[PATCH 06/11] dlm: Free dlm_ls in kobject release callback
flat view
HOTtoday
From: Ian Rogers <irogers@google.com>
Date: 2026-10-13 22:40:39
Also in:
amd-gfx, dri-devel, driver-core, gfs2, linux-acpi, linux-doc, linux-hardening, linux-pm, linux-s390, linux-sh, lkml, llvm, xen-devel
Subsystem:
distributed lock manager (dlm), filesystems (vfs and infrastructure), the rest · Maintainers:
Alexander Aring, David Teigland, Alexander Viro, Christian Brauner, Linus Torvalds
struct dlm_ls embeds a struct kobject (ls_kobj), but dlm_ktype lacked a
.release callback and dlm freed the lockspace structure directly via
kfree(ls). With CONFIG_DEBUG_KOBJECT_RELEASE=y, freeing ls before the
kobject release runs causes a use-after-free.
Add dlm_ls_release() to free struct dlm_ls when the last reference to
ls_kobj is dropped, use kobject_del() in release_lockspace(), and drop
the final kobject reference in free_lockspace().
Fixes: 3514faca19a6 ("kobject: remove struct kobj_type from struct kset")
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
---
fs/dlm/lockspace.c | 19 +++++++++++++------
1 file changed, 13 insertions(+), 6 deletions(-)
diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c
index a9c98b4f378f..1d226b27d8e6 100644
--- a/fs/dlm/lockspace.c
+++ b/fs/dlm/lockspace.c@@ -179,7 +179,15 @@ static const struct sysfs_ops dlm_attr_ops = { .store = dlm_attr_store, }; +static void dlm_ls_release(struct kobject *kobj) +{ + struct dlm_ls *ls = container_of(kobj, struct dlm_ls, ls_kobj); + + kfree(ls); +} + static struct kobj_type dlm_ktype = { + .release = dlm_ls_release, .default_groups = dlm_groups, .sysfs_ops = &dlm_attr_ops, };
@@ -355,7 +363,7 @@ static void free_lockspace(struct work_struct *work) */ rhashtable_free_and_destroy(&ls->ls_rsbtbl, rhash_free_rsb, NULL); - kfree(ls); + kobject_put(&ls->ls_kobj); } static int new_lockspace(const char *name, const char *cluster,
@@ -436,6 +444,8 @@ static int new_lockspace(const char *name, const char *cluster, atomic_set(&ls->ls_count, 0); init_waitqueue_head(&ls->ls_count_wait); ls->ls_flags = 0; + ls->ls_kobj.kset = dlm_kset; + kobject_init(&ls->ls_kobj, &dlm_ktype); if (ops && dlm_config.ci_recover_callbacks) { ls->ls_ops = ops;
@@ -567,9 +577,7 @@ static int new_lockspace(const char *name, const char *cluster, wait_event(ls->ls_recover_lock_wait, test_bit(LSFL_RECOVER_LOCK, &ls->ls_flags)); - ls->ls_kobj.kset = dlm_kset; - error = kobject_init_and_add(&ls->ls_kobj, &dlm_ktype, NULL, - "%s", ls->ls_name); + error = kobject_add(&ls->ls_kobj, NULL, "%s", ls->ls_name); if (error) goto out_recoverd; kobject_uevent(&ls->ls_kobj, KOBJ_ADD);
@@ -615,7 +623,6 @@ static int new_lockspace(const char *name, const char *cluster, rhashtable_destroy(&ls->ls_rsbtbl); out_lsfree: kobject_put(&ls->ls_kobj); - kfree(ls); out: module_put(THIS_MODULE); return error;
@@ -759,7 +766,7 @@ static int release_lockspace(struct dlm_ls *ls, unsigned int release_option) dlm_delete_debug_file(ls); - kobject_put(&ls->ls_kobj); + kobject_del(&ls->ls_kobj); xa_destroy(&ls->ls_recover_xa); kfree(ls->ls_recover_buf);
--
2.56.0.385.gd3acb90ef8-goog