If sysfs_create_group() fails with hstate_attr_group, hstate_kobjs[hi]
will be set to NULL. Then it will be passed to sysfs_create_group() if
h->demote_order != 0 thus triggering WARN_ON(!kobj) check. Fix this by
making sure hstate_kobjs[hi] != NULL when calling sysfs_create_group.

Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
---
 mm/hugetlb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index e72052964fb5..ff991e5bdf1f 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3846,6 +3846,7 @@ static int hugetlb_sysfs_add_hstate(struct hstate *h, struct kobject *parent,
 	if (retval) {
 		kobject_put(hstate_kobjs[hi]);
 		hstate_kobjs[hi] = NULL;
+		return retval;
 	}
 
 	if (h->demote_order) {
-- 
2.23.0

> On Aug 16, 2022, at 21:05, Miaohe Lin <linmiaohe@huawei.com> wrote:
> 
> If sysfs_create_group() fails with hstate_attr_group, hstate_kobjs[hi]
> will be set to NULL. Then it will be passed to sysfs_create_group() if
> h->demote_order != 0 thus triggering WARN_ON(!kobj) check. Fix this by
> making sure hstate_kobjs[hi] != NULL when calling sysfs_create_group.
> 
> Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>

It’s better to add a Fixes tag here.

Reviewed-by: Muchun Song <songmuchun@bytedance.com>

Thanks.

On 2022/8/17 10:31, Muchun Song wrote:
> 
> 
>> On Aug 16, 2022, at 21:05, Miaohe Lin <linmiaohe@huawei.com> wrote:
>>
>> If sysfs_create_group() fails with hstate_attr_group, hstate_kobjs[hi]
>> will be set to NULL. Then it will be passed to sysfs_create_group() if
>> h->demote_order != 0 thus triggering WARN_ON(!kobj) check. Fix this by
>> making sure hstate_kobjs[hi] != NULL when calling sysfs_create_group.
>>
>> Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
> 
> It’s better to add a Fixes tag here.

Will add it in next version. Thanks for your review and comment.

Thanks,
Miaohe Lin

> 
> Reviewed-by: Muchun Song <songmuchun@bytedance.com>
> 
> Thanks.
> 
> .
> 

On 08/16/22 21:05, Miaohe Lin wrote:
> If sysfs_create_group() fails with hstate_attr_group, hstate_kobjs[hi]
> will be set to NULL. Then it will be passed to sysfs_create_group() if
> h->demote_order != 0 thus triggering WARN_ON(!kobj) check. Fix this by
> making sure hstate_kobjs[hi] != NULL when calling sysfs_create_group.
> 
> Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
> ---
>  mm/hugetlb.c | 1 +
>  1 file changed, 1 insertion(+)

Thanks!

Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
-- 
Mike Kravetz

> 
> diff --git a/mm/hugetlb.c b/mm/hugetlb.c
> index e72052964fb5..ff991e5bdf1f 100644
> --- a/mm/hugetlb.c
> +++ b/mm/hugetlb.c
> @@ -3846,6 +3846,7 @@ static int hugetlb_sysfs_add_hstate(struct hstate *h, struct kobject *parent,
>  	if (retval) {
>  		kobject_put(hstate_kobjs[hi]);
>  		hstate_kobjs[hi] = NULL;
> +		return retval;
>  	}
>  
>  	if (h->demote_order) {
> -- 
> 2.23.0
>