After kobject_init_and_add(), the lifetime of the embedded struct
kobject is expected to be managed through the kobject core reference
counting.

In thpsize_create(), if kobject_init_and_add() fails, thpsize is freed
directly with kfree() rather than releasing the kobject reference with
kobject_put(). This may leave the reference count of the embedded struct
kobject unbalanced, resulting in a refcount leak and potentially leading
to a use-after-free.

Fix this by using kobject_put(&thpsize->kobj) in the failure path and
letting thpsize_release() handle the final cleanup.

Fixes: 3485b88390b0 ("mm: thp: introduce multi-size THP sysfs interface")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 mm/huge_memory.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 40cf59301c21..ae6ed483cd53 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -726,11 +726,8 @@ static struct thpsize *thpsize_create(int order, struct kobject *parent)
 
 	ret = kobject_init_and_add(&thpsize->kobj, &thpsize_ktype, parent,
 				   "hugepages-%lukB", size);
-	if (ret) {
-		kfree(thpsize);
-		goto err;
-	}
-
+	if (ret)
+		goto err_put;
 
 	ret = sysfs_add_group(&thpsize->kobj, &any_ctrl_attr_grp);
 	if (ret)
-- 
2.43.0

On 11 Apr 2026, at 2:21, Guangshuo Li wrote:

> After kobject_init_and_add(), the lifetime of the embedded struct
> kobject is expected to be managed through the kobject core reference
> counting.
>
> In thpsize_create(), if kobject_init_and_add() fails, thpsize is freed
> directly with kfree() rather than releasing the kobject reference with
> kobject_put(). This may leave the reference count of the embedded struct
> kobject unbalanced, resulting in a refcount leak and potentially leading
> to a use-after-free.
>
> Fix this by using kobject_put(&thpsize->kobj) in the failure path and
> letting thpsize_release() handle the final cleanup.
>
> Fixes: 3485b88390b0 ("mm: thp: introduce multi-size THP sysfs interface")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  mm/huge_memory.c | 7 ++-----
>  1 file changed, 2 insertions(+), 5 deletions(-)
>
LGTM.

Reviewed-by: Zi Yan <ziy@nvidia.com>


--
Best Regards,
Yan, Zi

On Sat, Apr 11, 2026 at 02:21:52PM +0800, Guangshuo Li wrote:
>After kobject_init_and_add(), the lifetime of the embedded struct
>kobject is expected to be managed through the kobject core reference
>counting.
>
>In thpsize_create(), if kobject_init_and_add() fails, thpsize is freed
>directly with kfree() rather than releasing the kobject reference with
>kobject_put(). This may leave the reference count of the embedded struct

Right. As documented for kobject_init_and_add(), once it has been
called, the error path should go through kobject_put():

/**
 * kobject_init_and_add() - Initialize a kobject structure and add it to
 *                          the kobject hierarchy.
...
 *
 * This function combines the call to kobject_init() and kobject_add().
 *
 * If this function returns an error, kobject_put() must be called to
 * properly clean up the memory associated with the object.  This is the
...
 */
int kobject_init_and_add(struct kobject *kobj, const struct kobj_type *ktype,
			 struct kobject *parent, const char *fmt, ...)

>kobject unbalanced, resulting in a refcount leak and potentially leading
>to a use-after-free.

IIUC, this looks more like wrong kobject lifetime handling and likely a
leak, not a clear UAF :)

>Fix this by using kobject_put(&thpsize->kobj) in the failure path and
>letting thpsize_release() handle the final cleanup.
>
>Fixes: 3485b88390b0 ("mm: thp: introduce multi-size THP sysfs interface")
>Cc: stable@vger.kernel.org
>Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
>---

Apart from that, LGTM.
Reviewed-by: Lance Yang <lance.yang@linux.dev>

On 11 Apr 2026, at 10:28, Lance Yang wrote:

> On Sat, Apr 11, 2026 at 02:21:52PM +0800, Guangshuo Li wrote:
>> After kobject_init_and_add(), the lifetime of the embedded struct
>> kobject is expected to be managed through the kobject core reference
>> counting.
>>
>> In thpsize_create(), if kobject_init_and_add() fails, thpsize is freed
>> directly with kfree() rather than releasing the kobject reference with
>> kobject_put(). This may leave the reference count of the embedded struct
>
> Right. As documented for kobject_init_and_add(), once it has been
> called, the error path should go through kobject_put():
>
> /**
>  * kobject_init_and_add() - Initialize a kobject structure and add it to
>  *                          the kobject hierarchy.
> ...
>  *
>  * This function combines the call to kobject_init() and kobject_add().
>  *
>  * If this function returns an error, kobject_put() must be called to
>  * properly clean up the memory associated with the object.  This is the
> ...
>  */
> int kobject_init_and_add(struct kobject *kobj, const struct kobj_type *ktype,
> 			 struct kobject *parent, const char *fmt, ...)
>
>> kobject unbalanced, resulting in a refcount leak and potentially leading
>> to a use-after-free.
>
> IIUC, this looks more like wrong kobject lifetime handling and likely a
> leak, not a clear UAF :)

kobject_put() ends up with calling kobj_type->release(), which is just
kfree(to_thpsize(kobj)), equivalent to kfree(thpsize) in the old code.
IIUC, there is no leak. Let me know if I miss anything.

>
>> Fix this by using kobject_put(&thpsize->kobj) in the failure path and
>> letting thpsize_release() handle the final cleanup.
>>
>> Fixes: 3485b88390b0 ("mm: thp: introduce multi-size THP sysfs interface")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
>> ---
>
> Apart from that, LGTM.
> Reviewed-by: Lance Yang <lance.yang@linux.dev>


--
Best Regards,
Yan, Zi

On 2026/4/12 09:49, Zi Yan wrote:
> On 11 Apr 2026, at 10:28, Lance Yang wrote:
> 
>> On Sat, Apr 11, 2026 at 02:21:52PM +0800, Guangshuo Li wrote:
>>> After kobject_init_and_add(), the lifetime of the embedded struct
>>> kobject is expected to be managed through the kobject core reference
>>> counting.
>>>
>>> In thpsize_create(), if kobject_init_and_add() fails, thpsize is freed
>>> directly with kfree() rather than releasing the kobject reference with
>>> kobject_put(). This may leave the reference count of the embedded struct
>>
>> Right. As documented for kobject_init_and_add(), once it has been
>> called, the error path should go through kobject_put():
>>
>> /**
>>   * kobject_init_and_add() - Initialize a kobject structure and add it to
>>   *                          the kobject hierarchy.
>> ...
>>   *
>>   * This function combines the call to kobject_init() and kobject_add().
>>   *
>>   * If this function returns an error, kobject_put() must be called to
>>   * properly clean up the memory associated with the object.  This is the
>> ...
>>   */
>> int kobject_init_and_add(struct kobject *kobj, const struct kobj_type *ktype,
>> 			 struct kobject *parent, const char *fmt, ...)
>>
>>> kobject unbalanced, resulting in a refcount leak and potentially leading
>>> to a use-after-free.
>>
>> IIUC, this looks more like wrong kobject lifetime handling and likely a
>> leak, not a clear UAF :)
> 
> kobject_put() ends up with calling kobj_type->release(), which is just
> kfree(to_thpsize(kobj)), equivalent to kfree(thpsize) in the old code.
> IIUC, there is no leak. Let me know if I miss anything.

Right, the fix is correct. I was only commenting on the changelog
wording, especially:

"resulting in a refcount leak and potentially leading to a use-after-free"

The old code does skip the required kobject cleanup path, but is
a UAF actually possible there?

Just a wording nit.

On 11 Apr 2026, at 23:24, Lance Yang wrote:

> On 2026/4/12 09:49, Zi Yan wrote:
>> On 11 Apr 2026, at 10:28, Lance Yang wrote:
>>
>>> On Sat, Apr 11, 2026 at 02:21:52PM +0800, Guangshuo Li wrote:
>>>> After kobject_init_and_add(), the lifetime of the embedded struct
>>>> kobject is expected to be managed through the kobject core reference
>>>> counting.
>>>>
>>>> In thpsize_create(), if kobject_init_and_add() fails, thpsize is freed
>>>> directly with kfree() rather than releasing the kobject reference with
>>>> kobject_put(). This may leave the reference count of the embedded struct
>>>
>>> Right. As documented for kobject_init_and_add(), once it has been
>>> called, the error path should go through kobject_put():
>>>
>>> /**
>>>   * kobject_init_and_add() - Initialize a kobject structure and add it to
>>>   *                          the kobject hierarchy.
>>> ...
>>>   *
>>>   * This function combines the call to kobject_init() and kobject_add().
>>>   *
>>>   * If this function returns an error, kobject_put() must be called to
>>>   * properly clean up the memory associated with the object.  This is the
>>> ...
>>>   */
>>> int kobject_init_and_add(struct kobject *kobj, const struct kobj_type *ktype,
>>> 			 struct kobject *parent, const char *fmt, ...)
>>>
>>>> kobject unbalanced, resulting in a refcount leak and potentially leading
>>>> to a use-after-free.
>>>
>>> IIUC, this looks more like wrong kobject lifetime handling and likely a
>>> leak, not a clear UAF :)
>>
>> kobject_put() ends up with calling kobj_type->release(), which is just
>> kfree(to_thpsize(kobj)), equivalent to kfree(thpsize) in the old code.
>> IIUC, there is no leak. Let me know if I miss anything.
>
> Right, the fix is correct. I was only commenting on the changelog
> wording, especially:
>
> "resulting in a refcount leak and potentially leading to a use-after-free"
>
> The old code does skip the required kobject cleanup path, but is
> a UAF actually possible there?

That is my question too. The original code might not cause any real issue.

Guangshuo, let us know if we get it wrong. Thanks.

>
> Just a wording nit.


--
Best Regards,
Yan, Zi

On Sun, 12 Apr 2026 09:33:29 -0400 Zi Yan <ziy@nvidia.com> wrote:

> > wording, especially:
> >
> > "resulting in a refcount leak and potentially leading to a use-after-free"
> >
> > The old code does skip the required kobject cleanup path, but is
> > a UAF actually possible there?
> 
> That is my question too. The original code might not cause any real issue.
> 
> Guangshuo, let us know if we get it wrong. Thanks.

Thanks, all.  I queued this for testing and added a note that a
changlog update is expected.

Hi Lance, Zi,

Thanks for the review and for pointing this out.

You are right — that was my mistake in the changelog wording. After
rechecking the failure path more carefully, I do not think a
use-after-free can actually happen here. The real issue is that the
error path skips the proper kobject cleanup flow, so the problem is
better described as an unbalanced kobject reference / refcount
handling issue rather than a potential UAF.

I will update the commit message accordingly and send a v2 shortly.

Thanks,
Guangshuo

Zi Yan <ziy@nvidia.com> 于2026年4月12日周日 21:33写道：
>
> On 11 Apr 2026, at 23:24, Lance Yang wrote:
>
> > On 2026/4/12 09:49, Zi Yan wrote:
> >> On 11 Apr 2026, at 10:28, Lance Yang wrote:
> >>
> >>> On Sat, Apr 11, 2026 at 02:21:52PM +0800, Guangshuo Li wrote:
> >>>> After kobject_init_and_add(), the lifetime of the embedded struct
> >>>> kobject is expected to be managed through the kobject core reference
> >>>> counting.
> >>>>
> >>>> In thpsize_create(), if kobject_init_and_add() fails, thpsize is freed
> >>>> directly with kfree() rather than releasing the kobject reference with
> >>>> kobject_put(). This may leave the reference count of the embedded struct
> >>>
> >>> Right. As documented for kobject_init_and_add(), once it has been
> >>> called, the error path should go through kobject_put():
> >>>
> >>> /**
> >>>   * kobject_init_and_add() - Initialize a kobject structure and add it to
> >>>   *                          the kobject hierarchy.
> >>> ...
> >>>   *
> >>>   * This function combines the call to kobject_init() and kobject_add().
> >>>   *
> >>>   * If this function returns an error, kobject_put() must be called to
> >>>   * properly clean up the memory associated with the object.  This is the
> >>> ...
> >>>   */
> >>> int kobject_init_and_add(struct kobject *kobj, const struct kobj_type *ktype,
> >>>                      struct kobject *parent, const char *fmt, ...)
> >>>
> >>>> kobject unbalanced, resulting in a refcount leak and potentially leading
> >>>> to a use-after-free.
> >>>
> >>> IIUC, this looks more like wrong kobject lifetime handling and likely a
> >>> leak, not a clear UAF :)
> >>
> >> kobject_put() ends up with calling kobj_type->release(), which is just
> >> kfree(to_thpsize(kobj)), equivalent to kfree(thpsize) in the old code.
> >> IIUC, there is no leak. Let me know if I miss anything.
> >
> > Right, the fix is correct. I was only commenting on the changelog
> > wording, especially:
> >
> > "resulting in a refcount leak and potentially leading to a use-after-free"
> >
> > The old code does skip the required kobject cleanup path, but is
> > a UAF actually possible there?
>
> That is my question too. The original code might not cause any real issue.
>
> Guangshuo, let us know if we get it wrong. Thanks.
>
> >
> > Just a wording nit.
>
>
> --
> Best Regards,
> Yan, Zi

On Sat, Apr 11, 2026 at 2:22 PM Guangshuo Li <lgs201920130244@gmail.com> wrote:
>
> After kobject_init_and_add(), the lifetime of the embedded struct
> kobject is expected to be managed through the kobject core reference
> counting.
>
> In thpsize_create(), if kobject_init_and_add() fails, thpsize is freed
> directly with kfree() rather than releasing the kobject reference with
> kobject_put(). This may leave the reference count of the embedded struct
> kobject unbalanced, resulting in a refcount leak and potentially leading
> to a use-after-free.
>
> Fix this by using kobject_put(&thpsize->kobj) in the failure path and
> letting thpsize_release() handle the final cleanup.
>
> Fixes: 3485b88390b0 ("mm: thp: introduce multi-size THP sysfs interface")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>

I’m fine with the patch, but could you send a v2 to drop
the err label, which is no longer used? Alternatively,
could you rename err_put to err?

@@ -825,9 +825,8 @@ static struct thpsize *thpsize_create(int order,
struct kobject *parent)
        }

        return thpsize;
-err_put:
-       kobject_put(&thpsize->kobj);
 err:
+       kobject_put(&thpsize->kobj);
        return ERR_PTR(ret);
 }


> ---
>  mm/huge_memory.c | 7 ++-----
>  1 file changed, 2 insertions(+), 5 deletions(-)
>
> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> index 40cf59301c21..ae6ed483cd53 100644
> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c
> @@ -726,11 +726,8 @@ static struct thpsize *thpsize_create(int order, struct kobject *parent)
>
>         ret = kobject_init_and_add(&thpsize->kobj, &thpsize_ktype, parent,
>                                    "hugepages-%lukB", size);
> -       if (ret) {
> -               kfree(thpsize);
> -               goto err;
> -       }
> -
> +       if (ret)
> +               goto err_put;
>
>         ret = sysfs_add_group(&thpsize->kobj, &any_ctrl_attr_grp);
>         if (ret)
> --
> 2.43.0
>

On Sat, Apr 11, 2026 at 4:32 PM Barry Song <baohua@kernel.org> wrote:
>
> On Sat, Apr 11, 2026 at 2:22 PM Guangshuo Li <lgs201920130244@gmail.com> wrote:
> >
> > After kobject_init_and_add(), the lifetime of the embedded struct
> > kobject is expected to be managed through the kobject core reference
> > counting.
> >
> > In thpsize_create(), if kobject_init_and_add() fails, thpsize is freed
> > directly with kfree() rather than releasing the kobject reference with
> > kobject_put(). This may leave the reference count of the embedded struct
> > kobject unbalanced, resulting in a refcount leak and potentially leading
> > to a use-after-free.
> >
> > Fix this by using kobject_put(&thpsize->kobj) in the failure path and
> > letting thpsize_release() handle the final cleanup.
> >
> > Fixes: 3485b88390b0 ("mm: thp: introduce multi-size THP sysfs interface")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
>
> I’m fine with the patch, but could you send a v2 to drop
> the err label, which is no longer used? Alternatively,
> could you rename err_put to err?
>
> @@ -825,9 +825,8 @@ static struct thpsize *thpsize_create(int order,
> struct kobject *parent)
>         }
>
>         return thpsize;
> -err_put:
> -       kobject_put(&thpsize->kobj);
>  err:
> +       kobject_put(&thpsize->kobj);
>         return ERR_PTR(ret);
>  }

Sorry, my mistake—err is still used by kzalloc_obj.

Reviewed-by: Barry Song <baohua@kernel.org>

On 4/11/26 2:21 PM, Guangshuo Li wrote:
> After kobject_init_and_add(), the lifetime of the embedded struct
> kobject is expected to be managed through the kobject core reference
> counting.
> 
> In thpsize_create(), if kobject_init_and_add() fails, thpsize is freed
> directly with kfree() rather than releasing the kobject reference with
> kobject_put(). This may leave the reference count of the embedded struct
> kobject unbalanced, resulting in a refcount leak and potentially leading
> to a use-after-free.
> 
> Fix this by using kobject_put(&thpsize->kobj) in the failure path and
> letting thpsize_release() handle the final cleanup.
> 
> Fixes: 3485b88390b0 ("mm: thp: introduce multi-size THP sysfs interface")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---

Make sense to me.
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>