From 96858e2308431ff5678e0e6fab1a06e19f3d95da Mon Sep 17 00:00:00 2001 From: Yogesh Gaur Date: Sun, 20 Sep 2026 14:45:33 +0530 Subject: [PATCH] md/raid5: give the io_unit slab caches per-array names Both raid5 log backends create their io_unit slab cache per array but name it after the struct: ppl_conf->io_kc = KMEM_CACHE(ppl_io_unit, 0); log->io_kc = KMEM_CACHE(r5l_io_unit, 0); KMEM_CACHE() passes the stringified type as the cache name, so every array that enables PPL or attaches a journal asks for a cache called "ppl_io_unit" or "r5l_io_unit". With two such arrays live at the same time the second one trips kmem_cache_sanity_check(): kmem_cache of name 'ppl_io_unit' already exists WARNING: mm/slab_common.c:112 at __kmem_cache_create_args+0xae/0x460 ppl_init_log+0x285/0x1310 drivers/md/raid5-ppl.c:1363 log_init drivers/md/raid5-log.h:138 [inline] raid5_change_consistency_policy+0x255/0x740 drivers/md/raid5.c:9141 consistency_policy_store+0x7f/0x230 drivers/md/md.c:5883 md_attr_store+0x3b7/0x640 drivers/md/md.c:6158 which is reachable by any user that can write "ppl" to md/consistency_policy on two arrays, and equally by assembling two journalled arrays. The cache is created and destroyed correctly on every path, so this is a name collision only - duplicate names confuse slabtop and /proc/slabinfo, which is what the check is there to catch. Build the name from the array instead, the way grow_stripes() already does for the stripe_head cache in this driver, and fall back to the mddev pointer for dm-raid where mdname() is the constant "mdX". The buffer is sized like conf->cache_name[] because mdname() can return up to DISK_NAME_LEN bytes. The explicit size/align arguments keep what KMEM_CACHE() expanded to, so object layout does not change. Fixes: 3418d036c81d ("raid5-ppl: Partial Parity Log write logging implementation") Fixes: f6bed0ef0a80 ("raid5: add basic stripe log") Reported-by: syzbot+2ef75c54d0b2ac5d00ba@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2ef75c54d0b2ac5d00ba Assisted-by: LLM Signed-off-by: Yogesh Gaur Link: https://patch.msgid.link/20260920091533.413-1-yogeshgaur.83@gmail.com Signed-off-by: Yu Kuai --- drivers/md/raid5-cache.c | 12 +++++++++++- drivers/md/raid5-ppl.c | 12 +++++++++++- 2 files changed, 22 insertions(+), 2 deletions(-) diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c index 62460e231f02..2600cb5ac393 100644 --- a/drivers/md/raid5-cache.c +++ b/drivers/md/raid5-cache.c @@ -3084,6 +3084,7 @@ int r5l_init_log(struct r5conf *conf, struct md_rdev *rdev) { struct r5l_log *log; struct md_thread *thread; + char cache_name[48]; int ret; pr_debug("md/raid:%s: using device %pg as journal\n", @@ -3123,7 +3124,16 @@ int r5l_init_log(struct r5conf *conf, struct md_rdev *rdev) INIT_LIST_HEAD(&log->flushing_ios); INIT_LIST_HEAD(&log->finished_ios); - log->io_kc = KMEM_CACHE(r5l_io_unit, 0); + if (mddev_is_dm(conf->mddev)) + snprintf(cache_name, sizeof(cache_name), "r5l_io_unit-%p", + conf->mddev); + else + snprintf(cache_name, sizeof(cache_name), "r5l_io_unit-%s", + mdname(conf->mddev)); + + log->io_kc = kmem_cache_create(cache_name, sizeof(struct r5l_io_unit), + __alignof__(struct r5l_io_unit), + 0, NULL); if (!log->io_kc) goto io_kc; diff --git a/drivers/md/raid5-ppl.c b/drivers/md/raid5-ppl.c index 7f8a9d3fd578..0530632f9d2a 100644 --- a/drivers/md/raid5-ppl.c +++ b/drivers/md/raid5-ppl.c @@ -1318,6 +1318,7 @@ int ppl_init_log(struct r5conf *conf) { struct ppl_conf *ppl_conf; struct mddev *mddev = conf->mddev; + char cache_name[48]; int ret = 0; int max_disks; int i; @@ -1360,7 +1361,16 @@ int ppl_init_log(struct r5conf *conf) ppl_conf->mddev = mddev; - ppl_conf->io_kc = KMEM_CACHE(ppl_io_unit, 0); + if (mddev_is_dm(mddev)) + snprintf(cache_name, sizeof(cache_name), "ppl_io_unit-%p", mddev); + else + snprintf(cache_name, sizeof(cache_name), "ppl_io_unit-%s", + mdname(mddev)); + + ppl_conf->io_kc = kmem_cache_create(cache_name, + sizeof(struct ppl_io_unit), + __alignof__(struct ppl_io_unit), + 0, NULL); if (!ppl_conf->io_kc) { ret = -ENOMEM; goto err;