[PATCH] dm-sysfs: fix misbehavior if kobject_init_and_add fails

[Mikulas Patocka <mpatocka@redhat.com>]

Hi

The bug is real, but the patch is wrong. As Sashiko noted, 
kobject_init_and_add would see an uninitialized kboject if it were called 
the second time.

I created this patch for this bug.

Mikulas


dm-sysfs: fix misbehavior if kobject_init_and_add fails

If kobject_init_and_add, we must call kobject_put (see the comment at
kobject_init_and_add).

Before calling kobject_init_and_add, we must zero the kobject (see
https://lwn.net/Articles/52085/). If the first call to dm_sysfs_init
failed, it may be called again, and that second call would see an
uninitialized kobject.

Cc: stable@vger.kernel.org
Fixes: 784aae735d9b ("dm: add name and uuid to sysfs")
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>

---
 drivers/md/dm-sysfs.c |   17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

Index: linux-2.6/drivers/md/dm-sysfs.c
===================================================================
--- linux-2.6.orig/drivers/md/dm-sysfs.c
+++ linux-2.6/drivers/md/dm-sysfs.c
@@ -128,9 +128,20 @@ static const struct kobj_type dm_ktype =
  */
 int dm_sysfs_init(struct mapped_device *md)
 {
-	return kobject_init_and_add(dm_kobject(md), &dm_ktype,
-				    &disk_to_dev(dm_disk(md))->kobj,
-				    "%s", "dm");
+	struct kobject *kobj = dm_kobject(md);
+	int r;
+
+	/* The kobject must be zeroed before calling kobject_init */
+	memset(kobj, 0, sizeof(struct kobject));
+	r = kobject_init_and_add(kobj, &dm_ktype,
+				 &disk_to_dev(dm_disk(md))->kobj,
+				 "%s", "dm");
+	if (unlikely(r)) {
+		/* Weird semantics - we must call kobject_put on failure */
+		dm_sysfs_exit(md);
+		return r;
+	}
+	return 0;
 }
 
 /*


On Tue, 3 Nov 2026, Wentao Liang wrote:

> dm_sysfs_init() uses kobject_init_and_add(), which requires a matching
> put even when adding the object fails. dm_setup_md_queue() currently
> unwinds the disk and holder links without releasing this object. Since
> md->type is still DM_TYPE_NONE, cleanup_mapped_device() also skips the
> sysfs cleanup, leaving the initialized kobject behind.
> 
> Call dm_sysfs_exit() before unwinding a failed sysfs initialization. This
> both puts the kobject and waits for its release callback, including when
> CONFIG_DEBUG_KOBJECT_RELEASE delays that callback, before the mapped
> device can be freed or its queue setup retried.
> 
> Fixes: 784aae735d9b ("dm: add name and uuid to sysfs")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/md/dm.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/md/dm.c b/drivers/md/dm.c
> index 1881d86111fb..08b87fd6f955 100644
> --- a/drivers/md/dm.c
> +++ b/drivers/md/dm.c
> @@ -2647,8 +2647,10 @@ int dm_setup_md_queue(struct mapped_device *md, struct dm_table *t)
>  	mutex_unlock(&md->table_devices_lock);
>  
>  	r = dm_sysfs_init(md);
> -	if (r)
> +	if (r) {
> +		dm_sysfs_exit(md);
>  		goto lock_out_undo_holders;
> +	}
>  
>  	md->type = type;
>  
> -- 
> 2.34.1
>