[PATCH] dm: release the sysfs kobject when its initialization fails

[PATCH] dm: release the sysfs kobject when its initialization fails

[Wentao Liang]

dm_sysfs_init() uses kobject_init_and_add(), which requires a matching
put even when adding the object fails. dm_setup_md_queue() currently
unwinds the disk and holder links without releasing this object. Since
md->type is still DM_TYPE_NONE, cleanup_mapped_device() also skips the
sysfs cleanup, leaving the initialized kobject behind.

Call dm_sysfs_exit() before unwinding a failed sysfs initialization. This
both puts the kobject and waits for its release callback, including when
CONFIG_DEBUG_KOBJECT_RELEASE delays that callback, before the mapped
device can be freed or its queue setup retried.

Fixes: 784aae735d9b ("dm: add name and uuid to sysfs")
Cc: stable@vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/md/dm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 1881d86111fb..08b87fd6f955 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -2647,8 +2647,10 @@ int dm_setup_md_queue(struct mapped_device *md, struct dm_table *t)
 	mutex_unlock(&md->table_devices_lock);
 
 	r = dm_sysfs_init(md);
-	if (r)
+	if (r) {
+		dm_sysfs_exit(md);
 		goto lock_out_undo_holders;
+	}
 
 	md->type = type;
 
-- 
2.34.1

Re: [PATCH] dm: release the sysfs kobject when its initialization fails

[Krzysztof Kozlowski]

On Tue, 03 Nov 2026 08:23:29 +0000, Wentao Liang wrote:
> dm_sysfs_init() uses kobject_init_and_add(), which requires a matching
> put even when adding the object fails. dm_setup_md_queue() currently
> unwinds the disk and holder links without releasing this object. Since
> md->type is still DM_TYPE_NONE, cleanup_mapped_device() also skips the
> sysfs cleanup, leaving the initialized kobject behind.
> 
> Call dm_sysfs_exit() before unwinding a failed sysfs initialization. This
> both puts the kobject and waits for its release callback, including when
> CONFIG_DEBUG_KOBJECT_RELEASE delays that callback, before the mapped
> device can be freed or its queue setup retried.
> 
> Fixes: 784aae735d9b ("dm: add name and uuid to sysfs")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/md/dm.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 



Multiple things here:
1. Your team ignored completely previous feedback. Multiple times.

2. You use multiple identities with this email address, thus I doubt that we
   speak with an actual person.

3. Your bot does not even bother running checkpatch, right?

4. Nothing of this was reproduced nor tested.

5. Finally, the same feedback:
You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem (so a patchset grouping multiple patches with a short cover
letter), how to document the issue discovery method and what was
or was not tested.

Best regards,
Krzysztof

[PATCH] dm-sysfs: fix misbehavior if kobject_init_and_add fails

[Mikulas Patocka]

Hi

The bug is real, but the patch is wrong. As Sashiko noted, 
kobject_init_and_add would see an uninitialized kboject if it were called 
the second time.

I created this patch for this bug.

Mikulas


dm-sysfs: fix misbehavior if kobject_init_and_add fails

If kobject_init_and_add, we must call kobject_put (see the comment at
kobject_init_and_add).

Before calling kobject_init_and_add, we must zero the kobject (see
https://lwn.net/Articles/52085/). If the first call to dm_sysfs_init
failed, it may be called again, and that second call would see an
uninitialized kobject.

Cc: stable@vger.kernel.org
Fixes: 784aae735d9b ("dm: add name and uuid to sysfs")
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>

---
 drivers/md/dm-sysfs.c |   17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

Index: linux-2.6/drivers/md/dm-sysfs.c
===================================================================
--- linux-2.6.orig/drivers/md/dm-sysfs.c
+++ linux-2.6/drivers/md/dm-sysfs.c
@@ -128,9 +128,20 @@ static const struct kobj_type dm_ktype =
  */
 int dm_sysfs_init(struct mapped_device *md)
 {
-	return kobject_init_and_add(dm_kobject(md), &dm_ktype,
-				    &disk_to_dev(dm_disk(md))->kobj,
-				    "%s", "dm");
+	struct kobject *kobj = dm_kobject(md);
+	int r;
+
+	/* The kobject must be zeroed before calling kobject_init */
+	memset(kobj, 0, sizeof(struct kobject));
+	r = kobject_init_and_add(kobj, &dm_ktype,
+				 &disk_to_dev(dm_disk(md))->kobj,
+				 "%s", "dm");
+	if (unlikely(r)) {
+		/* Weird semantics - we must call kobject_put on failure */
+		dm_sysfs_exit(md);
+		return r;
+	}
+	return 0;
 }
 
 /*


On Tue, 3 Nov 2026, Wentao Liang wrote:

> dm_sysfs_init() uses kobject_init_and_add(), which requires a matching
> put even when adding the object fails. dm_setup_md_queue() currently
> unwinds the disk and holder links without releasing this object. Since
> md->type is still DM_TYPE_NONE, cleanup_mapped_device() also skips the
> sysfs cleanup, leaving the initialized kobject behind.
> 
> Call dm_sysfs_exit() before unwinding a failed sysfs initialization. This
> both puts the kobject and waits for its release callback, including when
> CONFIG_DEBUG_KOBJECT_RELEASE delays that callback, before the mapped
> device can be freed or its queue setup retried.
> 
> Fixes: 784aae735d9b ("dm: add name and uuid to sysfs")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/md/dm.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/md/dm.c b/drivers/md/dm.c
> index 1881d86111fb..08b87fd6f955 100644
> --- a/drivers/md/dm.c
> +++ b/drivers/md/dm.c
> @@ -2647,8 +2647,10 @@ int dm_setup_md_queue(struct mapped_device *md, struct dm_table *t)
>  	mutex_unlock(&md->table_devices_lock);
>  
>  	r = dm_sysfs_init(md);
> -	if (r)
> +	if (r) {
> +		dm_sysfs_exit(md);
>  		goto lock_out_undo_holders;
> +	}
>  
>  	md->type = type;
>  
> -- 
> 2.34.1
>