From: Shengming Hu <hu.shengming@zte.com.cn>

kmem_cache_return_sheaf() may refill a partially consumed sheaf before
placing it in the barn. Without an explicit restriction, this refill may
draw objects from pfmemalloc slabs and consume emergency reserves.

Add __GFP_NOMEMALLOC so returned sheaves are refilled only from normal
memory. If that fails, flush and free the sheaf instead.

Signed-off-by: Shengming Hu <hu.shengming@zte.com.cn>
---
 mm/slub.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/slub.c b/mm/slub.c
index 53b4976d3831..34f17ecbde87 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -5123,7 +5123,7 @@ void kmem_cache_return_sheaf(struct kmem_cache *s, gfp_t gfp,
 	 * simply flush and free it.
 	 */
 	if (!barn || data_race(barn->nr_full) >= MAX_FULL_SHEAVES ||
-	    refill_sheaf(s, sheaf, gfp)) {
+	    refill_sheaf(s, sheaf, gfp | __GFP_NOMEMALLOC)) {
 		sheaf_flush_unused(s, sheaf);
 		free_empty_sheaf(s, sheaf);
 		return;
-- 
2.25.1

On Sun, Jul 19, 2026 at 11:37:01AM +0800, hu.shengming@zte.com.cn wrote:
> From: Shengming Hu <hu.shengming@zte.com.cn>
> 
> kmem_cache_return_sheaf() may refill a partially consumed sheaf before
> placing it in the barn. Without an explicit restriction, this refill may
> draw objects from pfmemalloc slabs and consume emergency reserves.
> 
> Add __GFP_NOMEMALLOC so returned sheaves are refilled only from normal
> memory. If that fails, flush and free the sheaf instead.
> 
> Signed-off-by: Shengming Hu <hu.shengming@zte.com.cn>
> ---
>  mm/slub.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/mm/slub.c b/mm/slub.c
> index 53b4976d3831..34f17ecbde87 100644
> --- a/mm/slub.c
> +++ b/mm/slub.c
> @@ -5123,7 +5123,7 @@ void kmem_cache_return_sheaf(struct kmem_cache *s, gfp_t gfp,
>  	 * simply flush and free it.
>  	 */
>  	if (!barn || data_race(barn->nr_full) >= MAX_FULL_SHEAVES ||
> -	    refill_sheaf(s, sheaf, gfp)) {
> +	    refill_sheaf(s, sheaf, gfp | __GFP_NOMEMALLOC)) {

maybe we can add __GFP_NOWARN as this is just an refilling attempt?
refilling failure could be acceptable.

>  		sheaf_flush_unused(s, sheaf);
>  		free_empty_sheaf(s, sheaf);
>  		return;
> -- 
> 2.25.1

Hao wrote:
> On Sun, Jul 19, 2026 at 11:37:01AM +0800, hu.shengming@zte.com.cn wrote:
> > From: Shengming Hu <hu.shengming@zte.com.cn>
> > 
> > kmem_cache_return_sheaf() may refill a partially consumed sheaf before
> > placing it in the barn. Without an explicit restriction, this refill may
> > draw objects from pfmemalloc slabs and consume emergency reserves.
> > 
> > Add __GFP_NOMEMALLOC so returned sheaves are refilled only from normal
> > memory. If that fails, flush and free the sheaf instead.
> > 
> > Signed-off-by: Shengming Hu <hu.shengming@zte.com.cn>
> > ---
> >  mm/slub.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/mm/slub.c b/mm/slub.c
> > index 53b4976d3831..34f17ecbde87 100644
> > --- a/mm/slub.c
> > +++ b/mm/slub.c
> > @@ -5123,7 +5123,7 @@ void kmem_cache_return_sheaf(struct kmem_cache *s, gfp_t gfp,
> >       * simply flush and free it.
> >       */
> >      if (!barn || data_race(barn->nr_full) >= MAX_FULL_SHEAVES ||
> > -        refill_sheaf(s, sheaf, gfp)) {
> > +        refill_sheaf(s, sheaf, gfp | __GFP_NOMEMALLOC)) {
> 
> maybe we can add __GFP_NOWARN as this is just an refilling attempt?
> refilling failure could be acceptable.
> 

Thanks for the review!

Good suggestion. Since refilling the sheaf is only a best-effort attempt
and failure is acceptable here, adding __GFP_NOWARN makes sense.

After taking another look, maybe we should also clear __GFP_NOFAIL if
it is present in the caller-provided GFP flags? Otherwise, the allocation
could retry indefinitely, which may not be appropriate for this optional
refill path.

--
With Best Regards,
Shengming

> >          sheaf_flush_unused(s, sheaf);
> >          free_empty_sheaf(s, sheaf);
> >          return;
> > -- 
> > 2.25.1

On 7/20/26 5:41 PM, hu.shengming@zte.com.cn wrote:
> Hao wrote:
>> On Sun, Jul 19, 2026 at 11:37:01AM +0800, hu.shengming@zte.com.cn wrote:
>>> From: Shengming Hu <hu.shengming@zte.com.cn>
>>>
>>> kmem_cache_return_sheaf() may refill a partially consumed sheaf before
>>> placing it in the barn. Without an explicit restriction, this refill may
>>> draw objects from pfmemalloc slabs and consume emergency reserves.
>>>
>>> Add __GFP_NOMEMALLOC so returned sheaves are refilled only from normal
>>> memory. If that fails, flush and free the sheaf instead.
>>>
>>> Signed-off-by: Shengming Hu <hu.shengming@zte.com.cn>
>>> ---
>>>  mm/slub.c | 2 +-
>>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/mm/slub.c b/mm/slub.c
>>> index 53b4976d3831..34f17ecbde87 100644
>>> --- a/mm/slub.c
>>> +++ b/mm/slub.c
>>> @@ -5123,7 +5123,7 @@ void kmem_cache_return_sheaf(struct kmem_cache *s, gfp_t gfp,
>>>       * simply flush and free it.
>>>       */
>>>      if (!barn || data_race(barn->nr_full) >= MAX_FULL_SHEAVES ||
>>> -        refill_sheaf(s, sheaf, gfp)) {
>>> +        refill_sheaf(s, sheaf, gfp | __GFP_NOMEMALLOC)) {
>>
>> maybe we can add __GFP_NOWARN as this is just an refilling attempt?
>> refilling failure could be acceptable.

Adding __GFP_NOMEMALLOC | __GFP_NOWARN makes sense to me.
Analogous to __pcs_replace_empty_main().

We don't really put pfmemalloc sheaves back to the barn but as you
pointed out kmem_cache_return_sheaf() could fill the non-pfmemalloc
sheaf with objects from pfmemalloc slabs.

> Thanks for the review!
> 
> Good suggestion. Since refilling the sheaf is only a best-effort attempt
> and failure is acceptable here, adding __GFP_NOWARN makes sense.
>
> After taking another look, maybe we should also clear __GFP_NOFAIL if
> it is present in the caller-provided GFP flags? Otherwise, the allocation
> could retry indefinitely, which may not be appropriate for this optional
> refill path.

Hmm, you might argue that it's not worth trying to refill the whole
sheaf w/ __GFP_NOFAIL in refill_sheaf() if e.g.) that end up reclaiming
more than one page under high memory pressure. (Just like how we clear
__GFP_NOFAIL when allocating high-order sheaves).

But that should not be part of this patch at least.

-- 
Cheers,
Harry / Hyeonggon

Harry wrote:
> On 7/20/26 5:41 PM, hu.shengming@zte.com.cn wrote:
> > Hao wrote:
> >> On Sun, Jul 19, 2026 at 11:37:01AM +0800, hu.shengming@zte.com.cn wrote:
> >>> From: Shengming Hu <hu.shengming@zte.com.cn>
> >>>
> >>> kmem_cache_return_sheaf() may refill a partially consumed sheaf before
> >>> placing it in the barn. Without an explicit restriction, this refill may
> >>> draw objects from pfmemalloc slabs and consume emergency reserves.
> >>>
> >>> Add __GFP_NOMEMALLOC so returned sheaves are refilled only from normal
> >>> memory. If that fails, flush and free the sheaf instead.
> >>>
> >>> Signed-off-by: Shengming Hu <hu.shengming@zte.com.cn>
> >>> ---
> >>>  mm/slub.c | 2 +-
> >>>  1 file changed, 1 insertion(+), 1 deletion(-)
> >>>
> >>> diff --git a/mm/slub.c b/mm/slub.c
> >>> index 53b4976d3831..34f17ecbde87 100644
> >>> --- a/mm/slub.c
> >>> +++ b/mm/slub.c
> >>> @@ -5123,7 +5123,7 @@ void kmem_cache_return_sheaf(struct kmem_cache *s, gfp_t gfp,
> >>>       * simply flush and free it.
> >>>       */
> >>>      if (!barn || data_race(barn->nr_full) >= MAX_FULL_SHEAVES ||
> >>> -        refill_sheaf(s, sheaf, gfp)) {
> >>> +        refill_sheaf(s, sheaf, gfp | __GFP_NOMEMALLOC)) {
> >>
> >> maybe we can add __GFP_NOWARN as this is just an refilling attempt?
> >> refilling failure could be acceptable.
> 
> Adding __GFP_NOMEMALLOC | __GFP_NOWARN makes sense to me.
> Analogous to __pcs_replace_empty_main().
> 
> We don't really put pfmemalloc sheaves back to the barn but as you
> pointed out kmem_cache_return_sheaf() could fill the non-pfmemalloc
> sheaf with objects from pfmemalloc slabs.
> 

Thanks for confirming this.

> > Thanks for the review!
> > 
> > Good suggestion. Since refilling the sheaf is only a best-effort attempt
> > and failure is acceptable here, adding __GFP_NOWARN makes sense.
> >
> > After taking another look, maybe we should also clear __GFP_NOFAIL if
> > it is present in the caller-provided GFP flags? Otherwise, the allocation
> > could retry indefinitely, which may not be appropriate for this optional
> > refill path.
> 
> Hmm, you might argue that it's not worth trying to refill the whole
> sheaf w/ __GFP_NOFAIL in refill_sheaf() if e.g.) that end up reclaiming
> more than one page under high memory pressure. (Just like how we clear
> __GFP_NOFAIL when allocating high-order sheaves).
> 
> But that should not be part of this patch at least.

Agreed. I will keep this patch focused on preventing the refill from
using pfmemalloc reserves and update it to use:

gfp | __GFP_NOMEMALLOC | __GFP_NOWARN

The handling of __GFP_NOFAIL in refill_sheaf() is a broader issue and
can be considered separately.

Thanks for the clarification!

--
With Best Regards,
Shengming