Re: [PATCH] mm/slab: change stride type from unsigned short to unsigned int

[Hao Li <hao.li@linux.dev>]

On Thu, Mar 05, 2026 at 04:05:21PM +0900, Harry Yoo wrote:
> On Thu, Mar 05, 2026 at 12:24:08PM +0530, Venkat Rao Bagalkote wrote:
> > On 03/03/26 7:27 pm, Harry Yoo wrote:
> > > Commit 7a8e71bc619d ("mm/slab: use stride to access slabobj_ext")
> > > defined the type of slab->stride as unsigned short, because the author
> > > initially planned to store stride within the lower 16 bits of the
> > > page_type field, but later stored it in unused bits in the counters
> > > field instead.
> > > 
> > > However, the idea of having only 2-byte stride turned out to be a
> > > serious mistake. On systems with 64k pages, order-1 pages are 128k,
> > > which is larger than USHRT_MAX. It triggers a debug warning because
> > > s->size is 128k while stride, truncated to 2 bytes, becomes zero:
> > > 
> > >    ------------[ cut here ]------------
> > >    Warning! stride (0) != s->size (131072)
> > >    WARNING: mm/slub.c:2231 at alloc_slab_obj_exts_early.constprop.0+0x524/0x534, CPU#6: systemd-sysctl/307
> > >    Modules linked in:
> > >    CPU: 6 UID: 0 PID: 307 Comm: systemd-sysctl Not tainted 7.0.0-rc1+ #6 PREEMPTLAZY
> > >    Hardware name: IBM,9009-22A POWER9 (architected) 0x4e0202 0xf000005 of:IBM,FW950.E0 (VL950_179) hv:phyp pSeries
> > >    NIP:  c0000000008a9ac0 LR: c0000000008a9abc CTR: 0000000000000000
> > >    REGS: c0000000141f7390 TRAP: 0700   Not tainted  (7.0.0-rc1+)
> > >    MSR:  8000000000029033 <SF,EE,ME,IR,DR,RI,LE>  CR: 28004400  XER: 00000005
> > >    CFAR: c000000000279318 IRQMASK: 0
> > >    GPR00: c0000000008a9abc c0000000141f7630 c00000000252a300 c00000001427b200
> > >    GPR04: 0000000000000004 0000000000000000 c000000000278fd0 0000000000000000
> > >    GPR08: fffffffffffe0000 0000000000000000 0000000000000000 0000000022004400
> > >    GPR12: c000000000f644b0 c000000017ff8f00 0000000000000000 0000000000000000
> > >    GPR16: 0000000000000000 c0000000141f7aa0 0000000000000000 c0000000141f7a88
> > >    GPR20: 0000000000000000 0000000000400cc0 ffffffffffffffff c00000001427b180
> > >    GPR24: 0000000000000004 00000000000c0cc0 c000000004e89a20 c00000005de90011
> > >    GPR28: 0000000000010010 c00000005df00000 c000000006017f80 c00c000000177a00
> > >    NIP [c0000000008a9ac0] alloc_slab_obj_exts_early.constprop.0+0x524/0x534
> > >    LR [c0000000008a9abc] alloc_slab_obj_exts_early.constprop.0+0x520/0x534
> > >    Call Trace:
> > >    [c0000000141f7630] [c0000000008a9abc] alloc_slab_obj_exts_early.constprop.0+0x520/0x534 (unreliable)
> > >    [c0000000141f76c0] [c0000000008aafbc] allocate_slab+0x154/0x94c
> > >    [c0000000141f7760] [c0000000008b41c0] refill_objects+0x124/0x16c
> > >    [c0000000141f77c0] [c0000000008b4be0] __pcs_replace_empty_main+0x2b0/0x444
> > >    [c0000000141f7810] [c0000000008b9600] __kvmalloc_node_noprof+0x840/0x914
> > >    [c0000000141f7900] [c000000000a3dd40] seq_read_iter+0x60c/0xb00
> > >    [c0000000141f7a10] [c000000000b36b24] proc_reg_read_iter+0x154/0x1fc
> > >    [c0000000141f7a50] [c0000000009cee7c] vfs_read+0x39c/0x4e4
> > >    [c0000000141f7b30] [c0000000009d0214] ksys_read+0x9c/0x180
> > >    [c0000000141f7b90] [c00000000003a8d0] system_call_exception+0x1e0/0x4b0
> > >    [c0000000141f7e50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec
> > > 
> > > This leads to slab_obj_ext() returning the first slabobj_ext or all
> > > objects and confuses the reference counting of object cgroups [1] and
> > > memory (un)charging for memory cgroups [2].
> > > 
> > > Fortunately, the counters field has 32 unused bits instead of 16
> > > on 64-bit CPUs, which is wide enough to hold any value of s->size.
> > > Change the type to unsigned int.
> > > 
> > > Reported-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>
> > > Closes: https://lore.kernel.org/lkml/ca241daa-e7e7-4604-a48d-de91ec9184a5@linux.ibm.com
> > > Closes: https://lore.kernel.org/all/ddff7c7d-c0c3-4780-808f-9a83268bbf0c@linux.ibm.com
> > > Fixes: 7a8e71bc619d ("mm/slab: use stride to access slabobj_ext")
> > > Signed-off-by: Harry Yoo <harry.yoo@oracle.com>
> > > ---
> > > 
> > > Hi Venkat, could you please test this on top of 7.0-rc2 (instead of
> > > 7.0-rc1) and see if the bugs [1] [2] are reproduced on your machine?
> > 
> > 
> > Hello Harry,
> > 
> > Apologizes for delayed response,
> 
> No worries.
> 
> > I was out sick.
> 
> Ouch :( hope you feel better now.
> 
> > I have tested this patch on top of 7.0-rc2, and confirm, this patch fixes
> > both the reported issue.
> >
> > Tested-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>
> 
> Thanks a lot for testing & confirming!

Indeed!
What a counterintuitive issue!

-- 
Thanks,
Hao