Re: [PATCH] mm/slub: fix kobject leak in sysfs_slab_add error path

[Hongling Zeng]

在 2026年07月13日 14:07, Harry Yoo 写道:
> On 7/13/26 2:58 PM, Hongling Zeng wrote:
> > When kobject_init_and_add() fails in sysfs_slab_add(), the kobject
> > is not properly cleaned up, causing a memory leak.
> >
> > According to the kobject API documentation, when kobject_init_and_add()
> > returns an error, the caller must call kobject_put() to properly clean
> > up the memory associated with the object. The current code only frees
> > the 'name' string but forgets to release the kobject reference.
> This was intentional, please see commit 2420baa8e046 ("mm/slab: Allow
> cache creation to proceed even if sysfs registration fails").
  Thank you for the clarification. I see now that this was an intentional
  design choice to allow cache creation to proceed even when sysfs
  registration fails.

> > Fix this by calling kobject_put() before jumping to the error label.
> >
> > Fixes: 54b6a731025f ("slub: fix leak of 'name' in sysfs_slab_add")
> > Signed-off-by: Hongling Zeng <zenghongling@xxxxxxxxxx>
> > ---
>
> Uh, there was a similar attempt recently...
>
> https://lore.kernel.org/linux-mm/gimwkjjpvwu2sg5625b3eeatw2vhv7rs6enm3vepdduhcefbf5@xen5iec7sn3z
>
> Sounds like we need a comment saying it is intentional!
 Good idea. Would a patch adding a comment like this be useful?
          err = kobject_init_and_add(&s->kobj, &slab_ktype, NULL, "%s", 
name);
  +       /*
  +        * Note: Intentionally not calling kobject_put() on error.
  +        *
  +        * The kobject release callback (slab_kmem_cache_release) would
  +        * free the entire kmem_cache structure. However, sysfs
  +        * registration failures are treated as non-fatal - the cache
  +        * continues to be used. See commit 2420baa8e046 ("mm/slab: Allow
  +        * cache creation to proceed even if sysfs registration fails").
  +        */
          if (err)
                  goto out;

Thanks!