Re: [PATCH] md/raid5: give the io_unit slab caches per-array names

[yu kuai]

在 2026/9/20 17:15, Yogesh Gaur 写道:

> Both raid5 log backends create their io_unit slab cache per array but
> name it after the struct:
>
> 	ppl_conf->io_kc = KMEM_CACHE(ppl_io_unit, 0);
> 	log->io_kc      = KMEM_CACHE(r5l_io_unit, 0);
>
> KMEM_CACHE() passes the stringified type as the cache name, so every
> array that enables PPL or attaches a journal asks for a cache called
> "ppl_io_unit" or "r5l_io_unit".  With two such arrays live at the same
> time the second one trips kmem_cache_sanity_check():
>
>    kmem_cache of name 'ppl_io_unit' already exists
>    WARNING: mm/slab_common.c:112 at __kmem_cache_create_args+0xae/0x460
>     ppl_init_log+0x285/0x1310 drivers/md/raid5-ppl.c:1363
>     log_init drivers/md/raid5-log.h:138 [inline]
>     raid5_change_consistency_policy+0x255/0x740 drivers/md/raid5.c:9141
>     consistency_policy_store+0x7f/0x230 drivers/md/md.c:5883
>     md_attr_store+0x3b7/0x640 drivers/md/md.c:6158
>
> which is reachable by any user that can write "ppl" to
> md/consistency_policy on two arrays, and equally by assembling two
> journalled arrays.  The cache is created and destroyed correctly on
> every path, so this is a name collision only - duplicate names confuse
> slabtop and /proc/slabinfo, which is what the check is there to catch.
>
> Build the name from the array instead, the way grow_stripes() already
> does for the stripe_head cache in this driver, and fall back to the
> mddev pointer for dm-raid where mdname() is the constant "mdX".  The
> buffer is sized like conf->cache_name[] because mdname() can return up
> to DISK_NAME_LEN bytes.
>
> The explicit size/align arguments keep what KMEM_CACHE() expanded to,
> so object layout does not change.
>
> Fixes: 3418d036c81d ("raid5-ppl: Partial Parity Log write logging implementation")
> Fixes: f6bed0ef0a80 ("raid5: add basic stripe log")
> Reported-by:syzbot+2ef75c54d0b2ac5d00ba@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes:https://syzkaller.appspot.com/bug?extid=2ef75c54d0b2ac5d00ba
> Assisted-by: LLM
> Signed-off-by: Yogesh Gaur<yogeshgaur.83@xxxxxxxxx>
> ---
>   drivers/md/raid5-cache.c | 12 +++++++++++-
>   drivers/md/raid5-ppl.c   | 12 +++++++++++-
>   2 files changed, 22 insertions(+), 2 deletions(-)
Applied to md-7.4

-- 
Thanks,
Kuai