Re: [RFC PATCH v1.1 07/11] mm/damon/sysfs-schemes: kobject_del() scheme action destination dirs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing kobject_del() in damon_sysfs_schemes_add_dirs() error path causes sysfs name collision
--

commit 34de5330acff239aa85773dbe06b9dce6ee27d61
Author: SeongJae Park <sj@kernel.org>

mm/damon/sysfs-schemes: kobject_del() scheme action destination dirs

On CONFIG_DEBUG_KOBJECT_RELEASE enabled kernel, lack of kobject_del()
could cause directories creation failures due to the name conflicts. Fix
those issues for scheme action destination directories by adding
kobject_del() calls.

Cc: <stable@vger.kernel.org> # 6.17.x

> diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c
> index 737638be84f15..108f6de32f8c1 100644
> --- a/mm/damon/sysfs-schemes.c
> +++ b/mm/damon/sysfs-schemes.c
> @@ -2148,8 +2148,10 @@ static void damos_sysfs_dests_rm_dirs(
>  	struct damos_sysfs_dest **dests_arr = dests->dests_arr;
>  	int i;
>  
> -	for (i = 0; i < dests->nr; i++)
> +	for (i = 0; i < dests->nr; i++) {
> +		kobject_del(&dests_arr[i]->kobj);
>  		kobject_put(&dests_arr[i]->kobj);
> +	}
>  	dests->nr = 0;
>  	kfree(dests_arr);
>  	dests->dests_arr = NULL;

[Severity: High]
This isn't a bug introduced by this patch, but does the out: error path in
damon_sysfs_schemes_add_dirs() have a similar issue?

If kobject_init_and_add() succeeds for a new scheme but the subsequent
damon_sysfs_scheme_add_dirs() call fails, it jumps to the out: label:

mm/damon/sysfs-schemes.c:damon_sysfs_schemes_add_dirs() {
...
		err = kobject_init_and_add(&scheme->kobj,
				&damon_sysfs_scheme_ktype, &schemes->kobj,
				"%d", i);
		if (err)
			goto out;
		err = damon_sysfs_scheme_add_dirs(scheme);
		if (err)
			goto out;
...
out:
	damon_sysfs_schemes_rm_dirs(schemes);
	kobject_put(&scheme->kobj);
	return err;
}

Since the failed scheme hasn't been added to schemes_arr yet,
damon_sysfs_schemes_rm_dirs() only cleans up the previously added schemes.
Then kobject_put() is called on the current scheme without a prior
kobject_del().

With CONFIG_DEBUG_KOBJECT_RELEASE enabled, could this omission leave the
newly created sysfs directory intact and cause a name collision (-EEXIST)
if userspace retries creating the schemes shortly after?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260617144807.91441-1-sj@kernel.org?part=7