[to-be-updated] mm-thp-fix-refcount-leak-in-thpsize_create-error-path.patch removed from -mm tree

[to-be-updated] mm-thp-fix-refcount-leak-in-thpsize_create-error-path.patch removed from -mm tree

[Andrew Morton]

The quilt patch titled
     Subject: mm: thp: Fix refcount leak in thpsize_create() error path
has been removed from the -mm tree.  Its filename was
     mm-thp-fix-refcount-leak-in-thpsize_create-error-path.patch

This patch was dropped because an updated version will be issued

------------------------------------------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
Subject: mm: thp: Fix refcount leak in thpsize_create() error path
Date: Sat, 11 Apr 2026 14:21:52 +0800

After kobject_init_and_add(), the lifetime of the embedded struct
kobject is expected to be managed through the kobject core reference
counting.

In thpsize_create(), if kobject_init_and_add() fails, thpsize is freed
directly with kfree() rather than releasing the kobject reference with
kobject_put(). This may leave the reference count of the embedded struct
kobject unbalanced, resulting in a refcount leak and potentially leading
to a use-after-free.

Fix this by using kobject_put(&thpsize->kobj) in the failure path and
letting thpsize_release() handle the final cleanup.

Link: https://lkml.kernel.org/r/20260411062152.2092967-1-lgs201920130244@gmail.com
Fixes: 3485b88390b0 ("mm: thp: introduce multi-size THP sysfs interface")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Barry Song <baohua@kernel.org>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Nico Pache <npache@redhat.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/huge_memory.c |    7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

--- a/mm/huge_memory.c~mm-thp-fix-refcount-leak-in-thpsize_create-error-path
+++ a/mm/huge_memory.c
@@ -729,11 +729,8 @@ static struct thpsize *thpsize_create(in
 
 	ret = kobject_init_and_add(&thpsize->kobj, &thpsize_ktype, parent,
 				   "hugepages-%lukB", size);
-	if (ret) {
-		kfree(thpsize);
-		goto err;
-	}
-
+	if (ret)
+		goto err_put;
 
 	ret = sysfs_add_group(&thpsize->kobj, &any_ctrl_attr_grp);
 	if (ret)
_

Patches currently in -mm which might be from lgs201920130244@gmail.com are

device-dax-fix-refcount-leak-in-__devm_create_dev_dax-error-path.patch