Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <20220120134415.57147-1-dzm91@hust.edu.cn> <0bc923d8-6565-69a3-c234-3789707efeb9@gmail.com>
In-Reply-To: <0bc923d8-6565-69a3-c234-3789707efeb9@gmail.com>
From:   Ryusuke Konishi <konishi.ryusuke@gmail.com>
Date:   Fri, 21 Jan 2022 02:54:21 +0900
Message-ID: <CAKFNMo=orkfaAmgPEHvWQmb83PG4nURgv+eaS0BX5_iDbG5pDw@mail.gmail.com>
Subject: Re: [PATCH] fs: nilfs2: fix memory leak in nilfs_sysfs_create_device_group
To:     Dongliang Mu <dzm91@hust.edu.cn>
Cc:     Pavel Skripkin <paskripkin@gmail.com>,
        Andrew Morton <akpm@linux-foundation.org>,
        linux-nilfs <linux-nilfs@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>,
        Nanyong Sun <sunnanyong@huawei.com>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

(added Nanyong Sun to CC)
Hi Dongliang,

On Thu, Jan 20, 2022 at 11:07 PM Pavel Skripkin <paskripkin@gmail.com> wrote:
>
> Hi Dongliang,
>
> On 1/20/22 16:44, Dongliang Mu wrote:
> > The preivous commit 8fd0c1b0647a ("nilfs2: fix memory leak in
> > nilfs_sysfs_delete_device_group") only handles the memory leak in the
> > nilfs_sysfs_delete_device_group. However, the similar memory leak still
> > occurs in the nilfs_sysfs_create_device_group.
> >
> > Fix it by adding kobject_del when
> > kobject_init_and_add succeeds, but one of the following calls fails.
> >
> > Fixes: 8fd0c1b0647a ("nilfs2: fix memory leak in nilfs_sysfs_delete_device_group")
>
> Why Fixes tag points to my commit? This issue was introduced before my patch
>

As Pavel pointed out, this patch is independent of his patch.
The following one ?

 5f5dec07aca7 ("nilfs2: fix memory leak in nilfs_sysfs_create_device_group")

> > Signed-off-by: Dongliang Mu <dzm91@hust.edu.cn>
> > ---
> >   fs/nilfs2/sysfs.c | 5 ++++-
> >   1 file changed, 4 insertions(+), 1 deletion(-)

Can you describe what memory leak issue does this patch actually fix ?

It looks like kobject_put() can call __kobject_del() unless circular
references exist.

  kobject_put() -> kref_put() -> kobject_release() ->
kobject_cleanup() -> __kobject_del()

As explained in Documentation/core-api/kobject.rst,

  kobject_del() can be used to drop the reference to the parent object, if
  circular references are constructed.

But, at least, the parent object is NULL in this case.
I really want to understand what the real problem is.

Thanks,
Ryusuke Konishi

> >
> > diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
> > index 379d22e28ed6..0b2db2b499d5 100644
> > --- a/fs/nilfs2/sysfs.c
> > +++ b/fs/nilfs2/sysfs.c
> > @@ -995,7 +995,7 @@ int nilfs_sysfs_create_device_group(struct super_block *sb)
> >
> >       err = nilfs_sysfs_create_mounted_snapshots_group(nilfs);
> >       if (err)
> > -             goto cleanup_dev_kobject;
> > +             goto delete_dev_kobject;
> >
> >       err = nilfs_sysfs_create_checkpoints_group(nilfs);
> >       if (err)
> > @@ -1027,6 +1027,9 @@ int nilfs_sysfs_create_device_group(struct super_block *sb)
> >   delete_mounted_snapshots_group:
> >       nilfs_sysfs_delete_mounted_snapshots_group(nilfs);
> >
> > +delete_dev_kobject:
> > +     kobject_del(&nilfs->ns_dev_kobj);
> > +
> >   cleanup_dev_kobject:
> >       kobject_put(&nilfs->ns_dev_kobj);
> >       kfree(nilfs->ns_dev_subgroups);
> With regards,
> Pavel Skripkin