Re: [RFC PATCH 6/9] mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs

[SeongJae Park <sj@kernel.org>]

On Tue, 16 Jun 2026 15:27:28 +0000 sashiko-bot@kernel.org wrote:

> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [High] Missing Kobject Deletion on Error Path
> --
> 
> commit b01a934762aa810a11a4a01efdd70c41f7274410
> Author: SeongJae Park <sj@kernel.org>
> 
> mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs
> 
> This commit adds missing kobject_del() calls to the cleanup of scheme quota
> goal directories. This prevents directory creation failures due to name
> conflicts when CONFIG_DEBUG_KOBJECT_RELEASE is enabled.
> 
> > diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c
> > index 300930c2c5b3f..737638be84f15 100644
> > --- a/mm/damon/sysfs-schemes.c
> > +++ b/mm/damon/sysfs-schemes.c
> > @@ -1465,8 +1465,10 @@ static void damos_sysfs_quota_goals_rm_dirs(
> >  	struct damos_sysfs_quota_goal **goals_arr = goals->goals_arr;
> >  	int i;
> >  
> > -	for (i = 0; i < goals->nr; i++)
> > +	for (i = 0; i < goals->nr; i++) {
> > +		kobject_del(&goals_arr[i]->kobj);
> >  		kobject_put(&goals_arr[i]->kobj);
> > +	}
> 
> [Severity: High]
> This isn't a bug introduced by this patch, but since you are fixing missing
> kobject_del() calls here to prevent name collisions, do the error paths in the
> various *_add_dirs() functions need similar fixes?
> 
> If an error occurs after a successful kobject_init_and_add(), the error paths
> currently call kobject_put() without kobject_del(). This can leave the sysfs
> directory present until the object's reference count drops to zero and the
> delayed release runs, potentially causing a -EEXIST failure if a user retries
> the operation.
> 
> For example, looking at damon_sysfs_targets_add_dirs() in mm/damon/sysfs.c:
> 
>     err = damon_sysfs_target_add_dirs(target);
>     if (err)
>         goto out;
>     ...
> out:
>     damon_sysfs_targets_rm_dirs(targets);
>     kobject_put(&target->kobj);
>     return err;
> 
> Could this leak the sysfs directory for target->kobj? 
> 
> The identical pattern appears in several other error paths:
> - damon_sysfs_contexts_add_dirs() in mm/damon/sysfs.c
> - damon_sysfs_kdamonds_add_dirs() in mm/damon/sysfs.c
> - damon_sysfs_schemes_add_dirs() in mm/damon/sysfs-schemes.c
> - damos_sysfs_populate_region_dir() in mm/damon/sysfs-schemes.c

Good finding but Sashiko reported this in another reply to this thread, and I
promised to fix those in the next revision.


Thanks,
SJ

[...]