Re: [PATCH v3 10/13] mm/slab: reduce slabobj_ext memory with allocation profiling disabled

Per sashiko [1], a fixed up version below. Couldn't trigger the issue
although seems to me it's real. Perhaps can happen only with SLUB_TINY
otherwise the sheaf can't have obj_exts allocated from objcg charge path.

[1] https://sashiko.dev/#/patchset/20260727-b4-objext_split-v3-0-c29ef0f1f257%40kernel.org?part=10

----8<----
From 905c6500e597a8ecf123ad167698f0a0c1a764bd Mon Sep 17 00:00:00 2001
From: "Vlastimil Babka (SUSE)" <[email protected]>
Date: Wed, 8 Jul 2026 17:04:36 +0200
Subject: [PATCH] mm/slab: reduce slabobj_ext memory with allocation profiling
 disabled

When memory allocation profiling is compiled in but permanently disabled
on boot with (implicit or explicit) "never" parameter, stop allocating
(thus wasting) memory for the codetag_ref parts of slabobj_ext metadata.

Do this by using the new slab_obj_ext_has_codetag() helper in
cache_obj_ext_size().

Additionally add slab_obj_ext_has_codetag() checks in
mark_obj_codetag_empty() and handle_failed_objexts_alloc(). The
functions might get called with memory allocation profiling disabled,
when the obj_ext array is allocated for objcg pointers only. Setting
codetag refs as empty is unnecessary in that case, and with them not
allocated anymore would now result in memory corruption.

Reviewed-by: Suren Baghdasaryan <[email protected]>
Signed-off-by: Vlastimil Babka (SUSE) <[email protected]>
---
 mm/slab.h | 2 +-
 mm/slub.c | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/mm/slab.h b/mm/slab.h
index 8f352d9f4d91..f86d4ed3f2be 100644
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -591,7 +591,7 @@ static inline size_t cache_obj_ext_size(struct kmem_cache *s)
 	if (IS_ENABLED(CONFIG_MEMCG))
 		sz += 1;
 
-	if (IS_ENABLED(CONFIG_MEM_ALLOC_PROFILING))
+	if (slab_obj_ext_has_codetag())
 		sz += 1;
 
 	return sizeof(struct slabobj_ext) * sz;
diff --git a/mm/slub.c b/mm/slub.c
index 67958f2b3bab..ec3997582f31 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2064,6 +2064,9 @@ static inline void mark_obj_codetag_empty(const void *obj)
 	struct slab *obj_slab;
 	unsigned long slab_exts;
 
+	if (!slab_obj_ext_has_codetag())
+		return;
+
 	if (is_kfence_address(obj))
 		return;
 
@@ -2099,6 +2102,9 @@ static inline void handle_failed_objexts_alloc(struct slab *slab,
 {
 	unsigned int stride;
 
+	if (!slab_obj_ext_has_codetag())
+		return;
+
 	/*
 	 * If vector previously failed to allocate then we have live
 	 * objects with no tag reference. Mark all references in this
-- 
2.55.0