Re: [PATCH] mm: thp: Fix refcount leak in thpsize_create() error path

[Lance Yang]

On Sat, Apr 11, 2026 at 02:21:52PM +0800, Guangshuo Li wrote:
>After kobject_init_and_add(), the lifetime of the embedded struct
>kobject is expected to be managed through the kobject core reference
>counting.
>
>In thpsize_create(), if kobject_init_and_add() fails, thpsize is freed
>directly with kfree() rather than releasing the kobject reference with
>kobject_put(). This may leave the reference count of the embedded struct

Right. As documented for kobject_init_and_add(), once it has been
called, the error path should go through kobject_put():

/**
 * kobject_init_and_add() - Initialize a kobject structure and add it to
 *                          the kobject hierarchy.
...
 *
 * This function combines the call to kobject_init() and kobject_add().
 *
 * If this function returns an error, kobject_put() must be called to
 * properly clean up the memory associated with the object.  This is the
...
 */
int kobject_init_and_add(struct kobject *kobj, const struct kobj_type *ktype,
			 struct kobject *parent, const char *fmt, ...)

>kobject unbalanced, resulting in a refcount leak and potentially leading
>to a use-after-free.

IIUC, this looks more like wrong kobject lifetime handling and likely a
leak, not a clear UAF :)

>Fix this by using kobject_put(&thpsize->kobj) in the failure path and
>letting thpsize_release() handle the final cleanup.
>
>Fixes: 3485b88390b0 ("mm: thp: introduce multi-size THP sysfs interface")
>Cc: stable@xxxxxxxxxxxxxxx
>Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
>---

Apart from that, LGTM.
Reviewed-by: Lance Yang <lance.yang@xxxxxxxxx>