Re: [RFC PATCH 9/9] mm/damon/sysfs: kobject_del() probe dirs

[SeongJae Park <sj@kernel.org>]

On Tue, 16 Jun 2026 15:24:11 +0000 sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [Medium] The patch adds `kobject_del()` to `damon_sysfs_probes_rm_dirs()` to fix sysfs name collisions caused by delayed kobject releases, but misses the exact same flaw on the error paths of `damon_sysfs_probes_add_dirs()` and multiple other array-building functions. This leaves the system vulnerable to `-EEXIST` failures upon retry after an error.
> --
> 
> commit 4a5efc2733f009261a15fd64a4d901ca19499bb5
> Author: SeongJae Park <sj@kernel.org>
> 
> mm/damon/sysfs: kobject_del() probe dirs
> 
> This commit fixes a directory creation failure caused by name conflicts
> when CONFIG_DEBUG_KOBJECT_RELEASE is enabled. It adds missing kobject_del()
> calls during the removal of probe directories.
> 
> > diff --git a/mm/damon/sysfs.c b/mm/damon/sysfs.c
> > index 04725ff3d9f3c..04ca0a34e1206 100644
> > --- a/mm/damon/sysfs.c
> > +++ b/mm/damon/sysfs.c
> > @@ -1139,6 +1139,7 @@ static void damon_sysfs_probes_rm_dirs(
> >  
> >  	for (i = 0; i < probes->nr; i++) {
> >  		damon_sysfs_probe_rm_dirs(probes_arr[i]);
> > +		kobject_del(&probes_arr[i]->kobj);
> 
> [Severity: Medium]
> This is a pre-existing issue, but it looks like the same lack of
> kobject_del() on error paths could cause name collisions upon retry.
> 
> For example, if damon_sysfs_probe_add_dirs() fails inside
> damon_sysfs_probes_add_dirs(), the error path drops the probe by calling
> kobject_put() without kobject_del():
> 
> mm/damon/sysfs.c:damon_sysfs_probes_add_dirs() {
>     ...
> 		err = damon_sysfs_probe_add_dirs(probe);
> 		if (err) {
> 			kobject_put(&probe->kobj);
> 			damon_sysfs_probes_rm_dirs(probes);
> 			return err;
> 		}
>     ...
> }
> 
> Under CONFIG_DEBUG_KOBJECT_RELEASE, if userspace immediately retries the
> operation after an error, won't kobject_init_and_add() fail with -EEXIST due
> to a name collision with the lingering directory?
> 
> Should we also add synchronous sysfs deletion via kobject_del() to these
> similar error paths?
> - mm/damon/sysfs.c:damon_sysfs_targets_add_dirs()
> - mm/damon/sysfs.c:damon_sysfs_contexts_add_dirs()
> - mm/damon/sysfs.c:damon_sysfs_kdamonds_add_dirs()
> - mm/damon/sysfs-schemes.c:damon_sysfs_schemes_add_dirs()

Yes.  Sashiko reported same issues in other replies to this thread and I will
fix these in the next revision.


Thanks,
SJ

[...]