On 10/6/26 11:20, Kees Cook wrote:
> Since commit 734bbc1c97ea7 ("ipc, msg: Use dedicated slab buckets for
> alloc_msg()"), alloc_msg() allocates with GFP_KERNEL, and a msg_msg is
> accounted only through SLAB_ACCOUNT on its bucket caches. With
> CONFIG_SLAB_BUCKETS=n, kmem_buckets_create() creates no caches and
> kmem_buckets_alloc() is a GFP_KERNEL kmalloc() from the general caches,
> which do not account it; the same happens when kmem_buckets_create()
> fails. Either way, the allocation is not charged to the sender's memory
> cgroup.
>
> Allocate with GFP_KERNEL_ACCOUNT again, as before that commit. Memcg
> charges such an allocation in whichever cache serves it, so drop the
> SLAB_ACCOUNT, which no longer adds anything.
>
> Build tested ARCH=x86_64 defconfig with GCC 16.2.0, with
> CONFIG_SLAB_BUCKETS as y and n.
>
> Fixes: 734bbc1c97ea7 ("ipc, msg: Use dedicated slab buckets for alloc_msg()")
> Assisted-by: LLM
> Signed-off-by: Kees Cook <[email protected]>
Could we, for the purposes of a backportable fix, just have both
SLAB_ACCOUNT and GFP_KERNEL_ACCOUNT in place? That should do the right thing
regardless of CONFIG_SLAB_BUCKETS state, no?
> ---
> ipc/msgutil.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/ipc/msgutil.c b/ipc/msgutil.c
> index e28f0cecb2ec..1ba8e59cb255 100644
> --- a/ipc/msgutil.c
> +++ b/ipc/msgutil.c
> @@ -43,7 +43,7 @@ static kmem_buckets *msg_buckets __ro_after_init;
>
> static int __init init_msg_buckets(void)
> {
> - msg_buckets = kmem_buckets_create("msg_msg", SLAB_ACCOUNT,
> + msg_buckets = kmem_buckets_create("msg_msg", 0,
> sizeof(struct msg_msg),
> DATALEN_MSG, NULL);
>
> @@ -58,7 +58,8 @@ static struct msg_msg *alloc_msg(size_t len)
> size_t alen;
>
> alen = min(len, DATALEN_MSG);
> - msg = kmem_buckets_alloc(msg_buckets, sizeof(*msg) + alen, GFP_KERNEL);
> + msg = kmem_buckets_alloc(msg_buckets, sizeof(*msg) + alen,
> + GFP_KERNEL_ACCOUNT);
> if (msg == NULL)
> return NULL;
>
