From 20dab9d72acdd2288d8a966a8e318274b1e26254 Mon Sep 17 00:00:00 2001 From: Hongling Zeng Date: Mon, 13 Jul 2026 13:41:54 +0800 Subject: [PATCH] mm: huge_memory: fix kobject cleanup in thpsize_create error When kobject_init_and_add() fails, the kobject API requires calling kobject_put() to properly clean up the memory, not direct kfree(). According to the kobject API documentation, kobject_init_and_add() calls kobject_init() internally. If the subsequent kobject_add() fails, the kobject has still been initialized and must be cleaned up via the reference count mechanism (kobject_put), not direct kfree(). Direct kfree() leaves the kobject's internal state (including the reference count and kset membership) uncleaned, which can cause: - Memory leaks of kobject internal structures - Potential use-after-free if there are pending references - Inconsistent state with the rest of the error handling code This fix matches the pattern used elsewhere in the kernel and in the same function (err_put label) which correctly uses kobject_put(). Link: https://lore.kernel.org/20260713054154.120915-1-zenghongling@kylinos.cn Fixes: 3485b88390b0 ("mm: thp: introduce multi-size THP sysfs interface") Signed-off-by: Hongling Zeng Suggested-by: Baolin Wang Reviewed-by: Lorenzo Stoakes (ARM) Acked-by: Zi Yan Reviewed-by: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Hongling Zeng Cc: Lance Yang Cc: Liam R. Howlett Cc: Nico Pache Cc: Ryan Roberts Signed-off-by: Andrew Morton --- mm/huge_memory.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index c615e81620b9..c61871b5a333 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -818,10 +818,8 @@ static struct thpsize *thpsize_create(int order, struct kobject *parent) ret = kobject_init_and_add(&thpsize->kobj, &thpsize_ktype, parent, "hugepages-%lukB", size); - if (ret) { - kfree(thpsize); - goto err; - } + if (ret) + goto err_put; ret = sysfs_add_group(&thpsize->kobj, &any_ctrl_attr_grp);