> > [...]page dumped because: page still charged to cgroup
> >
> > Fixes: 21c690a349baa ("mm: introduce slabobj_ext to support slab object extensions")
> > Signed-off-by: Zhenhua Huang <quic_zhenhuah@quicinc.com>

Thanks for reporting and fixing the issue!

> > ---
>
> Acked-by: Harry Yoo <harry.yoo@oracle.com>
>
> I reproduced the issue locally and confirmed that this patch fixes
> the issue.
>
> Tested-by: Harry Yoo <harry.yoo@oracle.com>
>
> By the way, I think this should probably be backported to -stable?
>
> --
> Cheers,
> Harry / Hyeonggon
>
> >  mm/slub.c | 8 ++++++--
> >  1 file changed, 6 insertions(+), 2 deletions(-)
> >
> > diff --git a/mm/slub.c b/mm/slub.c
> > index dac149df1be1..b42ce3a88806 100644
> > --- a/mm/slub.c
> > +++ b/mm/slub.c
> > @@ -2023,7 +2023,7 @@ int alloc_slab_obj_exts(struct slab *slab, struct kmem_cache *s,
> >       return 0;
> >  }
> >
> > -/* Should be called only if mem_alloc_profiling_enabled() */
> > +/* Should be called if slab_obj_exts(slab) */
> >  static noinline void free_slab_obj_exts(struct slab *slab)
> >  {
> >       struct slabobj_ext *obj_exts;
> > @@ -2592,7 +2592,11 @@ static __always_inline void account_slab(struct slab *slab, int order,
> >  static __always_inline void unaccount_slab(struct slab *slab, int order,
> >                                          struct kmem_cache *s)
> >  {
> > -     if (memcg_kmem_online() || need_slab_obj_ext())
> > +     /*
> > +      * The slab object extensions should now be freed regardless of
> > +      * whether mem_alloc_profiling_enabled() or not now.

This comment does not explain why. I amended it in my suggestion below.

> > +      */
> > +     if (memcg_kmem_online() || slab_obj_exts(slab))
> >               free_slab_obj_exts(slab);

free_slab_obj_exts() will be checking again that for
slab_obj_exts(slab) != NULL. Since this change effectively removes the
static key check (mem_alloc_profiling_enabled() call inside
need_slab_obj_ext()), I think we can simply make free_slab_obj_exts()
inline function and remove the above condition completely. IOW:

static inline void free_slab_obj_exts(struct slab *slab)
{
        struct slabobj_ext *obj_exts;

        obj_exts = slab_obj_exts(slab);
        if (!obj_exts)
                return;
        ...
        slab->obj_exts = 0;
}

static __always_inline void unaccount_slab(...)
{
     /*
      * The slab object extensions should be freed regardless of
      * whether mem_alloc_profiling_enabled() or not because profiling
      * might have been disabled after slab->obj_exts got allocated.
      */
      free_slab_obj_exts(slab);
      ...
}

> >
> >       mod_node_page_state(slab_pgdat(slab), cache_vmstat_idx(s),
> > --
> > 2.25.1
> >
> >

Re: [PATCH] mm, slab: clean up slab->obj_exts always

[Zhenhua Huang]

Thanks Suren.

On 2025/4/19 7:09, Suren Baghdasaryan wrote:
> On Fri, Apr 18, 2025 at 8:17 AM Harry Yoo <harry.yoo@oracle.com> wrote:
>>
>> On Fri, Apr 18, 2025 at 02:14:59PM +0800, Zhenhua Huang wrote:
>>> When memory allocation profiling is disabled at runtime or due to an
>>> error, shutdown_mem_profiling() is called: slab->obj_exts which
>>> previously allocated remains.
>>> It won't be cleared by unaccount_slab() because of
>>> mem_alloc_profiling_enabled() not true. It's incorrect, slab->obj_exts
>>> should always be cleaned up in unaccount_slab() to avoid following error:
>>>
>>> [...]BUG: Bad page state in process...
>>> ..
>>> [...]page dumped because: page still charged to cgroup
>>>
>>> Fixes: 21c690a349baa ("mm: introduce slabobj_ext to support slab object extensions")
>>> Signed-off-by: Zhenhua Huang <quic_zhenhuah@quicinc.com>
> 
> Thanks for reporting and fixing the issue!
> 
>>> ---
>>
>> Acked-by: Harry Yoo <harry.yoo@oracle.com>
>>
>> I reproduced the issue locally and confirmed that this patch fixes
>> the issue.
>>
>> Tested-by: Harry Yoo <harry.yoo@oracle.com>
>>
>> By the way, I think this should probably be backported to -stable?
>>
>> --
>> Cheers,
>> Harry / Hyeonggon
>>
>>>   mm/slub.c | 8 ++++++--
>>>   1 file changed, 6 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/mm/slub.c b/mm/slub.c
>>> index dac149df1be1..b42ce3a88806 100644
>>> --- a/mm/slub.c
>>> +++ b/mm/slub.c
>>> @@ -2023,7 +2023,7 @@ int alloc_slab_obj_exts(struct slab *slab, struct kmem_cache *s,
>>>        return 0;
>>>   }
>>>
>>> -/* Should be called only if mem_alloc_profiling_enabled() */
>>> +/* Should be called if slab_obj_exts(slab) */
>>>   static noinline void free_slab_obj_exts(struct slab *slab)
>>>   {
>>>        struct slabobj_ext *obj_exts;
>>> @@ -2592,7 +2592,11 @@ static __always_inline void account_slab(struct slab *slab, int order,
>>>   static __always_inline void unaccount_slab(struct slab *slab, int order,
>>>                                           struct kmem_cache *s)
>>>   {
>>> -     if (memcg_kmem_online() || need_slab_obj_ext())
>>> +     /*
>>> +      * The slab object extensions should now be freed regardless of
>>> +      * whether mem_alloc_profiling_enabled() or not now.
> 
> This comment does not explain why. I amended it in my suggestion below.

I will follow your suggestion.

> 
>>> +      */
>>> +     if (memcg_kmem_online() || slab_obj_exts(slab))
>>>                free_slab_obj_exts(slab);
> 
> free_slab_obj_exts() will be checking again that for
> slab_obj_exts(slab) != NULL. Since this change effectively removes the
> static key check (mem_alloc_profiling_enabled() call inside
> need_slab_obj_ext()), I think we can simply make free_slab_obj_exts()
> inline function and remove the above condition completely. IOW:
> 

Got it. I'll send another version that includes these changes.

> static inline void free_slab_obj_exts(struct slab *slab)
> {
>          struct slabobj_ext *obj_exts;
> 
>          obj_exts = slab_obj_exts(slab);
>          if (!obj_exts)
>                  return;
>          ...
>          slab->obj_exts = 0;
> }
> 
> static __always_inline void unaccount_slab(...)
> {
>       /*
>        * The slab object extensions should be freed regardless of
>        * whether mem_alloc_profiling_enabled() or not because profiling
>        * might have been disabled after slab->obj_exts got allocated.
>        */
>        free_slab_obj_exts(slab);
>        ...
> }
> 
>>>
>>>        mod_node_page_state(slab_pgdat(slab), cache_vmstat_idx(s),
>>> --
>>> 2.25.1
>>>
>>>

Re: [PATCH] mm, slab: clean up slab->obj_exts always

[Zhenhua Huang]

On 2025/4/18 23:17, Harry Yoo wrote:
> On Fri, Apr 18, 2025 at 02:14:59PM +0800, Zhenhua Huang wrote:
>> When memory allocation profiling is disabled at runtime or due to an
>> error, shutdown_mem_profiling() is called: slab->obj_exts which
>> previously allocated remains.
>> It won't be cleared by unaccount_slab() because of
>> mem_alloc_profiling_enabled() not true. It's incorrect, slab->obj_exts
>> should always be cleaned up in unaccount_slab() to avoid following error:
>>
>> [...]BUG: Bad page state in process...
>> ..
>> [...]page dumped because: page still charged to cgroup
>>
>> Fixes: 21c690a349baa ("mm: introduce slabobj_ext to support slab object extensions")
>> Signed-off-by: Zhenhua Huang<quic_zhenhuah@quicinc.com>
>> ---
> Acked-by: Harry Yoo<harry.yoo@oracle.com>
> 
> I reproduced the issue locally and confirmed that this patch fixes
> the issue.
> 
> Tested-by: Harry Yoo<harry.yoo@oracle.com>
> 
> By the way, I think this should probably be backported to -stable?

Thanks Harry, I'll send another patch that incorporates Suren's 
suggestion as well.

> 
> -- Cheers, Harry / Hyeonggon

Re: [PATCH] mm, slab: clean up slab->obj_exts always

[David Rientjes]

On Fri, 18 Apr 2025, Zhenhua Huang wrote:

> When memory allocation profiling is disabled at runtime or due to an
> error, shutdown_mem_profiling() is called: slab->obj_exts which
> previously allocated remains.
> It won't be cleared by unaccount_slab() because of
> mem_alloc_profiling_enabled() not true. It's incorrect, slab->obj_exts
> should always be cleaned up in unaccount_slab() to avoid following error:
> 
> [...]BUG: Bad page state in process...
> ..
> [...]page dumped because: page still charged to cgroup
> 
> Fixes: 21c690a349baa ("mm: introduce slabobj_ext to support slab object extensions")
> Signed-off-by: Zhenhua Huang <quic_zhenhuah@quicinc.com>

Acked-by: David Rientjes <rientjes@google.com>