Re: [PATCH v3 5/9] dlm: Free dlm_ls in kobject release callback - sashiko-bot

From: sashiko-bot@kernel.org
To: "Ian Rogers" <irogers@google.com>,
	"Danilo Krummrich" <dakr@kernel.org>,
	"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
	"Kees Cook" <kees@kernel.org>, "Miguel Ojeda" <ojeda@kernel.org>,
	"Rafael J . Wysocki" <rafael@kernel.org>
Cc: "Madhavan Srinivasan" <maddy@linux.ibm.com>,
	"Michael Ellerman" <mpe@ellerman.id.au>,
	"Nicholas Piggin" <npiggin@gmail.com>,
	"Christophe Leroy" <chleroy@kernel.org>,
	"Nayna Jain" <nayna@linux.ibm.com>,
	"Srish Srinivasan" <ssrish@linux.ibm.com>,
	"Mimi Zohar" <zohar@linux.ibm.com>,
	"Yoshinori Sato" <ysato@users.sourceforge.jp>,
	"Rich Felker" <dalias@libc.org>,
	"John Paul Adrian Glaubitz" <glaubitz@physik.fu-berlin.de>,
	"Juergen Gross" <jgross@suse.com>,
	"Stefano Stabellini" <sstabellini@kernel.org>,
	"Oleksandr Tyshchenko" <oleksandr_tyshchenko@epam.com>,
	"Nathan Chancellor" <nathan@kernel.org>,
	"Nick Desaulniers" <ndesaulniers@google.com>,
	"Viresh Kumar" <viresh.kumar@linaro.org>,
	"Zhongqiu Han" <zhongqiu.han@oss.qualcomm.com>,
	"Alexander Aring" <aahringo@redhat.com>,
	"Felix Kuehling" <felix.kuehling@amd.com>,
	"Christian König" <christian.koenig@amd.com>,
	"Zhihao Cheng" <chengzhihao1@huawei.com>,
	"Sumanth Korikkar" <sumanthk@linux.ibm.com>,
	"Bill Wendling" <morbo@google.com>,
	"Justin Stitt" <justinstitt@google.com>,
	linux-s390@vger.kernel.org, linux-mtd@lists.infradead.org,
	dri-devel@lists.freedesktop.org,
	"Heiko Carstens" <hca@linux.ibm.com>,
	"Vasily Gorbik" <gor@linux.ibm.com>,
	"Alexander Gordeev" <agordeev@linux.ibm.com>,
	"Christian Borntraeger" <borntraeger@linux.ibm.com>
Subject: Re: [PATCH v3 5/9] dlm: Free dlm_ls in kobject release callback
Date: Sun, 08 Nov 2026 23:06:49 +0000	[thread overview]
Message-ID: <sashiko-outbox-204150@kernel.org> (raw)
In-Reply-To: <20261108223913.3624571-6-irogers@google.com>

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] dlm: wrong Fixes commit and misleading subject for
  dlm_ls_release()
--

commit cebf1bf6f5d4b67423eada980e5a294abe491cc6
Author: Ian Rogers <irogers@google.com>

> dlm: Free dlm_ls in kobject release callback
>
> struct dlm_ls embeds a struct kobject (ls_kobj), but dlm_ktype lacked a
> .release callback and dlm freed the lockspace structure directly via
> kfree(ls). With CONFIG_DEBUG_KOBJECT_RELEASE=y, freeing ls before the
> delayed kobject release runs causes a use-after-free, and unloading the
> module while the delayed release is pending results in an instruction
> page fault.
>
> Add a completion ls_kobj_done and dlm_ls_release() to complete it when
> the last kobject reference is dropped, waiting for it in free_lockspace()
> before kfree(ls) and in the new_lockspace() error path before module_put().
> Also delete the kobject via kobject_del() before stopping dlm_recoverd
> to close the window where concurrent sysfs writes could wake the stopped
> recovery task.
>
> Fixes: 3514faca19a6 ("kobject: remove struct kobj_type from struct kset")
> Acked-by: Alexander Aring <aahringo@redhat.com>
> Signed-off-by: Ian Rogers <irogers@google.com>

[Severity: Low]
3514faca19a6 ("kobject: remove struct kobj_type from struct kset") only
removed the .ktype pointer from dlm_kset while leaving dlm_ktype.release
set to lockspace_kobj_release().  The commit that dropped the release
callback from dlm_ktype and started calling kfree(ls) directly after
kobject_put(&ls->ls_kobj) is 8a4cf500f1dd ("dlm: drop kobject release
callback handling").  Should the Fixes: tag point to that commit instead:

  Fixes: 8a4cf500f1dd ("dlm: drop kobject release callback handling")

Also, the subject line says dlm_ls is freed in the kobject release
callback, whereas dlm_ls_release() only signals ls_kobj_done and kfree(ls)
Still happens in free_lockspace() and new_lockspace().

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261108223913.3624571-1-irogers@google.com?part=5