github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

md/raid5: give the io_unit slab caches per-array names

Browse Source 
Both raid5 log backends create their io_unit slab cache per array but
name it after the struct:

	ppl_conf->io_kc = KMEM_CACHE(ppl_io_unit, 0);
	log->io_kc      = KMEM_CACHE(r5l_io_unit, 0);

KMEM_CACHE() passes the stringified type as the cache name, so every
array that enables PPL or attaches a journal asks for a cache called
"ppl_io_unit" or "r5l_io_unit".  With two such arrays live at the same
time the second one trips kmem_cache_sanity_check():

  kmem_cache of name 'ppl_io_unit' already exists
  WARNING: mm/slab_common.c:112 at __kmem_cache_create_args+0xae/0x460
   ppl_init_log+0x285/0x1310 drivers/md/raid5-ppl.c:1363
   log_init drivers/md/raid5-log.h:138 [inline]
   raid5_change_consistency_policy+0x255/0x740 drivers/md/raid5.c:9141
   consistency_policy_store+0x7f/0x230 drivers/md/md.c:5883
   md_attr_store+0x3b7/0x640 drivers/md/md.c:6158

which is reachable by any user that can write "ppl" to
md/consistency_policy on two arrays, and equally by assembling two
journalled arrays.  The cache is created and destroyed correctly on
every path, so this is a name collision only - duplicate names confuse
slabtop and /proc/slabinfo, which is what the check is there to catch.

Build the name from the array instead, the way grow_stripes() already
does for the stripe_head cache in this driver, and fall back to the
mddev pointer for dm-raid where mdname() is the constant "mdX".  The
buffer is sized like conf->cache_name[] because mdname() can return up
to DISK_NAME_LEN bytes.

The explicit size/align arguments keep what KMEM_CACHE() expanded to,
so object layout does not change.

Fixes: 3418d036c8 ("raid5-ppl: Partial Parity Log write logging implementation")
Fixes: f6bed0ef0a ("raid5: add basic stripe log")
Reported-by: syzbot+2ef75c54d0b2ac5d00ba@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2ef75c54d0b2ac5d00ba
Assisted-by: LLM
Signed-off-by: Yogesh Gaur <yogeshgaur.83@gmail.com>
Link: https://patch.msgid.link/20260920091533.413-1-yogeshgaur.83@gmail.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
This commit is contained in:
Yogesh Gaur 2026-09-20 14:45:33 +05:30 committed by Yu Kuai
parent 68dab5c14a
commit 96858e2308
2 changed files with 22 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/md/raid5-cache.c
View File

@ -3084,6 +3084,7 @@ int r5l_init_log(struct r5conf *conf, struct md_rdev *rdev)
{
struct r5l_log *log;
struct md_thread *thread;
char cache_name[48];
int ret;
pr_debug("md/raid:%s: using device %pg as journal\n",
@ -3123,7 +3124,16 @@ int r5l_init_log(struct r5conf *conf, struct md_rdev *rdev)
INIT_LIST_HEAD(&log->flushing_ios);
INIT_LIST_HEAD(&log->finished_ios);
log->io_kc = KMEM_CACHE(r5l_io_unit, 0);
if (mddev_is_dm(conf->mddev))
snprintf(cache_name, sizeof(cache_name), "r5l_io_unit-%p",
conf->mddev);
else
snprintf(cache_name, sizeof(cache_name), "r5l_io_unit-%s",
mdname(conf->mddev));
log->io_kc = kmem_cache_create(cache_name, sizeof(struct r5l_io_unit),
__alignof__(struct r5l_io_unit),
0, NULL);
if (!log->io_kc)
goto io_kc;

12
drivers/md/raid5-ppl.c
View File

@ -1318,6 +1318,7 @@ int ppl_init_log(struct r5conf *conf)
{
struct ppl_conf *ppl_conf;
struct mddev *mddev = conf->mddev;
char cache_name[48];
int ret = 0;
int max_disks;
int i;
@ -1360,7 +1361,16 @@ int ppl_init_log(struct r5conf *conf)
ppl_conf->mddev = mddev;
ppl_conf->io_kc = KMEM_CACHE(ppl_io_unit, 0);
if (mddev_is_dm(mddev))
snprintf(cache_name, sizeof(cache_name), "ppl_io_unit-%p", mddev);
else
snprintf(cache_name, sizeof(cache_name), "ppl_io_unit-%s",
mdname(mddev));
ppl_conf->io_kc = kmem_cache_create(cache_name,
sizeof(struct ppl_io_unit),
__alignof__(struct ppl_io_unit),
0, NULL);
if (!ppl_conf->io_kc) {
ret = -ENOMEM;
goto err;