From: Longlong Xia calculate_alignment() with SLAB_HWCACHE_ALIGN halves ralign in a while (size <= ralign / 2) loop. When size is 0, ralign eventually reaches 0 and the condition stays true indefinitely, hanging the kernel. kmem_cache_sanity_check() rejected size > KMALLOC_MAX_SIZE but not size == 0, and the sanity check is compiled out without CONFIG_DEBUG_VM. Add a !object_size check in __kmem_cache_create_args(), which is always compiled, and add !size to the DEBUG_VM sanity check for diagnostics. Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Longlong Xia --- mm/slab_common.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mm/slab_common.c b/mm/slab_common.c index 657fd75776ea..209fe838fe71 100644 --- a/mm/slab_common.c +++ b/mm/slab_common.c @@ -102,7 +102,7 @@ static bool kmem_cache_is_duplicate_name(const char *name) static int kmem_cache_sanity_check(const char *name, unsigned int size) { - if (!name || in_interrupt() || size > KMALLOC_MAX_SIZE) { + if (!name || in_interrupt() || !size || size > KMALLOC_MAX_SIZE) { pr_err("kmem_cache_create(%s) integrity check failed\n", name); return -EINVAL; } @@ -354,7 +354,7 @@ struct kmem_cache *__kmem_cache_create_args(const char *name, goto out_unlock; } - if (flags & ~SLAB_FLAGS_PERMITTED) { + if (!object_size || flags & ~SLAB_FLAGS_PERMITTED) { err = -EINVAL; goto out_unlock; } -- 2.43.0