[PATCH 09/11] ubifs: sysfs: Use kset_create_and_add() for ubifs_kset

[Ian Rogers]

ubifs_kset was a static struct kset using a custom ubifs_ktype that
had no default_groups and no .release callback. With
CONFIG_DEBUG_KOBJECT_RELEASE=y, unloading the ubifs module while delayed
kobject release is pending causes a use-after-free on the static kset.

Replace the static ubifs_kset and empty ubifs_ktype with a dynamically
allocated kset via kset_create_and_add().

Fixes: 203a55f04f66 ("ubifs: Fix memory leak in ubifs_sysfs_init()")
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irog...@google.com>
---
 fs/ubifs/sysfs.c | 24 +++++++-----------------
 1 file changed, 7 insertions(+), 17 deletions(-)

diff --git a/fs/ubifs/sysfs.c b/fs/ubifs/sysfs.c
index dbf967dcf26e..e20931e3a62f 100644
--- a/fs/ubifs/sysfs.c
+++ b/fs/ubifs/sysfs.c
@@ -80,13 +80,7 @@ static const struct kobj_type ubifs_sb_ktype = {
        .release        = ubifs_sb_release,
 };
 
-static const struct kobj_type ubifs_ktype = {
-       .sysfs_ops      = &ubifs_attr_ops,
-};
-
-static struct kset ubifs_kset = {
-       .kobj   = {.ktype = &ubifs_ktype},
-};
+static struct kset *ubifs_kset;
 
 int ubifs_sysfs_register(struct ubifs_info *c)
 {
@@ -107,7 +101,7 @@ int ubifs_sysfs_register(struct ubifs_info *c)
                goto out_free;
        }
 
-       c->kobj.kset = &ubifs_kset;
+       c->kobj.kset = ubifs_kset;
        init_completion(&c->kobj_unregister);
 
        ret = kobject_init_and_add(&c->kobj, &ubifs_sb_ktype, NULL,
@@ -139,18 +133,14 @@ void ubifs_sysfs_unregister(struct ubifs_info *c)
 
 int __init ubifs_sysfs_init(void)
 {
-       int ret;
+       ubifs_kset = kset_create_and_add("ubifs", NULL, fs_kobj);
+       if (!ubifs_kset)
+               return -ENOMEM;
 
-       kobject_set_name(&ubifs_kset.kobj, "ubifs");
-       ubifs_kset.kobj.parent = fs_kobj;
-       ret = kset_register(&ubifs_kset);
-       if (ret)
-               kset_put(&ubifs_kset);
-
-       return ret;
+       return 0;
 }
 
 void ubifs_sysfs_exit(void)
 {
-       kset_unregister(&ubifs_kset);
+       kset_unregister(ubifs_kset);
 }
-- 
2.56.0.385.gd3acb90ef8-goog