]> git.ipfire.org Git - thirdparty/kernel/stable.git/commitdiff
f2fs: fix uninitialized kobject put in f2fs_init_sysfs()
authorGuangshuo Li <lgs201920130244@gmail.com>
Fri, 10 Apr 2026 12:47:26 +0000 (20:47 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 14 May 2026 13:31:18 +0000 (15:31 +0200)
commit b635f2ecdb5ad34f9c967cabb704d6bed9382fd0 upstream.

In f2fs_init_sysfs(), all failure paths after kset_register() jump to
put_kobject, which unconditionally releases both f2fs_tune and
f2fs_feat.

If kobject_init_and_add(&f2fs_feat, ...) fails, f2fs_tune has not been
initialized yet, so calling kobject_put(&f2fs_tune) is invalid.

Fix this by splitting the unwind path so each error path only releases
objects that were successfully initialized.

Fixes: a907f3a68ee26ba4 ("f2fs: add a sysfs entry to reclaim POSIX_FADV_NOREUSE pages")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/f2fs/sysfs.c

index 5fbfdc96e502d60c800f9ed8632a7c11b2e7e9e3..cd1921edb59effa1a7b77a95e3766172cfe099e8 100644 (file)
@@ -1984,24 +1984,26 @@ int __init f2fs_init_sysfs(void)
        ret = kobject_init_and_add(&f2fs_feat, &f2fs_feat_ktype,
                                   NULL, "features");
        if (ret)
-               goto put_kobject;
+               goto unregister_kset;
 
        ret = kobject_init_and_add(&f2fs_tune, &f2fs_tune_ktype,
                                   NULL, "tuning");
        if (ret)
-               goto put_kobject;
+               goto put_feat;
 
        f2fs_proc_root = proc_mkdir("fs/f2fs", NULL);
        if (!f2fs_proc_root) {
                ret = -ENOMEM;
-               goto put_kobject;
+               goto put_tune;
        }
 
        return 0;
 
-put_kobject:
+put_tune:
        kobject_put(&f2fs_tune);
+put_feat:
        kobject_put(&f2fs_feat);
+unregister_kset:
        kset_unregister(&f2fs_kset);
        return ret;
 }