6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Kees Cook [ Upstream commit c57fbbe42e907fa26c5ffada52d913d4ca5fa66e ] Since commit 734bbc1c97ea7 ("ipc, msg: Use dedicated slab buckets for alloc_msg()"), alloc_msg() allocates with GFP_KERNEL, and a msg_msg is accounted only through SLAB_ACCOUNT on its bucket caches. With CONFIG_SLAB_BUCKETS=n, kmem_buckets_create() creates no caches and kmem_buckets_alloc() is a GFP_KERNEL kmalloc() from the general caches, which do not account it; the same happens when kmem_buckets_create() fails. Either way, the allocation is not charged to the sender's memory cgroup. Allocate with GFP_KERNEL_ACCOUNT again, as before that commit, so the allocation is charged whichever cache serves it. Build tested ARCH=x86_64 defconfig with GCC 16.2.0, with CONFIG_SLAB_BUCKETS as y and n. Fixes: 734bbc1c97ea7 ("ipc, msg: Use dedicated slab buckets for alloc_msg()") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook Link: https://patch.msgid.link/20261014052344.384723-2-kees@kernel.org Signed-off-by: Vlastimil Babka (SUSE) Reviewed-by: Harry Yoo (Meta) Reviewed-by: Pedro Falcato Signed-off-by: Harry Yoo (Meta) Signed-off-by: Sasha Levin --- ipc/msgutil.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ipc/msgutil.c b/ipc/msgutil.c index 7a03f6d03de3a..2b93abb808e7b 100644 --- a/ipc/msgutil.c +++ b/ipc/msgutil.c @@ -63,7 +63,8 @@ static struct msg_msg *alloc_msg(size_t len) size_t alen; alen = min(len, DATALEN_MSG); - msg = kmem_buckets_alloc(msg_buckets, sizeof(*msg) + alen, GFP_KERNEL); + msg = kmem_buckets_alloc(msg_buckets, sizeof(*msg) + alen, + GFP_KERNEL_ACCOUNT); if (msg == NULL) return NULL; -- 2.53.0