Re: [PATCH 09/11] ubifs: sysfs: Use kset_create_and_add() for ubifs_kset

[Zhihao Cheng <chengzhihao1@xxxxxxxxxx>]

在 2026/10/14 6:39, Ian Rogers 写道:
> ubifs_kset was a static struct kset using a custom ubifs_ktype that
> had no default_groups and no .release callback. With
> CONFIG_DEBUG_KOBJECT_RELEASE=y, unloading the ubifs module while delayed
> kobject release is pending causes a use-after-free on the static kset.
>
> Replace the static ubifs_kset and empty ubifs_ktype with a dynamically
> allocated kset via kset_create_and_add().
>
> Fixes: 203a55f04f66 ("ubifs: Fix memory leak in ubifs_sysfs_init()")
> Assisted-by: Antigravity:gemini-3.1-pro
> Signed-off-by: Ian Rogers <irogers@xxxxxxxxxx>
> ---
>   fs/ubifs/sysfs.c | 24 +++++++-----------------
>   1 file changed, 7 insertions(+), 17 deletions(-)
Tested-by: Zhihao Cheng <chengzhihao1@xxxxxxxxxx>
Reviewed-by: Zhihao Cheng <chengzhihao1@xxxxxxxxxx>
> diff --git a/fs/ubifs/sysfs.c b/fs/ubifs/sysfs.c
> index dbf967dcf26e..e20931e3a62f 100644
> --- a/fs/ubifs/sysfs.c
> +++ b/fs/ubifs/sysfs.c
> @@ -80,13 +80,7 @@ static const struct kobj_type ubifs_sb_ktype = {
>         .release        = ubifs_sb_release,
>   };
>   
> -static const struct kobj_type ubifs_ktype = {
> -       .sysfs_ops      = &ubifs_attr_ops,
> -};
> -
> -static struct kset ubifs_kset = {
> -       .kobj   = {.ktype = &ubifs_ktype},
> -};
> +static struct kset *ubifs_kset;
>   
>   int ubifs_sysfs_register(struct ubifs_info *c)
>   {
> @@ -107,7 +101,7 @@ int ubifs_sysfs_register(struct ubifs_info *c)
>                 goto out_free;
>         }
>   
> -	c->kobj.kset = &ubifs_kset;
> +       c->kobj.kset = ubifs_kset;
>         init_completion(&c->kobj_unregister);
>   
>   	ret = kobject_init_and_add(&c->kobj, &ubifs_sb_ktype, NULL,
> @@ -139,18 +133,14 @@ void ubifs_sysfs_unregister(struct ubifs_info *c)
>   
>   int __init ubifs_sysfs_init(void)
>   {
> -       int ret;
> +       ubifs_kset = kset_create_and_add("ubifs", NULL, fs_kobj);
> +       if (!ubifs_kset)
> +               return -ENOMEM;
>   
> -	kobject_set_name(&ubifs_kset.kobj, "ubifs");
> -       ubifs_kset.kobj.parent = fs_kobj;
> -       ret = kset_register(&ubifs_kset);
> -       if (ret)
> -               kset_put(&ubifs_kset);
> -
> -       return ret;
> +       return 0;
>   }
>   
>   void ubifs_sysfs_exit(void)
>   {
> -       kset_unregister(&ubifs_kset);
> +       kset_unregister(ubifs_kset);
>   }