memleak around kobject_init_and_add()

["Tobin C. Harding" <me@tobin.cc>]

(Note at bottom on reasons for 'To' list 'Cc' list)

Hi,

kobject_init_and_add() seems to be routinely misused.  A failed call to this
function requires a call to kobject_put() otherwise we leak memory.

Examples memleaks can be seen in:

	mm/slub.c
	fs/btrfs/sysfs.c
	fs/xfs/xfs_sysfs.h: xfs_sysfs_init()

 Question: Do we fix the misuse or fix the API?

$ git grep kobject_init_and_add | wc -l
117

Either way, we will have to go through all 117 call sites and check them.  I
don't mind fixing them all but I don't want to do it twice because I chose the
wrong option.  Reaching out to those more experienced for a suggestion please.

Fix the API
-----------

Typically init functions do not require cleanup if they fail, this argument
leads to this patch

diff --git a/lib/kobject.c b/lib/kobject.c
index aa89edcd2b63..62328054bbd0 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -453,6 +453,9 @@ int kobject_init_and_add(struct kobject *kobj, struct kobj_type *ktype,
 	retval = kobject_add_varg(kobj, parent, fmt, args);
 	va_end(args);
 
+	if (retval)
+		kobject_put(kobj);
+
 	return retval;
 }
 EXPORT_SYMBOL_GPL(kobject_init_and_add);


Fix all the call sites
----------------------

Go through all 117 call sites and add kobj_put() in the error path.

This example from mm/slub.c

diff --git a/mm/slub.c b/mm/slub.c
index d30ede89f4a6..84a9d6c06c27 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -5756,8 +5756,10 @@ static int sysfs_slab_add(struct kmem_cache *s)
 
 	s->kobj.kset = kset;
 	err = kobject_init_and_add(&s->kobj, &slab_ktype, NULL, "%s", name);
-	if (err)
+	if (err) {
+		kobject_put(&s->kobj);
 		goto out;
+	}
 
 	err = sysfs_create_group(&s->kobj, &slab_attr_group);
 	if (err)


thanks,
Tobin.


This is a Saturday afternoon 'drinking some wine, hacking on the kernel'
email.  Sending it to the lib/kobject.c maintainers for obvious
reasons.  CC'd a few extra people who I thought might be interested to
take the weight of Greg and Rafael :)