[PATCH] mm/huge_memory: fix memory leak when kobject_init_and_add() fails

[PATCH] mm/huge_memory: fix memory leak when kobject_init_and_add() fails

[ranxiaokai627]

From: Ran Xiaokai <ran.xiaokai@zte.com.cn>

As documented in the comments for kobject_init_and_add():

"If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object.  This is the
same type of error handling after a call to kobject_add() and kobject
lifetime rules are the same here."

This is because kobject_init_and_add() may have already allocated memory
internally for the kobject name (kobj->name), and leaving the refcount
at 1 prevents its release callback from being triggered.

Fixes: 3485b88390b0a ("mm: thp: introduce multi-size THP sysfs interface")
Signed-off-by: Ran Xiaokai <ran.xiaokai@zte.com.cn>
---
 mm/huge_memory.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 653f2dc03403..601750dbe79f 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -790,11 +790,8 @@ static struct thpsize *thpsize_create(int order, struct kobject *parent)
 
 	ret = kobject_init_and_add(&thpsize->kobj, &thpsize_ktype, parent,
 				   "hugepages-%lukB", size);
-	if (ret) {
-		kfree(thpsize);
-		goto err;
-	}
-
+	if (ret)
+		goto err_put;
 
 	ret = sysfs_add_group(&thpsize->kobj, &any_ctrl_attr_grp);
 	if (ret)
-- 
2.25.1

Re: [PATCH] mm/huge_memory: fix memory leak when kobject_init_and_add() fails

[David Hildenbrand (Arm)]

On 6/9/26 15:12, ranxiaokai627@163.com wrote:
> From: Ran Xiaokai <ran.xiaokai@zte.com.cn>
> 
> As documented in the comments for kobject_init_and_add():
> 
> "If this function returns an error, kobject_put() must be called to
> properly clean up the memory associated with the object.  This is the
> same type of error handling after a call to kobject_add() and kobject
> lifetime rules are the same here."
> 
> This is because kobject_init_and_add() may have already allocated memory
> internally for the kobject name (kobj->name), and leaving the refcount
> at 1 prevents its release callback from being triggered.
> 
> Fixes: 3485b88390b0a ("mm: thp: introduce multi-size THP sysfs interface")
> Signed-off-by: Ran Xiaokai <ran.xiaokai@zte.com.cn>
> ---
>  mm/huge_memory.c | 7 ++-----
>  1 file changed, 2 insertions(+), 5 deletions(-)
> 
> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> index 653f2dc03403..601750dbe79f 100644
> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c
> @@ -790,11 +790,8 @@ static struct thpsize *thpsize_create(int order, struct kobject *parent)
>  
>  	ret = kobject_init_and_add(&thpsize->kobj, &thpsize_ktype, parent,
>  				   "hugepages-%lukB", size);
> -	if (ret) {
> -		kfree(thpsize);
> -		goto err;
> -	}
> -
> +	if (ret)
> +		goto err_put;
>  
>  	ret = sysfs_add_group(&thpsize->kobj, &any_ctrl_attr_grp);
>  	if (ret)

This looks a lot like:

https://lore.kernel.org/all/20260411062152.2092967-1-lgs201920130244@gmail.com/

-- 
Cheers,

David

Re: [PATCH] mm/huge_memory: fix memory leak when kobject_init_and_add() fails

[Lance Yang]

On 2026/6/9 21:19, David Hildenbrand (Arm) wrote:
> On 6/9/26 15:12, ranxiaokai627@163.com wrote:
>> From: Ran Xiaokai <ran.xiaokai@zte.com.cn>
>>
>> As documented in the comments for kobject_init_and_add():
>>
>> "If this function returns an error, kobject_put() must be called to
>> properly clean up the memory associated with the object.  This is the
>> same type of error handling after a call to kobject_add() and kobject
>> lifetime rules are the same here."
>>
>> This is because kobject_init_and_add() may have already allocated memory
>> internally for the kobject name (kobj->name), and leaving the refcount
>> at 1 prevents its release callback from being triggered.
>>
>> Fixes: 3485b88390b0a ("mm: thp: introduce multi-size THP sysfs interface")
>> Signed-off-by: Ran Xiaokai <ran.xiaokai@zte.com.cn>
>> ---
>>   mm/huge_memory.c | 7 ++-----
>>   1 file changed, 2 insertions(+), 5 deletions(-)
>>
>> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
>> index 653f2dc03403..601750dbe79f 100644
>> --- a/mm/huge_memory.c
>> +++ b/mm/huge_memory.c
>> @@ -790,11 +790,8 @@ static struct thpsize *thpsize_create(int order, struct kobject *parent)
>>   
>>   	ret = kobject_init_and_add(&thpsize->kobj, &thpsize_ktype, parent,
>>   				   "hugepages-%lukB", size);
>> -	if (ret) {
>> -		kfree(thpsize);
>> -		goto err;
>> -	}
>> -
>> +	if (ret)
>> +		goto err_put;
>>   
>>   	ret = sysfs_add_group(&thpsize->kobj, &any_ctrl_attr_grp);
>>   	if (ret)
> 
> This looks a lot like:
> 
> https://lore.kernel.org/all/20260411062152.2092967-1-lgs201920130244@gmail.com/

Right, the same issue :) There is a v2:

https://lore.kernel.org/linux-mm/20260412175428.2613383-1-lgs201920130244@gmail.com/

Still pending, though ...

Re: [PATCH] mm/huge_memory: fix memory leak when kobject_init_and_add() fails

[Lorenzo Stoakes]

On Tue, Jun 09, 2026 at 10:04:16PM +0800, Lance Yang wrote:
>
>
> On 2026/6/9 21:19, David Hildenbrand (Arm) wrote:
> > On 6/9/26 15:12, ranxiaokai627@163.com wrote:
> > > From: Ran Xiaokai <ran.xiaokai@zte.com.cn>
> > >
> > > As documented in the comments for kobject_init_and_add():
> > >
> > > "If this function returns an error, kobject_put() must be called to
> > > properly clean up the memory associated with the object.  This is the
> > > same type of error handling after a call to kobject_add() and kobject
> > > lifetime rules are the same here."
> > >
> > > This is because kobject_init_and_add() may have already allocated memory
> > > internally for the kobject name (kobj->name), and leaving the refcount
> > > at 1 prevents its release callback from being triggered.
> > >
> > > Fixes: 3485b88390b0a ("mm: thp: introduce multi-size THP sysfs interface")
> > > Signed-off-by: Ran Xiaokai <ran.xiaokai@zte.com.cn>
> > > ---
> > >   mm/huge_memory.c | 7 ++-----
> > >   1 file changed, 2 insertions(+), 5 deletions(-)
> > >
> > > diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> > > index 653f2dc03403..601750dbe79f 100644
> > > --- a/mm/huge_memory.c
> > > +++ b/mm/huge_memory.c
> > > @@ -790,11 +790,8 @@ static struct thpsize *thpsize_create(int order, struct kobject *parent)
> > >   	ret = kobject_init_and_add(&thpsize->kobj, &thpsize_ktype, parent,
> > >   				   "hugepages-%lukB", size);
> > > -	if (ret) {
> > > -		kfree(thpsize);
> > > -		goto err;
> > > -	}
> > > -
> > > +	if (ret)
> > > +		goto err_put;
> > >   	ret = sysfs_add_group(&thpsize->kobj, &any_ctrl_attr_grp);
> > >   	if (ret)
> >
> > This looks a lot like:
> >
> > https://lore.kernel.org/all/20260411062152.2092967-1-lgs201920130244@gmail.com/
>
> Right, the same issue :) There is a v2:
>
> https://lore.kernel.org/linux-mm/20260412175428.2613383-1-lgs201920130244@gmail.com/
>
> Still pending, though ...

If people could use my actual correct email address it might not have been
pending :) *grumble*

Re: [PATCH] mm/huge_memory: fix memory leak when kobject_init_and_add() fails

[SeongJae Park]

+ Guangshuo

On Tue, 9 Jun 2026 22:04:16 +0800 Lance Yang <lance.yang@linux.dev> wrote:

> 
> 
> On 2026/6/9 21:19, David Hildenbrand (Arm) wrote:
> > On 6/9/26 15:12, ranxiaokai627@163.com wrote:
> >> From: Ran Xiaokai <ran.xiaokai@zte.com.cn>
> >>
> >> As documented in the comments for kobject_init_and_add():
> >>
> >> "If this function returns an error, kobject_put() must be called to
> >> properly clean up the memory associated with the object.  This is the
> >> same type of error handling after a call to kobject_add() and kobject
> >> lifetime rules are the same here."
> >>
> >> This is because kobject_init_and_add() may have already allocated memory
> >> internally for the kobject name (kobj->name), and leaving the refcount
> >> at 1 prevents its release callback from being triggered.
> >>
> >> Fixes: 3485b88390b0a ("mm: thp: introduce multi-size THP sysfs interface")
> >> Signed-off-by: Ran Xiaokai <ran.xiaokai@zte.com.cn>
> >> ---
> >>   mm/huge_memory.c | 7 ++-----
> >>   1 file changed, 2 insertions(+), 5 deletions(-)
> >>
> >> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> >> index 653f2dc03403..601750dbe79f 100644
> >> --- a/mm/huge_memory.c
> >> +++ b/mm/huge_memory.c
> >> @@ -790,11 +790,8 @@ static struct thpsize *thpsize_create(int order, struct kobject *parent)
> >>   
> >>   	ret = kobject_init_and_add(&thpsize->kobj, &thpsize_ktype, parent,
> >>   				   "hugepages-%lukB", size);
> >> -	if (ret) {
> >> -		kfree(thpsize);
> >> -		goto err;
> >> -	}
> >> -
> >> +	if (ret)
> >> +		goto err_put;
> >>   
> >>   	ret = sysfs_add_group(&thpsize->kobj, &any_ctrl_attr_grp);
> >>   	if (ret)
> > 
> > This looks a lot like:
> > 
> > https://lore.kernel.org/all/20260411062152.2092967-1-lgs201920130244@gmail.com/
> 
> Right, the same issue :) There is a v2:
> 
> https://lore.kernel.org/linux-mm/20260412175428.2613383-1-lgs201920130244@gmail.com/
> 
> Still pending, though ...

I added the author of the patch (Guangshuo) to the recipients list of this
mail, because they may better to aware of this.


Thanks,
SJ