Hi, On Tue, Oct 27, 2026 at 6:39 PM Ian Rogers <[email protected]> wrote: > > struct dlm_ls embeds a struct kobject (ls_kobj), but dlm_ktype lacked a > .release callback and dlm freed the lockspace structure directly via > kfree(ls). With CONFIG_DEBUG_KOBJECT_RELEASE=y, freeing ls before the > delayed kobject release runs causes a use-after-free, and unloading the > module while the delayed release is pending results in an instruction > page fault. > > Add a completion ls_kobj_done and dlm_ls_release() to complete it when > the last kobject reference is dropped, waiting for it in free_lockspace() > before kfree(ls) and in the new_lockspace() error path before module_put(). > Also delete the kobject via kobject_del() before stopping dlm_recoverd > to close the window where concurrent sysfs writes could wake the stopped > recovery task. > > Fixes: 3514faca19a6 ("kobject: remove struct kobj_type from struct kset") > Signed-off-by: Ian Rogers <[email protected]>
A somewhat "big change" for just a debug functionality. Althrough I agree we shout call "kobject_del()" early to avoid additional sysfs changes during removal. Acked-by: Alexander Aring <[email protected]> Thanks. - Alex
