Root Cause Analysis

1. Relevant Files, Functions, and Data Structures

• File: mm/shmem.c
• Functions:
  • shmem_initxattrs(struct inode *inode, const struct xattr *xattr_array, void *fs_info) (lines 4400–4454)
  • shmem_reconfigure(struct fs_context *fc) (lines 4959–5045)
• Structures and Fields:
  • struct shmem_sb_info (sbinfo):
    • unsigned long max_inodes: Maximum number of inodes allowed, or 0 for unlimited.
    • unsigned long free_ispace: Inode space available in bytes.
    • raw_spinlock_t stat_lock: Lock protecting filesystem accounting fields.
  • Local variable size_t ispace: Tracks the temporary xattr space reservation during inode xattr initialization.

2. Technical Mechanism and Trigger Conditions

When a new inode is created on a tmpfs filesystem (e.g., via vfs_mkdir() -> shmem_mkdir() -> shmem_mknod() -> security_inode_init_security()), shmem_initxattrs() is invoked to allocate and attach the LSM security xattrs.

1. Initial Space Reservation (mm/shmem.c:4408):

   if (sbinfo->max_inodes) {
       for (xattr = xattr_array; xattr->name != NULL; xattr++) {
           ispace += simple_xattr_space(xattr->name,
               xattr->value_len + XATTR_SECURITY_PREFIX_LEN);
       }
       if (ispace) {
           raw_spin_lock(&sbinfo->stat_lock);
           if (sbinfo->free_ispace < ispace)
               ispace = 0;
           else
               sbinfo->free_ispace -= ispace;
           raw_spin_unlock(&sbinfo->stat_lock);
           if (!ispace)
               return -ENOSPC;
       }
   }
   

   If the filesystem is mounted with an inode limit (sbinfo->max_inodes > 0), the required memory for each xattr is calculated via simple_xattr_space(...) and deducted from sbinfo->free_ispace. For a typical SELinux context (security.selinux), this requires 83 bytes (0x53), setting local ispace = 0x53.

2. Concurrent Reconfiguration: The subsequent loop performs memory allocations (CLASS(simple_xattr, new_xattr) and kasprintf(GFP_KERNEL_ACCOUNT, ...)), which may sleep or be preempted. During this time, shmem_initxattrs() does not hold any lock. A concurrent remount operation (shmem_reconfigure()) specifying nr_inodes=0 can run on another CPU:

   if (ctx->seen & SHMEM_SEEN_INODES) {
       sbinfo->max_inodes  = ctx->inodes; // set to 0 (unlimited inodes)
       sbinfo->free_ispace = ctx->inodes * BOGO_INODE_SIZE - used_isp;
   }
   

   This clears sbinfo->max_inodes to 0.

3. Inconsistent Gating on sbinfo->max_inodes (mm/shmem.c:4438): When shmem_initxattrs() processes the allocated xattrs and adds them via simple_xattr_add():

   for (xattr = xattr_array; xattr->name != NULL; xattr++) {
       ...
       if (simple_xattr_add(&sbinfo->xa_cache, &info->xattrs, new_xattr))
           break;
   
       if (sbinfo->max_inodes)
           ispace -= simple_xattr_space(new_xattr->name, new_xattr->size);
       retain_and_null_ptr(new_xattr);
   }
   

   Because sbinfo->max_inodes is re-read locklessly and has changed to 0, the condition if (sbinfo->max_inodes) evaluates to false. As a result, ispace -= simple_xattr_space(...) is skipped, leaving ispace un-decremented (at 0x53).

4. Assertion Failure (mm/shmem.c:4451): All xattrs in xattr_array are successfully committed, so the error check if (xattr->name != NULL) is false. Execution reaches:

   WARN_ON(ispace);
   

   Because ispace was never decremented due to the racy check on sbinfo->max_inodes, WARN_ON(ispace) fires with ispace == 0x53.