[PATCH v3 5/9] dlm: Free dlm_ls in kobject release callback

[sashiko-bot at kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] dlm: wrong Fixes commit and misleading subject for
  dlm_ls_release()
--

commit cebf1bf6f5d4b67423eada980e5a294abe491cc6
Author: Ian Rogers <irogers at google.com>

> dlm: Free dlm_ls in kobject release callback
>
> struct dlm_ls embeds a struct kobject (ls_kobj), but dlm_ktype lacked a
> .release callback and dlm freed the lockspace structure directly via
> kfree(ls). With CONFIG_DEBUG_KOBJECT_RELEASE=y, freeing ls before the
> delayed kobject release runs causes a use-after-free, and unloading the
> module while the delayed release is pending results in an instruction
> page fault.
>
> Add a completion ls_kobj_done and dlm_ls_release() to complete it when
> the last kobject reference is dropped, waiting for it in free_lockspace()
> before kfree(ls) and in the new_lockspace() error path before module_put().
> Also delete the kobject via kobject_del() before stopping dlm_recoverd
> to close the window where concurrent sysfs writes could wake the stopped
> recovery task.
>
> Fixes: 3514faca19a6 ("kobject: remove struct kobj_type from struct kset")
> Acked-by: Alexander Aring <aahringo at redhat.com>
> Signed-off-by: Ian Rogers <irogers at google.com>

[Severity: Low]
3514faca19a6 ("kobject: remove struct kobj_type from struct kset") only
removed the .ktype pointer from dlm_kset while leaving dlm_ktype.release
set to lockspace_kobj_release().  The commit that dropped the release
callback from dlm_ktype and started calling kfree(ls) directly after
kobject_put(&ls->ls_kobj) is 8a4cf500f1dd ("dlm: drop kobject release
callback handling").  Should the Fixes: tag point to that commit instead:

  Fixes: 8a4cf500f1dd ("dlm: drop kobject release callback handling")

Also, the subject line says dlm_ls is freed in the kobject release
callback, whereas dlm_ls_release() only signals ls_kobj_done and kfree(ls)
Still happens in free_lockspace() and new_lockspace().

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261108223913.3624571-1-irogers@google.com?part=5