Re: [PATCH 09/11] ubifs: sysfs: Use kset_create_and_add() for ubifs_kset

[Zhihao Cheng]

在 2026/10/14 6:39, Ian Rogers 写道:

ubifs_kset was a static struct kset using a custom ubifs_ktype that
had no default_groups and no .release callback. With
CONFIG_DEBUG_KOBJECT_RELEASE=y, unloading the ubifs module while delayed
kobject release is pending causes a use-after-free on the static kset.

Replace the static ubifs_kset and empty ubifs_ktype with a dynamically
allocated kset via kset_create_and_add().

Fixes: 203a55f04f66 ("ubifs: Fix memory leak in ubifs_sysfs_init()")
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irog...@google.com>
---
  fs/ubifs/sysfs.c | 24 +++++++-----------------
  1 file changed, 7 insertions(+), 17 deletions(-)

Tested-by: Zhihao Cheng <chengzhih...@huawei.com>
Reviewed-by: Zhihao Cheng <chengzhih...@huawei.com>

diff --git a/fs/ubifs/sysfs.c b/fs/ubifs/sysfs.c
index dbf967dcf26e..e20931e3a62f 100644
--- a/fs/ubifs/sysfs.c
+++ b/fs/ubifs/sysfs.c
@@ -80,13 +80,7 @@ static const struct kobj_type ubifs_sb_ktype = {
        .release        = ubifs_sb_release,
  };

-static const struct kobj_type ubifs_ktype = {

-       .sysfs_ops      = &ubifs_attr_ops,
-};
-
-static struct kset ubifs_kset = {
-       .kobj   = {.ktype = &ubifs_ktype},
-};
+static struct kset *ubifs_kset;

int ubifs_sysfs_register(struct ubifs_info *c)

  {
@@ -107,7 +101,7 @@ int ubifs_sysfs_register(struct ubifs_info *c)
                goto out_free;
        }

- c->kobj.kset = &ubifs_kset;

+       c->kobj.kset = ubifs_kset;
        init_completion(&c->kobj_unregister);

ret = kobject_init_and_add(&c->kobj, &ubifs_sb_ktype, NULL,

@@ -139,18 +133,14 @@ void ubifs_sysfs_unregister(struct ubifs_info *c)

int __init ubifs_sysfs_init(void)

  {
-       int ret;
+       ubifs_kset = kset_create_and_add("ubifs", NULL, fs_kobj);
+       if (!ubifs_kset)
+               return -ENOMEM;

- kobject_set_name(&ubifs_kset.kobj, "ubifs");

-       ubifs_kset.kobj.parent = fs_kobj;
-       ret = kset_register(&ubifs_kset);
-       if (ret)
-               kset_put(&ubifs_kset);
-
-       return ret;
+       return 0;
  }

void ubifs_sysfs_exit(void)

  {
-       kset_unregister(&ubifs_kset);
+       kset_unregister(ubifs_kset);
  }