[PATCH slab/for-next 11/14] smack: specify SLAB_MAY_ACCOUNT for smack_rule cache
Harry Yoo
harry at kernel.org
Wed Oct 21 18:48:12 UTC 2026
On Wed, Oct 21, 2026 at 09:59:15AM -0700, Casey Schaufler wrote:
> On 10/21/2026 4:46 AM, Harry Yoo (Meta) wrote:
> > smk_copy_rules() allocates rules with the gfp passed from
> > security_prepare_creds(), which is GFP_KERNEL_ACCOUNT. Specify
> > SLAB_MAY_ACCOUNT when the object may be charged to a memcg.
> > __GFP_ACCOUNT without SLAB_MAY_ACCOUNT will not be allowed.
> >
> > Path: fork() -> copy_creds() -> prepare_creds()
> > -> security_prepare_creds(GFP_KERNEL_ACCOUNT) -> smack_cred_prepare()
> > -> smk_copy_rules() -> kmem_cache_zalloc(smack_rule_cache)
> >
> > Assisted-by: LLM
> > Cc: Casey Schaufler <casey at schaufler-ca.com>
> > Cc: Paul Moore <paul at paul-moore.com>
> > Cc: James Morris <jmorris at namei.org>
> > Cc: "Serge E. Hallyn" <serge at hallyn.com>
> > Cc: linux-security-module at vger.kernel.org
> > Signed-off-by: Harry Yoo (Meta) <harry at kernel.org>
>
> How was this change tested?
>From the cover letter:
> Each tested cache was verified with the warning in patch 13:
> I confirmed that 1) the warning is triggered without the conversion,
> and 2) specifying SLAB_MAY_ACCOUNT resolves it. However I could not test
> io-pgtable_armv7s_l2 and sun50i's pt_pool caches due to lack of the
> hardware and emulation support. So they are compile-tested only.
>
> cache tested environment
> --------------------- ------ -----------------------
> radix_tree_node yes x86
> maple_node yes x86
> buffer_head yes x86
> skbuff_head_cache yes x86
> fanotify_*_event yes x86
> smack_rule yes x86
Good, this can be reasonably tested.
Let me write down instructions to replay this testing.
> io-pgtable_armv7s_l2 no compile-tested only
> thread_stack yes ppc64le (64K pages)
> pgd_cache (arm64) yes arm64 (64K pages)
> PGT_CACHE (powerpc) yes ppc64le
> PCI_DMA_*_tables yes s390x (zPCI + vfio)
> hostfs_inode_cache yes UML
> sun50i pt_pool no compile-tested only
# Pull the b4 branch from git.kernel.org and configure the kernel
$ git clone -b b4/memalloc-prof-dont-waste-slabobj-ext-metadata \
https://git.kernel.org/pub/scm/linux/kernel/git/harry/linux.git smack-repro
$ cd smack-repro
$ make defconfig kvm_guest.config
$ ./scripts/config -e MEMCG -e SECURITY_SMACK -e DEBUG_VM -e FUSE_FS -e VIRTIO_FS -e VIRTIO_MMIO
$ make olddefconfig
# Create a script to run in a VM
$ cat > repro.sh << 'EOF'
#!/bin/sh
mountpoint -q /sys/fs/cgroup || mount -t cgroup2 none /sys/fs/cgroup
echo +memory > /sys/fs/cgroup/cgroup.subtree_control
mkdir -p /sys/fs/cgroup/test
echo $$ > /sys/fs/cgroup/test/cgroup.procs # non-root memcg; root is not charged
mountpoint -q /sys/fs/smackfs || mount -t smackfs smackfs /sys/fs/smackfs
echo 'foo bar rwxa' > /sys/fs/smackfs/load-self2
sh -c : # fork -> prepare_creds -> smk_copy_rules(GFP_KERNEL_ACCOUNT)
echo "WARN count: $(dmesg | grep -c 'WARNING:.*__memcg_slab_post_alloc_hook')"
dmesg | sed -n '/cut here/,/end trace/p'
EOF
# Revert this patch, build the kernel, and test
$ git revert --no-edit HEAD~3 # Revert "smack: specify ..."
$ vng --build
$ vng --user root -a lsm=smack -- sh repro.sh
WARN count: 1
[ 1.178905] ------------[ cut here ]------------
[ 1.178913] WARNING: mm/memcontrol.c:3627 at __memcg_slab_post_alloc_hook+0x4a0/0x7b0, CPU#11: sh/434
[ 1.178922] Modules linked in:
[ 1.178925] CPU: 11 UID: 0 PID: 434 Comm: sh Not tainted 7.3.0-rc1-virtme-g121988b3e78d #3 PREEMPT(lazy)
[ 1.178928] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 1.178929] RIP: 0010:__memcg_slab_post_alloc_hook+0x4a0/0x7b0
[ 1.178932] Code: 86 e2 e3 ff e9 2e fe ff ff e8 7c a3 e3 ff 48 8b 53 10 f6 c2 03 0f 85 53 02 00 00 65 48 ff 0a e8 66 e2 e3 ff e9 52 fc ff ff 90 <0f> 0b 90 e9 ff fd ff ff 48 81 c3 bc 00 00 00 48 8b 0c d8 4c 8b a1
[ 1.178933] RSP: 0018:ff7dde988181bbf8 EFLAGS: 00010246
[ 1.178935] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ff4f87a042e55d00
[ 1.178936] RDX: 0000000000400dc0 RSI: 0000000000000000 RDI: ff4f87a041828b00
[ 1.178937] RBP: ff7dde988181bc80 R08: 0000000000000001 R09: ff7dde988181bc80
[ 1.178938] R10: 0000000000000000 R11: ff7dde988181be90 R12: ff4f87a045b600c0
[ 1.178939] R13: 0000000000000000 R14: ff4f87a04b95dc08 R15: ff4f87a041828b00
[ 1.178943] FS: 00007f5efb4e0780(0000) GS:ff4f87a0de940000(0000) knlGS:0000000000000000
[ 1.178945] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1.178946] CR2: 0000555ab8c2dda8 CR3: 000000000594e006 CR4: 0000000000771ef0
[ 1.178947] PKRU: 55555554
[ 1.178948] Call Trace:
[ 1.178950] <TASK>
[ 1.178951] ? srso_alias_return_thunk+0x5/0xfbef5
[ 1.178955] ? __memcg_slab_post_alloc_hook+0x517/0x7b0
[ 1.178957] kmem_cache_alloc_noprof+0x3ac/0x3e0
[ 1.178960] ? smack_cred_prepare+0x84/0x180
[ 1.178964] smack_cred_prepare+0x84/0x180
[ 1.178966] security_prepare_creds+0x49/0xa0
[ 1.178970] prepare_creds+0x168/0x280
[ 1.178974] copy_creds+0x25/0x130
[ 1.178976] copy_process+0x6d4/0x2830
[ 1.178981] kernel_clone+0xd5/0x420
[ 1.178984] __do_sys_clone+0x65/0x90
[ 1.178987] do_syscall_64+0xda/0x4b0
[ 1.178992] ? srso_alias_return_thunk+0x5/0xfbef5
[ 1.178994] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 1.178996] RIP: 0033:0x7f5efb5d30e8
[ 1.178998] Code: 7d e0 e8 2b 58 f5 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 70 41 89 c4 85 c0 75 31 64 48 8b 04 25 10 00
[ 1.178999] RSP: 002b:00007ffce2898640 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
[ 1.179001] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f5efb5d30e8
[ 1.179002] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
[ 1.179003] RBP: 00007ffce2898660 R08: 0000000000000000 R09: 0000000000000000
[ 1.179003] R10: 00007f5efb4e0a50 R11: 0000000000000246 R12: 0000555aad43184c
[ 1.179004] R13: 00000000ffffffff R14: 0000000000000000 R15: 0000555ab8c37740
[ 1.179007] </TASK>
[ 1.179008] ---[ end trace 0000000000000000 ]---
# Revert the revert and run the same script in a VM
$ git revert --no-edit HEAD
$ vng --build
$ vng --user root -a lsm=smack -- sh repro.sh
WARN count: 0
Hope this helps.
--
Cheers,
Harry / Hyeonggon
More information about the Linux-security-module-archive
mailing list