Re: [PATCH] zsmalloc: use actual object size to detect spans

[Sergey Senozhatsky <senozhatsky@chromium.org>]

On (26/01/07 02:10), Yosry Ahmed wrote:
> On Wed, Jan 07, 2026 at 11:06:09AM +0900, Sergey Senozhatsky wrote:
> > On (26/01/07 01:56), Yosry Ahmed wrote:
> > > > I recall us having exactly this idea when we first introduced
> > > > zs_obj_{read,write}_end() functions, and I do recall that it
> > > > did not work.  Somehow this panics in __memcpy+0xc/0x44.  Let
> > > > me dig into it again.
> > > 
> > > Maybe because at this point we are trying to memcpy() class->size, which
> > > already includes ZS_HANDLE_SIZE. So reading after increasing the offset
> > > reads ZS_HANDLE_SIZE after class->size.
> > 
> > Yeah, I guess that falsely hits the spanning path because of extra
> > sizeof(unsigned long).
> 
> Or the object could be spanning two pages indeed, but we're copying
> extra sizeof(unsigned long), that shouldn't crash tho.

It seems there is no second page, it's a pow-of-two size class.  So
we mis-detect spanning.

[   51.406310] zsmalloc: :: size class 48, orig offt 16336, page size 16384, memcpy sizes 40, 8
[   51.407571] Unable to handle kernel paging request at virtual address ffffc04000000000
[   51.420816] pc : __memcpy+0xc/0x44

Second memcpy() of sizeof(unsigned long) traps.

> I think the changes need to be shuffled around to avoid this, or just
> have a combined patch, which would be less pretty.

I think I prefer a shuffle.

There is another possible improvement point (UNTESTED): if the first
page holds only ZS_HANDLE bytes, then we can avoid memcpy() path and
instead just kmap the second page + offset.