Re: [RFC PATCH v1.1 03/11] mm/damon/sysfs-schemes: kobject_del() scheme dirs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing `kobject_del()` on error path in `damon_sysfs_schemes_add_dirs()` leads to `-EEXIST` sysfs directory creation failures
--

commit 9080a7ab1bab654c1e6a9f081551a9609de62cbf
Author: SeongJae Park <sj@kernel.org>

mm/damon/sysfs-schemes: kobject_del() scheme dirs

On CONFIG_DEBUG_KOBJECT_RELEASE enabled kernel, lack of kobject_del()
could cause directories creation failures due to the name conflicts. Fix
those issues for scheme directories by adding kobject_del() calls.

> diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c
> index 329cfd0bbe9f3..37cf6edb54f17 100644
> --- a/mm/damon/sysfs-schemes.c
> +++ b/mm/damon/sysfs-schemes.c
> @@ -2686,6 +2686,7 @@ void damon_sysfs_schemes_rm_dirs(struct damon_sysfs_schemes *schemes)
>  
>  	for (i = 0; i < schemes->nr; i++) {
>  		damon_sysfs_scheme_rm_dirs(schemes_arr[i]);
> +		kobject_del(&schemes_arr[i]->kobj);
>  		kobject_put(&schemes_arr[i]->kobj);
>  	}
>  	schemes->nr = 0;

[Severity: High]
This isn't a bug introduced by this patch, but it appears a similar issue
might still exist in damon_sysfs_schemes_add_dirs() on the error path.

While subsequent patches in this series successfully fixed this exact pattern
for other arrays, it seems damon_sysfs_schemes_add_dirs() might have been
missed.

If kobject_init_and_add() succeeds for a new scheme, but child directory
creation via damon_sysfs_scheme_add_dirs() fails, the code branches to the
out label:

mm/damon/sysfs-schemes.c:damon_sysfs_schemes_add_dirs() {
    ...
		err = kobject_init_and_add(&scheme->kobj,
				&damon_sysfs_scheme_ktype, &schemes->kobj,
				"%d", i);
		if (err)
			goto out;
		err = damon_sysfs_scheme_add_dirs(scheme);
		if (err)
			goto out;
    ...
out:
	damon_sysfs_schemes_rm_dirs(schemes);
	kobject_put(&scheme->kobj);
	return err;
}

Can this lead to the scheme directory lingering in sysfs because kobject_del()
is missing before kobject_put()?

If CONFIG_DEBUG_KOBJECT_RELEASE is enabled, kobject_cleanup() is delayed.
Since the parent persistent schemes directory survives, could a subsequent user
write to resize the array attempt to recreate a directory with the same
numerical ID and result in an -EEXIST conflict?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260617144807.91441-1-sj@kernel.org?part=3