f2fs: use global inline_xattr_slab instead of per-sb slab cache

As Hong Yun reported in mailing list:

loop7: detected capacity change from 0 to 131072
------------[ cut here ]------------
kmem_cache of name 'f2fs_xattr_entry-7:7' already exists
WARNING: CPU: 0 PID: 24426 at mm/slab_common.c:110 kmem_cache_sanity_check mm/slab_common.c:109 [inline]
WARNING: CPU: 0 PID: 24426 at mm/slab_common.c:110 __kmem_cache_create_args+0xa6/0x320 mm/slab_common.c:307
CPU: 0 UID: 0 PID: 24426 Comm: syz.7.1370 Not tainted 6.17.0-rc4 #1 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:kmem_cache_sanity_check mm/slab_common.c:109 [inline]
RIP: 0010:__kmem_cache_create_args+0xa6/0x320 mm/slab_common.c:307
Call Trace:
__kmem_cache_create include/linux/slab.h:353 [inline]
f2fs_kmem_cache_create fs/f2fs/f2fs.h:2943 [inline]
f2fs_init_xattr_caches+0xa5/0xe0 fs/f2fs/xattr.c:843
f2fs_fill_super+0x1645/0x2620 fs/f2fs/super.c:4918
get_tree_bdev_flags+0x1fb/0x260 fs/super.c:1692
vfs_get_tree+0x43/0x140 fs/super.c:1815
do_new_mount+0x201/0x550 fs/namespace.c:3808
do_mount fs/namespace.c:4136 [inline]
__do_sys_mount fs/namespace.c:4347 [inline]
__se_sys_mount+0x298/0x2f0 fs/namespace.c:4324
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x8e/0x3a0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x76/0x7e

The bug can be reproduced w/ below scripts:
- mount /dev/vdb /mnt1
- mount /dev/vdc /mnt2
- umount /mnt1
- mounnt /dev/vdb /mnt1

The reason is if we created two slab caches, named f2fs_xattr_entry-7:3
and f2fs_xattr_entry-7:7, and they have the same slab size. Actually,
slab system will only create one slab cache core structure which has
slab name of "f2fs_xattr_entry-7:3", and two slab caches share the same
structure and cache address.

So, if we destroy f2fs_xattr_entry-7:3 cache w/ cache address, it will
decrease reference count of slab cache, rather than release slab cache
entirely, since there is one more user has referenced the cache.

Then, if we try to create slab cache w/ name "f2fs_xattr_entry-7:3" again,
slab system will find that there is existed cache which has the same name
and trigger the warning.

Let's changes to use global inline_xattr_slab instead of per-sb slab cache
for fixing.

Fixes: a999150f4fe3 ("f2fs: use kmem_cache pool during inline xattr lookups")
Cc: stable@kernel.org
Reported-by: Hong Yun <yhong@link.cuhk.edu.hk>
Tested-by: Hong Yun <yhong@link.cuhk.edu.hk>
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

authored by

Chao Yu and committed by

Jaegeuk Kim 7 months ago 1f27ef42 10b591e7

+24 -36

4 changed files

expand all

f2fs

f2fs.h

super.c

xattr.c

xattr.h

-3

fs/f2fs/f2fs.h

··· 1885 1885 spinlock_t error_lock; /* protect errors/stop_reason array */ 1886 1886 bool error_dirty; /* errors of sb is dirty */ 1887 1887 1888 - struct kmem_cache *inline_xattr_slab; /* inline xattr entry */ 1889 - unsigned int inline_xattr_slab_size; /* default inline xattr slab size */ 1890 - 1891 1888 /* For reclaimed segs statistics per each GC mode */ 1892 1889 unsigned int gc_segment_mode; /* GC state for reclaimed segments */ 1893 1890 unsigned int gc_reclaimed_segs[MAX_GC_MODE]; /* Reclaimed segs for each mode */

+8 -9

fs/f2fs/super.c

··· 2027 2027 kfree(sbi->raw_super); 2028 2028 2029 2029 f2fs_destroy_page_array_cache(sbi); 2030 - f2fs_destroy_xattr_caches(sbi); 2031 2030 #ifdef CONFIG_QUOTA 2032 2031 for (i = 0; i < MAXQUOTAS; i++) 2033 2032 kfree(F2FS_OPTION(sbi).s_qf_names[i]); ··· 4974 4975 if (err) 4975 4976 goto free_iostat; 4976 4977 4977 - /* init per sbi slab cache */ 4978 - err = f2fs_init_xattr_caches(sbi); 4979 - if (err) 4980 - goto free_percpu; 4981 4978 err = f2fs_init_page_array_cache(sbi); 4982 4979 if (err) 4983 - goto free_xattr_cache; 4980 + goto free_percpu; 4984 4981 4985 4982 /* get an inode for meta space */ 4986 4983 sbi->meta_inode = f2fs_iget(sb, F2FS_META_INO(sbi)); ··· 5305 5310 sbi->meta_inode = NULL; 5306 5311 free_page_array_cache: 5307 5312 f2fs_destroy_page_array_cache(sbi); 5308 - free_xattr_cache: 5309 - f2fs_destroy_xattr_caches(sbi); 5310 5313 free_percpu: 5311 5314 destroy_percpu_info(sbi); 5312 5315 free_iostat: ··· 5507 5514 err = f2fs_create_casefold_cache(); 5508 5515 if (err) 5509 5516 goto free_compress_cache; 5510 - err = register_filesystem(&f2fs_fs_type); 5517 + err = f2fs_init_xattr_cache(); 5511 5518 if (err) 5512 5519 goto free_casefold_cache; 5520 + err = register_filesystem(&f2fs_fs_type); 5521 + if (err) 5522 + goto free_xattr_cache; 5513 5523 return 0; 5524 + free_xattr_cache: 5525 + f2fs_destroy_xattr_cache(); 5514 5526 free_casefold_cache: 5515 5527 f2fs_destroy_casefold_cache(); 5516 5528 free_compress_cache: ··· 5556 5558 static void __exit exit_f2fs_fs(void) 5557 5559 { 5558 5560 unregister_filesystem(&f2fs_fs_type); 5561 + f2fs_destroy_xattr_cache(); 5559 5562 f2fs_destroy_casefold_cache(); 5560 5563 f2fs_destroy_compress_cache(); 5561 5564 f2fs_destroy_compress_mempool();

+10 -20

fs/f2fs/xattr.c

··· 23 23 #include "xattr.h" 24 24 #include "segment.h" 25 25 26 + static struct kmem_cache *inline_xattr_slab; 26 27 static void *xattr_alloc(struct f2fs_sb_info *sbi, int size, bool *is_inline) 27 28 { 28 - if (likely(size == sbi->inline_xattr_slab_size)) { 29 + if (likely(size == DEFAULT_XATTR_SLAB_SIZE)) { 29 30 *is_inline = true; 30 - return f2fs_kmem_cache_alloc(sbi->inline_xattr_slab, 31 + return f2fs_kmem_cache_alloc(inline_xattr_slab, 31 32 GFP_F2FS_ZERO, false, sbi); 32 33 } 33 34 *is_inline = false; ··· 39 38 bool is_inline) 40 39 { 41 40 if (is_inline) 42 - kmem_cache_free(sbi->inline_xattr_slab, xattr_addr); 41 + kmem_cache_free(inline_xattr_slab, xattr_addr); 43 42 else 44 43 kfree(xattr_addr); 45 44 } ··· 831 830 return err; 832 831 } 833 832 834 - int f2fs_init_xattr_caches(struct f2fs_sb_info *sbi) 833 + int __init f2fs_init_xattr_cache(void) 835 834 { 836 - dev_t dev = sbi->sb->s_bdev->bd_dev; 837 - char slab_name[32]; 838 - 839 - sprintf(slab_name, "f2fs_xattr_entry-%u:%u", MAJOR(dev), MINOR(dev)); 840 - 841 - sbi->inline_xattr_slab_size = F2FS_OPTION(sbi).inline_xattr_size * 842 - sizeof(__le32) + XATTR_PADDING_SIZE; 843 - 844 - sbi->inline_xattr_slab = f2fs_kmem_cache_create(slab_name, 845 - sbi->inline_xattr_slab_size); 846 - if (!sbi->inline_xattr_slab) 847 - return -ENOMEM; 848 - 849 - return 0; 835 + inline_xattr_slab = f2fs_kmem_cache_create("f2fs_xattr_entry", 836 + DEFAULT_XATTR_SLAB_SIZE); 837 + return inline_xattr_slab ? 0 : -ENOMEM; 850 838 } 851 839 852 - void f2fs_destroy_xattr_caches(struct f2fs_sb_info *sbi) 840 + void f2fs_destroy_xattr_cache(void) 853 841 { 854 - kmem_cache_destroy(sbi->inline_xattr_slab); 842 + kmem_cache_destroy(inline_xattr_slab); 855 843 }

+6 -4

fs/f2fs/xattr.h

··· 89 89 F2FS_TOTAL_EXTRA_ATTR_SIZE / sizeof(__le32) - \ 90 90 DEF_INLINE_RESERVED_SIZE - \ 91 91 MIN_INLINE_DENTRY_SIZE / sizeof(__le32)) 92 + #define DEFAULT_XATTR_SLAB_SIZE (DEFAULT_INLINE_XATTR_ADDRS * \ 93 + sizeof(__le32) + XATTR_PADDING_SIZE) 92 94 93 95 /* 94 96 * On-disk structure of f2fs_xattr ··· 134 132 int f2fs_getxattr(struct inode *, int, const char *, void *, 135 133 size_t, struct folio *); 136 134 ssize_t f2fs_listxattr(struct dentry *, char *, size_t); 137 - int f2fs_init_xattr_caches(struct f2fs_sb_info *); 138 - void f2fs_destroy_xattr_caches(struct f2fs_sb_info *); 135 + int __init f2fs_init_xattr_cache(void); 136 + void f2fs_destroy_xattr_cache(void); 139 137 #else 140 138 141 139 #define f2fs_xattr_handlers NULL ··· 152 150 { 153 151 return -EOPNOTSUPP; 154 152 } 155 - static inline int f2fs_init_xattr_caches(struct f2fs_sb_info *sbi) { return 0; } 156 - static inline void f2fs_destroy_xattr_caches(struct f2fs_sb_info *sbi) { } 153 + static inline int __init f2fs_init_xattr_cache(void) { return 0; } 154 + static inline void f2fs_destroy_xattr_cache(void) { } 157 155 #endif 158 156 159 157 #ifdef CONFIG_F2FS_FS_SECURITY

Configure Feed

Configure Feed