[PATCH 06/11] dlm: Free dlm_ls in kobject release callback

[Ian Rogers]

struct dlm_ls embeds a struct kobject (ls_kobj), but dlm_ktype lacked a
.release callback and dlm freed the lockspace structure directly via
kfree(ls). With CONFIG_DEBUG_KOBJECT_RELEASE=y, freeing ls before the
kobject release runs causes a use-after-free.

Add dlm_ls_release() to free struct dlm_ls when the last reference to
ls_kobj is dropped, use kobject_del() in release_lockspace(), and drop
the final kobject reference in free_lockspace().

Fixes: 3514faca19a6 ("kobject: remove struct kobj_type from struct kset")
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irog...@google.com>
---
 fs/dlm/lockspace.c | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c
index a9c98b4f378f..1d226b27d8e6 100644
--- a/fs/dlm/lockspace.c
+++ b/fs/dlm/lockspace.c
@@ -179,7 +179,15 @@ static const struct sysfs_ops dlm_attr_ops = {
        .store = dlm_attr_store,
 };
 
+static void dlm_ls_release(struct kobject *kobj)
+{
+       struct dlm_ls *ls = container_of(kobj, struct dlm_ls, ls_kobj);
+
+       kfree(ls);
+}
+
 static struct kobj_type dlm_ktype = {
+       .release        = dlm_ls_release,
        .default_groups = dlm_groups,
        .sysfs_ops     = &dlm_attr_ops,
 };
@@ -355,7 +363,7 @@ static void free_lockspace(struct work_struct *work)
         */
        rhashtable_free_and_destroy(&ls->ls_rsbtbl, rhash_free_rsb, NULL);
 
-       kfree(ls);
+       kobject_put(&ls->ls_kobj);
 }
 
 static int new_lockspace(const char *name, const char *cluster,
@@ -436,6 +444,8 @@ static int new_lockspace(const char *name, const char 
*cluster,
        atomic_set(&ls->ls_count, 0);
        init_waitqueue_head(&ls->ls_count_wait);
        ls->ls_flags = 0;
+       ls->ls_kobj.kset = dlm_kset;
+       kobject_init(&ls->ls_kobj, &dlm_ktype);
 
        if (ops && dlm_config.ci_recover_callbacks) {
                ls->ls_ops = ops;
@@ -567,9 +577,7 @@ static int new_lockspace(const char *name, const char 
*cluster,
        wait_event(ls->ls_recover_lock_wait,
                   test_bit(LSFL_RECOVER_LOCK, &ls->ls_flags));
 
-       ls->ls_kobj.kset = dlm_kset;
-       error = kobject_init_and_add(&ls->ls_kobj, &dlm_ktype, NULL,
-                                    "%s", ls->ls_name);
+       error = kobject_add(&ls->ls_kobj, NULL, "%s", ls->ls_name);
        if (error)
                goto out_recoverd;
        kobject_uevent(&ls->ls_kobj, KOBJ_ADD);
@@ -615,7 +623,6 @@ static int new_lockspace(const char *name, const char 
*cluster,
        rhashtable_destroy(&ls->ls_rsbtbl);
  out_lsfree:
        kobject_put(&ls->ls_kobj);
-       kfree(ls);
  out:
        module_put(THIS_MODULE);
        return error;
@@ -759,7 +766,7 @@ static int release_lockspace(struct dlm_ls *ls, unsigned 
int release_option)
 
        dlm_delete_debug_file(ls);
 
-       kobject_put(&ls->ls_kobj);
+       kobject_del(&ls->ls_kobj);
 
        xa_destroy(&ls->ls_recover_xa);
        kfree(ls->ls_recover_buf);
-- 
2.56.0.385.gd3acb90ef8-goog