Re: [PATCH v2] mm: thp: Fix refcount leak in thpsize_create() error path

[Andrew Morton]

On Mon, 13 Apr 2026 01:54:28 +0800 Guangshuo Li <lgs201920130244@xxxxxxxxx> wrote:

> After kobject_init_and_add(), the lifetime of the embedded struct
> kobject is expected to be managed through the kobject core reference
> counting.
> 
> In thpsize_create(), if kobject_init_and_add() fails, thpsize is freed
> directly with kfree() rather than releasing the kobject reference with
> kobject_put(). This may leave the reference count of the embedded struct
> kobject unbalanced, resulting in a refcount leak.
> 
> Fix this by using kobject_put(&thpsize->kobj) in the failure path and
> letting thpsize_release() handle the final cleanup.

OK...

> 
> ...
>
> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c
> @@ -726,10 +726,8 @@ static struct thpsize *thpsize_create(int order, struct kobject *parent)
>  
>  	ret = kobject_init_and_add(&thpsize->kobj, &thpsize_ktype, parent,
>  				   "hugepages-%lukB", size);
> -	if (ret) {
> -		kfree(thpsize);
> +	if (ret)
>  		goto err;

So this should be goto err_put?

> -	}
>  
>  
>  	ret = sysfs_add_group(&thpsize->kobj, &any_ctrl_attr_grp);
> -- 
> 2.43.0