Re: [PATCH] mm/slub: fix kobject leak in sysfs_slab_add error path

[Hongling Zeng <zhongling0719@126.com>]

在 2026年07月13日 14:07, Harry Yoo 写道:
>
> On 7/13/26 2:58 PM, Hongling Zeng wrote:
>> When kobject_init_and_add() fails in sysfs_slab_add(), the kobject
>> is not properly cleaned up, causing a memory leak.
>>
>> According to the kobject API documentation, when kobject_init_and_add()
>> returns an error, the caller must call kobject_put() to properly clean
>> up the memory associated with the object. The current code only frees
>> the 'name' string but forgets to release the kobject reference.
> This was intentional, please see commit 2420baa8e046 ("mm/slab: Allow
> cache creation to proceed even if sysfs registration fails").
   Thank you for the clarification. I see now that this was an intentional
   design choice to allow cache creation to proceed even when sysfs
   registration fails.

>> Fix this by calling kobject_put() before jumping to the error label.
>>
>> Fixes: 54b6a731025f ("slub: fix leak of 'name' in sysfs_slab_add")
>> Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
>> ---
>
> Uh, there was a similar attempt recently...
>
> https://lore.kernel.org/linux-mm/gimwkjjpvwu2sg5625b3eeatw2vhv7rs6enm3vepdduhcefbf5@xen5iec7sn3z
>
> Sounds like we need a comment saying it is intentional!
>
  Good idea. Would a patch adding a comment like this be useful?
           err = kobject_init_and_add(&s->kobj, &slab_ktype, NULL, "%s", 
name);
   +       /*
   +        * Note: Intentionally not calling kobject_put() on error.
   +        *
   +        * The kobject release callback (slab_kmem_cache_release) would
   +        * free the entire kmem_cache structure. However, sysfs
   +        * registration failures are treated as non-fatal - the cache
   +        * continues to be used. See commit 2420baa8e046 ("mm/slab: Allow
   +        * cache creation to proceed even if sysfs registration fails").
   +        */
           if (err)
                   goto out;

Thanks!