On Wed, Dec 26, 2007 at 01:31:35PM -0800, Christoph Lameter wrote:
Erm... Let me spell it out: current lifetime rules are completely broken.
As it is, create/destroy/create cache sequence will do kobject_put() on
kfree'd object. Even without people playing with holding sysfs files
open or doing IO on those.
a) you have kobject embedded into struct with the lifetime rules of its
own. When its refcount hits zero you kfree() the sucker, even if you
still have references to embedded kobject.
b) your symlinks stick around. Even when cache is long gone you still
have a sysfs symlink with its embedded kobject as a target. They are
eventually removed when cache with the same name gets created. _Then_
you get the target kobject dropped - when the memory it used to be in
had been freed for hell knows how long and reused by something that would
not appreciate slub.c code suddenly deciding to decrement some word in
that memory.
c) you leak references to these kobject; kobject_del() only removes it
from the tree undoing the effect of kobject_add() and you still need
kobject_put() to deal with the last reference.
--
