Both raid5 log backends create their io_unit slab cache per array but
name it after the struct:

	ppl_conf->io_kc = KMEM_CACHE(ppl_io_unit, 0);
	log->io_kc      = KMEM_CACHE(r5l_io_unit, 0);

KMEM_CACHE() passes the stringified type as the cache name, so every
array that enables PPL or attaches a journal asks for a cache called
"ppl_io_unit" or "r5l_io_unit".  With two such arrays live at the same
time the second one trips kmem_cache_sanity_check():

  kmem_cache of name 'ppl_io_unit' already exists
  WARNING: mm/slab_common.c:112 at __kmem_cache_create_args+0xae/0x460
   ppl_init_log+0x285/0x1310 drivers/md/raid5-ppl.c:1363
   log_init drivers/md/raid5-log.h:138 [inline]
   raid5_change_consistency_policy+0x255/0x740 drivers/md/raid5.c:9141
   consistency_policy_store+0x7f/0x230 drivers/md/md.c:5883
   md_attr_store+0x3b7/0x640 drivers/md/md.c:6158

which is reachable by any user that can write "ppl" to
md/consistency_policy on two arrays, and equally by assembling two
journalled arrays.  The cache is created and destroyed correctly on
every path, so this is a name collision only - duplicate names confuse
slabtop and /proc/slabinfo, which is what the check is there to catch.

Build the name from the array instead, the way grow_stripes() already
does for the stripe_head cache in this driver, and fall back to the
mddev pointer for dm-raid where mdname() is the constant "mdX".  The
buffer is sized like conf->cache_name[] because mdname() can return up
to DISK_NAME_LEN bytes.

The explicit size/align arguments keep what KMEM_CACHE() expanded to,
so object layout does not change.

Fixes: 3418d036c81d ("raid5-ppl: Partial Parity Log write logging implementation")
Fixes: f6bed0ef0a80 ("raid5: add basic stripe log")
Reported-by: syzbot+2ef75c54d0b2ac5d00ba@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2ef75c54d0b2ac5d00ba
Assisted-by: LLM
Signed-off-by: Yogesh Gaur <yogeshgaur.83@gmail.com>
---
 drivers/md/raid5-cache.c | 12 +++++++++++-
 drivers/md/raid5-ppl.c   | 12 +++++++++++-
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index 7b7546bfa21f..47458a474adf 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -3066,6 +3066,7 @@ int r5l_init_log(struct r5conf *conf, struct md_rdev *rdev)
 {
 	struct r5l_log *log;
 	struct md_thread *thread;
+	char cache_name[48];
 	int ret;
 
 	pr_debug("md/raid:%s: using device %pg as journal\n",
@@ -3105,7 +3106,16 @@ int r5l_init_log(struct r5conf *conf, struct md_rdev *rdev)
 	INIT_LIST_HEAD(&log->flushing_ios);
 	INIT_LIST_HEAD(&log->finished_ios);
 
-	log->io_kc = KMEM_CACHE(r5l_io_unit, 0);
+	if (mddev_is_dm(conf->mddev))
+		snprintf(cache_name, sizeof(cache_name), "r5l_io_unit-%p",
+			 conf->mddev);
+	else
+		snprintf(cache_name, sizeof(cache_name), "r5l_io_unit-%s",
+			 mdname(conf->mddev));
+
+	log->io_kc = kmem_cache_create(cache_name, sizeof(struct r5l_io_unit),
+				       __alignof__(struct r5l_io_unit),
+				       0, NULL);
 	if (!log->io_kc)
 		goto io_kc;
 
diff --git a/drivers/md/raid5-ppl.c b/drivers/md/raid5-ppl.c
index 7f8a9d3fd578..0530632f9d2a 100644
--- a/drivers/md/raid5-ppl.c
+++ b/drivers/md/raid5-ppl.c
@@ -1318,6 +1318,7 @@ int ppl_init_log(struct r5conf *conf)
 {
 	struct ppl_conf *ppl_conf;
 	struct mddev *mddev = conf->mddev;
+	char cache_name[48];
 	int ret = 0;
 	int max_disks;
 	int i;
@@ -1360,7 +1361,16 @@ int ppl_init_log(struct r5conf *conf)
 
 	ppl_conf->mddev = mddev;
 
-	ppl_conf->io_kc = KMEM_CACHE(ppl_io_unit, 0);
+	if (mddev_is_dm(mddev))
+		snprintf(cache_name, sizeof(cache_name), "ppl_io_unit-%p", mddev);
+	else
+		snprintf(cache_name, sizeof(cache_name), "ppl_io_unit-%s",
+			 mdname(mddev));
+
+	ppl_conf->io_kc = kmem_cache_create(cache_name,
+					    sizeof(struct ppl_io_unit),
+					    __alignof__(struct ppl_io_unit),
+					    0, NULL);
 	if (!ppl_conf->io_kc) {
 		ret = -ENOMEM;
 		goto err;
-- 
2.55.0.windows.5

在 2026/9/20 17:15, Yogesh Gaur 写道:

> Both raid5 log backends create their io_unit slab cache per array but
> name it after the struct:
>
> 	ppl_conf->io_kc = KMEM_CACHE(ppl_io_unit, 0);
> 	log->io_kc      = KMEM_CACHE(r5l_io_unit, 0);
>
> KMEM_CACHE() passes the stringified type as the cache name, so every
> array that enables PPL or attaches a journal asks for a cache called
> "ppl_io_unit" or "r5l_io_unit".  With two such arrays live at the same
> time the second one trips kmem_cache_sanity_check():
>
>    kmem_cache of name 'ppl_io_unit' already exists
>    WARNING: mm/slab_common.c:112 at __kmem_cache_create_args+0xae/0x460
>     ppl_init_log+0x285/0x1310 drivers/md/raid5-ppl.c:1363
>     log_init drivers/md/raid5-log.h:138 [inline]
>     raid5_change_consistency_policy+0x255/0x740 drivers/md/raid5.c:9141
>     consistency_policy_store+0x7f/0x230 drivers/md/md.c:5883
>     md_attr_store+0x3b7/0x640 drivers/md/md.c:6158
>
> which is reachable by any user that can write "ppl" to
> md/consistency_policy on two arrays, and equally by assembling two
> journalled arrays.  The cache is created and destroyed correctly on
> every path, so this is a name collision only - duplicate names confuse
> slabtop and /proc/slabinfo, which is what the check is there to catch.
>
> Build the name from the array instead, the way grow_stripes() already
> does for the stripe_head cache in this driver, and fall back to the
> mddev pointer for dm-raid where mdname() is the constant "mdX".  The
> buffer is sized like conf->cache_name[] because mdname() can return up
> to DISK_NAME_LEN bytes.
>
> The explicit size/align arguments keep what KMEM_CACHE() expanded to,
> so object layout does not change.
>
> Fixes: 3418d036c81d ("raid5-ppl: Partial Parity Log write logging implementation")
> Fixes: f6bed0ef0a80 ("raid5: add basic stripe log")
> Reported-by:syzbot+2ef75c54d0b2ac5d00ba@syzkaller.appspotmail.com
> Closes:https://syzkaller.appspot.com/bug?extid=2ef75c54d0b2ac5d00ba
> Assisted-by: LLM
> Signed-off-by: Yogesh Gaur<yogeshgaur.83@gmail.com>
> ---
>   drivers/md/raid5-cache.c | 12 +++++++++++-
>   drivers/md/raid5-ppl.c   | 12 +++++++++++-
>   2 files changed, 22 insertions(+), 2 deletions(-)
Applied to md-7.4

-- 
Thanks,
Kuai