* Re: [PATCH] dm: release the sysfs kobject when its initialization fails
2026-11-03 8:23 [PATCH] dm: release the sysfs kobject when its initialization fails Wentao Liang
@ 2026-11-03 9:21 ` Krzysztof Kozlowski
2026-11-05 14:56 ` [PATCH] dm-sysfs: fix misbehavior if kobject_init_and_add fails Mikulas Patocka
1 sibling, 0 replies; 3+ messages in thread
From: Krzysztof Kozlowski @ 2026-11-03 9:21 UTC (permalink / raw)
To: Wentao Liang
Cc: agk, mpatocka, dm-devel, linux-kernel, stable, snitzer, bmarzins
On Tue, 03 Nov 2026 08:23:29 +0000, Wentao Liang wrote:
> dm_sysfs_init() uses kobject_init_and_add(), which requires a matching
> put even when adding the object fails. dm_setup_md_queue() currently
> unwinds the disk and holder links without releasing this object. Since
> md->type is still DM_TYPE_NONE, cleanup_mapped_device() also skips the
> sysfs cleanup, leaving the initialized kobject behind.
>
> Call dm_sysfs_exit() before unwinding a failed sysfs initialization. This
> both puts the kobject and waits for its release callback, including when
> CONFIG_DEBUG_KOBJECT_RELEASE delays that callback, before the mapped
> device can be freed or its queue setup retried.
>
> Fixes: 784aae735d9b ("dm: add name and uuid to sysfs")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
> drivers/md/dm.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
Multiple things here:
1. Your team ignored completely previous feedback. Multiple times.
2. You use multiple identities with this email address, thus I doubt that we
speak with an actual person.
3. Your bot does not even bother running checkpatch, right?
4. Nothing of this was reproduced nor tested.
5. Finally, the same feedback:
You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.
More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.
This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down. Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.
Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem (so a patchset grouping multiple patches with a short cover
letter), how to document the issue discovery method and what was
or was not tested.
Best regards,
Krzysztof
^ permalink raw reply [flat|nested] 3+ messages in thread* [PATCH] dm-sysfs: fix misbehavior if kobject_init_and_add fails
2026-11-03 8:23 [PATCH] dm: release the sysfs kobject when its initialization fails Wentao Liang
2026-11-03 9:21 ` Krzysztof Kozlowski
@ 2026-11-05 14:56 ` Mikulas Patocka
1 sibling, 0 replies; 3+ messages in thread
From: Mikulas Patocka @ 2026-11-05 14:56 UTC (permalink / raw)
To: Wentao Liang; +Cc: agk, snitzer, bmarzins, dm-devel, linux-kernel
Hi
The bug is real, but the patch is wrong. As Sashiko noted,
kobject_init_and_add would see an uninitialized kboject if it were called
the second time.
I created this patch for this bug.
Mikulas
dm-sysfs: fix misbehavior if kobject_init_and_add fails
If kobject_init_and_add, we must call kobject_put (see the comment at
kobject_init_and_add).
Before calling kobject_init_and_add, we must zero the kobject (see
https://lwn.net/Articles/52085/). If the first call to dm_sysfs_init
failed, it may be called again, and that second call would see an
uninitialized kobject.
Cc: stable@vger.kernel.org
Fixes: 784aae735d9b ("dm: add name and uuid to sysfs")
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
---
drivers/md/dm-sysfs.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
Index: linux-2.6/drivers/md/dm-sysfs.c
===================================================================
--- linux-2.6.orig/drivers/md/dm-sysfs.c
+++ linux-2.6/drivers/md/dm-sysfs.c
@@ -128,9 +128,20 @@ static const struct kobj_type dm_ktype =
*/
int dm_sysfs_init(struct mapped_device *md)
{
- return kobject_init_and_add(dm_kobject(md), &dm_ktype,
- &disk_to_dev(dm_disk(md))->kobj,
- "%s", "dm");
+ struct kobject *kobj = dm_kobject(md);
+ int r;
+
+ /* The kobject must be zeroed before calling kobject_init */
+ memset(kobj, 0, sizeof(struct kobject));
+ r = kobject_init_and_add(kobj, &dm_ktype,
+ &disk_to_dev(dm_disk(md))->kobj,
+ "%s", "dm");
+ if (unlikely(r)) {
+ /* Weird semantics - we must call kobject_put on failure */
+ dm_sysfs_exit(md);
+ return r;
+ }
+ return 0;
}
/*
On Tue, 3 Nov 2026, Wentao Liang wrote:
> dm_sysfs_init() uses kobject_init_and_add(), which requires a matching
> put even when adding the object fails. dm_setup_md_queue() currently
> unwinds the disk and holder links without releasing this object. Since
> md->type is still DM_TYPE_NONE, cleanup_mapped_device() also skips the
> sysfs cleanup, leaving the initialized kobject behind.
>
> Call dm_sysfs_exit() before unwinding a failed sysfs initialization. This
> both puts the kobject and waits for its release callback, including when
> CONFIG_DEBUG_KOBJECT_RELEASE delays that callback, before the mapped
> device can be freed or its queue setup retried.
>
> Fixes: 784aae735d9b ("dm: add name and uuid to sysfs")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
> drivers/md/dm.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/md/dm.c b/drivers/md/dm.c
> index 1881d86111fb..08b87fd6f955 100644
> --- a/drivers/md/dm.c
> +++ b/drivers/md/dm.c
> @@ -2647,8 +2647,10 @@ int dm_setup_md_queue(struct mapped_device *md, struct dm_table *t)
> mutex_unlock(&md->table_devices_lock);
>
> r = dm_sysfs_init(md);
> - if (r)
> + if (r) {
> + dm_sysfs_exit(md);
> goto lock_out_undo_holders;
> + }
>
> md->type = type;
>
> --
> 2.34.1
>
^ permalink raw reply [flat|nested] 3+ messages in thread