Re: [PATCH] mm: thp: Fix refcount leak in thpsize_create() error path

[Barry Song]

On Sat, Apr 11, 2026 at 4:32 PM Barry Song <baohua@xxxxxxxxxx> wrote:
>
> On Sat, Apr 11, 2026 at 2:22 PM Guangshuo Li <lgs201920130244@xxxxxxxxx> wrote:
> >
> > After kobject_init_and_add(), the lifetime of the embedded struct
> > kobject is expected to be managed through the kobject core reference
> > counting.
> >
> > In thpsize_create(), if kobject_init_and_add() fails, thpsize is freed
> > directly with kfree() rather than releasing the kobject reference with
> > kobject_put(). This may leave the reference count of the embedded struct
> > kobject unbalanced, resulting in a refcount leak and potentially leading
> > to a use-after-free.
> >
> > Fix this by using kobject_put(&thpsize->kobj) in the failure path and
> > letting thpsize_release() handle the final cleanup.
> >
> > Fixes: 3485b88390b0 ("mm: thp: introduce multi-size THP sysfs interface")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
>
> I’m fine with the patch, but could you send a v2 to drop
> the err label, which is no longer used? Alternatively,
> could you rename err_put to err?
>
> @@ -825,9 +825,8 @@ static struct thpsize *thpsize_create(int order,
> struct kobject *parent)
>         }
>
>         return thpsize;
> -err_put:
> -       kobject_put(&thpsize->kobj);
>  err:
> +       kobject_put(&thpsize->kobj);
>         return ERR_PTR(ret);
>  }

Sorry, my mistake—err is still used by kzalloc_obj.

Reviewed-by: Barry Song <baohua@xxxxxxxxxx>