Re: [PATCH] mm: thp: Fix refcount leak in thpsize_create() error path

[Barry Song <baohua@kernel.org>]

On Sat, Apr 11, 2026 at 2:22 PM Guangshuo Li <lgs201920130244@gmail.com> wrote:
>
> After kobject_init_and_add(), the lifetime of the embedded struct
> kobject is expected to be managed through the kobject core reference
> counting.
>
> In thpsize_create(), if kobject_init_and_add() fails, thpsize is freed
> directly with kfree() rather than releasing the kobject reference with
> kobject_put(). This may leave the reference count of the embedded struct
> kobject unbalanced, resulting in a refcount leak and potentially leading
> to a use-after-free.
>
> Fix this by using kobject_put(&thpsize->kobj) in the failure path and
> letting thpsize_release() handle the final cleanup.
>
> Fixes: 3485b88390b0 ("mm: thp: introduce multi-size THP sysfs interface")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>

I’m fine with the patch, but could you send a v2 to drop
the err label, which is no longer used? Alternatively,
could you rename err_put to err?

@@ -825,9 +825,8 @@ static struct thpsize *thpsize_create(int order,
struct kobject *parent)
        }

        return thpsize;
-err_put:
-       kobject_put(&thpsize->kobj);
 err:
+       kobject_put(&thpsize->kobj);
        return ERR_PTR(ret);
 }


> ---
>  mm/huge_memory.c | 7 ++-----
>  1 file changed, 2 insertions(+), 5 deletions(-)
>
> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> index 40cf59301c21..ae6ed483cd53 100644
> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c
> @@ -726,11 +726,8 @@ static struct thpsize *thpsize_create(int order, struct kobject *parent)
>
>         ret = kobject_init_and_add(&thpsize->kobj, &thpsize_ktype, parent,
>                                    "hugepages-%lukB", size);
> -       if (ret) {
> -               kfree(thpsize);
> -               goto err;
> -       }
> -
> +       if (ret)
> +               goto err_put;
>
>         ret = sysfs_add_group(&thpsize->kobj, &any_ctrl_attr_grp);
>         if (ret)
> --
> 2.43.0
>