[PATCH slab/for-next 11/14] smack: specify SLAB_MAY_ACCOUNT for smack_rule cache

Wed Oct 21 19:14:39 UTC 2026

On 10/21/2026 11:48 AM, Harry Yoo wrote:
> On Wed, Oct 21, 2026 at 09:59:15AM -0700, Casey Schaufler wrote:
>> On 10/21/2026 4:46 AM, Harry Yoo (Meta) wrote:
>>> smk_copy_rules() allocates rules with the gfp passed from
>>> security_prepare_creds(), which is GFP_KERNEL_ACCOUNT. Specify
>>> SLAB_MAY_ACCOUNT when the object may be charged to a memcg.
>>> __GFP_ACCOUNT without SLAB_MAY_ACCOUNT will not be allowed.
>>>
>>> Path: fork() -> copy_creds() -> prepare_creds()
>>>   -> security_prepare_creds(GFP_KERNEL_ACCOUNT) -> smack_cred_prepare()
>>>   -> smk_copy_rules() -> kmem_cache_zalloc(smack_rule_cache)
>>>
>>> Assisted-by: LLM
>>> Cc: Casey Schaufler <casey at schaufler-ca.com>
>>> Cc: Paul Moore <paul at paul-moore.com>
>>> Cc: James Morris <jmorris at namei.org>
>>> Cc: "Serge E. Hallyn" <serge at hallyn.com>
>>> Cc: linux-security-module at vger.kernel.org
>>> Signed-off-by: Harry Yoo (Meta) <harry at kernel.org>
>> How was this change tested?

Brilliant response. Thank you. Add my

Reviewed-by: Casey Schaufler <casey at schaufler-ca.com>

> From the cover letter:
>> Each tested cache was verified with the warning in patch 13:
>> I confirmed that 1) the warning is triggered without the conversion,
>> and 2) specifying SLAB_MAY_ACCOUNT resolves it. However I could not test
>> io-pgtable_armv7s_l2 and sun50i's pt_pool caches due to lack of the
>> hardware and emulation support. So they are compile-tested only.
>>
>>   cache                  tested  environment
>>   ---------------------  ------  -----------------------
>>   radix_tree_node        yes     x86
>>   maple_node             yes     x86
>>   buffer_head            yes     x86
>>   skbuff_head_cache      yes     x86
>>   fanotify_*_event       yes     x86
>>   smack_rule             yes     x86
> Good, this can be reasonably tested.
> Let me write down instructions to replay this testing.
>
>>   io-pgtable_armv7s_l2   no      compile-tested only
>>   thread_stack           yes     ppc64le (64K pages)
>>   pgd_cache (arm64)      yes     arm64 (64K pages)
>>   PGT_CACHE (powerpc)    yes     ppc64le
>>   PCI_DMA_*_tables       yes     s390x (zPCI + vfio)
>>   hostfs_inode_cache     yes     UML
>>   sun50i pt_pool         no      compile-tested only
> # Pull the b4 branch from git.kernel.org and configure the kernel
>
> $ git clone -b b4/memalloc-prof-dont-waste-slabobj-ext-metadata \
>       https://git.kernel.org/pub/scm/linux/kernel/git/harry/linux.git smack-repro
> $ cd smack-repro
> $ make defconfig kvm_guest.config
> $ ./scripts/config -e MEMCG -e SECURITY_SMACK -e DEBUG_VM -e FUSE_FS -e VIRTIO_FS -e VIRTIO_MMIO
> $ make olddefconfig
>
> # Create a script to run in a VM
> $ cat > repro.sh << 'EOF'
> #!/bin/sh
> mountpoint -q /sys/fs/cgroup || mount -t cgroup2 none /sys/fs/cgroup
> echo +memory > /sys/fs/cgroup/cgroup.subtree_control
> mkdir -p /sys/fs/cgroup/test
> echo $$ > /sys/fs/cgroup/test/cgroup.procs   # non-root memcg; root is not charged
> mountpoint -q /sys/fs/smackfs || mount -t smackfs smackfs /sys/fs/smackfs
> echo 'foo bar rwxa' > /sys/fs/smackfs/load-self2
> sh -c :   # fork -> prepare_creds -> smk_copy_rules(GFP_KERNEL_ACCOUNT)
> echo "WARN count: $(dmesg | grep -c 'WARNING:.*__memcg_slab_post_alloc_hook')"
> dmesg | sed -n '/cut here/,/end trace/p'
> EOF
>
> # Revert this patch, build the kernel, and test
>
> $ git revert --no-edit HEAD~3 # Revert "smack: specify ..."
> $ vng --build
> $ vng --user root -a lsm=smack -- sh repro.sh
> WARN count: 1
> [    1.178905] ------------[ cut here ]------------
> [    1.178913] WARNING: mm/memcontrol.c:3627 at __memcg_slab_post_alloc_hook+0x4a0/0x7b0, CPU#11: sh/434
> [    1.178922] Modules linked in:
> [    1.178925] CPU: 11 UID: 0 PID: 434 Comm: sh Not tainted 7.3.0-rc1-virtme-g121988b3e78d #3 PREEMPT(lazy)
> [    1.178928] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
> [    1.178929] RIP: 0010:__memcg_slab_post_alloc_hook+0x4a0/0x7b0
> [    1.178932] Code: 86 e2 e3 ff e9 2e fe ff ff e8 7c a3 e3 ff 48 8b 53 10 f6 c2 03 0f 85 53 02 00 00 65 48 ff 0a e8 66 e2 e3 ff e9 52 fc ff ff 90 <0f> 0b 90 e9 ff fd ff ff 48 81 c3 bc 00 00 00 48 8b 0c d8 4c 8b a1
> [    1.178933] RSP: 0018:ff7dde988181bbf8 EFLAGS: 00010246
> [    1.178935] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ff4f87a042e55d00
> [    1.178936] RDX: 0000000000400dc0 RSI: 0000000000000000 RDI: ff4f87a041828b00
> [    1.178937] RBP: ff7dde988181bc80 R08: 0000000000000001 R09: ff7dde988181bc80
> [    1.178938] R10: 0000000000000000 R11: ff7dde988181be90 R12: ff4f87a045b600c0
> [    1.178939] R13: 0000000000000000 R14: ff4f87a04b95dc08 R15: ff4f87a041828b00
> [    1.178943] FS:  00007f5efb4e0780(0000) GS:ff4f87a0de940000(0000) knlGS:0000000000000000
> [    1.178945] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [    1.178946] CR2: 0000555ab8c2dda8 CR3: 000000000594e006 CR4: 0000000000771ef0
> [    1.178947] PKRU: 55555554
> [    1.178948] Call Trace:
> [    1.178950]  <TASK>
> [    1.178951]  ? srso_alias_return_thunk+0x5/0xfbef5
> [    1.178955]  ? __memcg_slab_post_alloc_hook+0x517/0x7b0
> [    1.178957]  kmem_cache_alloc_noprof+0x3ac/0x3e0
> [    1.178960]  ? smack_cred_prepare+0x84/0x180
> [    1.178964]  smack_cred_prepare+0x84/0x180
> [    1.178966]  security_prepare_creds+0x49/0xa0
> [    1.178970]  prepare_creds+0x168/0x280
> [    1.178974]  copy_creds+0x25/0x130
> [    1.178976]  copy_process+0x6d4/0x2830
> [    1.178981]  kernel_clone+0xd5/0x420
> [    1.178984]  __do_sys_clone+0x65/0x90
> [    1.178987]  do_syscall_64+0xda/0x4b0
> [    1.178992]  ? srso_alias_return_thunk+0x5/0xfbef5
> [    1.178994]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> [    1.178996] RIP: 0033:0x7f5efb5d30e8
> [    1.178998] Code: 7d e0 e8 2b 58 f5 ff 45 31 c0 31 d2 31 f6 64 48 8b 04 25 10 00 00 00 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 70 41 89 c4 85 c0 75 31 64 48 8b 04 25 10 00
> [    1.178999] RSP: 002b:00007ffce2898640 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
> [    1.179001] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f5efb5d30e8
> [    1.179002] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
> [    1.179003] RBP: 00007ffce2898660 R08: 0000000000000000 R09: 0000000000000000
> [    1.179003] R10: 00007f5efb4e0a50 R11: 0000000000000246 R12: 0000555aad43184c
> [    1.179004] R13: 00000000ffffffff R14: 0000000000000000 R15: 0000555ab8c37740
> [    1.179007]  </TASK>
> [    1.179008] ---[ end trace 0000000000000000 ]---
>
> # Revert the revert and run the same script in a VM
>
> $ git revert --no-edit HEAD
> $ vng --build
> $ vng --user root -a lsm=smack -- sh repro.sh
> WARN count: 0
>
> Hope this helps.
>