Re: [RFC PATCH v1.1 06/11] mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing `kobject_del()` in the error path of `damon_sysfs_schemes_add_dirs()`, leading to sysfs directory name conflicts.
--

commit 58717b37ac0466e3caf0f4f4b66fbd823b1faaab
Author: SeongJae Park <sj@kernel.org>

mm/damon/sysfs-schemes: kobject_del() scheme quota goal dirs

On CONFIG_DEBUG_KOBJECT_RELEASE enabled kernel, lack of kobject_del()
could cause directories creation failures due to the name conflicts. Fix
those issues for scheme quota goal directories by adding kobject_del()
calls.

> diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c
> index 300930c2c5b3f..737638be84f15 100644
> --- a/mm/damon/sysfs-schemes.c
> +++ b/mm/damon/sysfs-schemes.c
> @@ -1465,8 +1465,10 @@ static void damos_sysfs_quota_goals_rm_dirs(
>  	struct damos_sysfs_quota_goal **goals_arr = goals->goals_arr;
>  	int i;
>  
> -	for (i = 0; i < goals->nr; i++)
> +	for (i = 0; i < goals->nr; i++) {
> +		kobject_del(&goals_arr[i]->kobj);
>  		kobject_put(&goals_arr[i]->kobj);
> +	}
>  	goals->nr = 0;
>  	kfree(goals_arr);
>  	goals->goals_arr = NULL;

[Severity: High]
This isn't a bug introduced by this patch, but it appears the same missing
kobject_del() issue exists in damon_sysfs_schemes_add_dirs().

When damon_sysfs_schemes_add_dirs() fails after successfully calling
kobject_init_and_add() for a new scheme, the error path drops the kobject
reference using kobject_put(), but fails to call kobject_del():

mm/damon/sysfs-schemes.c:damon_sysfs_schemes_add_dirs() {
    ...
		err = kobject_init_and_add(&scheme->kobj,
				&damon_sysfs_scheme_ktype, &schemes->kobj,
				"%d", i);
		if (err)
			goto out;
		err = damon_sysfs_scheme_add_dirs(scheme);
		if (err)
			goto out;
    ...
out:
	damon_sysfs_schemes_rm_dirs(schemes);
	kobject_put(&scheme->kobj);
	return err;
}

Under CONFIG_DEBUG_KOBJECT_RELEASE, the release of the kobject is delayed.
Because the parent kobject is persistent, the scheme directory remains
linked in the sysfs tree until the delay expires.

If a user subsequently retries writing to nr_schemes, could the kernel
attempt to create a new scheme kobject with the same name under the same
parent, triggering a -EEXIST name collision?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260617144807.91441-1-sj@kernel.org?part=6