[PATCH 09/11] ubifs: sysfs: Use kset_create_and_add() for ubifs_kset

[Zhihao Cheng]

在 2026/10/14 6:39, Ian Rogers 写道:
> ubifs_kset was a static struct kset using a custom ubifs_ktype that
> had no default_groups and no .release callback. With
> CONFIG_DEBUG_KOBJECT_RELEASE=y, unloading the ubifs module while delayed
> kobject release is pending causes a use-after-free on the static kset.
> 
> Replace the static ubifs_kset and empty ubifs_ktype with a dynamically
> allocated kset via kset_create_and_add().
> 
> Fixes: 203a55f04f66 ("ubifs: Fix memory leak in ubifs_sysfs_init()")
> Assisted-by: Antigravity:gemini-3.1-pro
> Signed-off-by: Ian Rogers <irogers at google.com>
> ---
>   fs/ubifs/sysfs.c | 24 +++++++-----------------
>   1 file changed, 7 insertions(+), 17 deletions(-)
> 

Tested-by: Zhihao Cheng <chengzhihao1 at huawei.com>
Reviewed-by: Zhihao Cheng <chengzhihao1 at huawei.com>
> diff --git a/fs/ubifs/sysfs.c b/fs/ubifs/sysfs.c
> index dbf967dcf26e..e20931e3a62f 100644
> --- a/fs/ubifs/sysfs.c
> +++ b/fs/ubifs/sysfs.c
> @@ -80,13 +80,7 @@ static const struct kobj_type ubifs_sb_ktype = {
>   	.release	= ubifs_sb_release,
>   };
>   
> -static const struct kobj_type ubifs_ktype = {
> -	.sysfs_ops	= &ubifs_attr_ops,
> -};
> -
> -static struct kset ubifs_kset = {
> -	.kobj	= {.ktype = &ubifs_ktype},
> -};
> +static struct kset *ubifs_kset;
>   
>   int ubifs_sysfs_register(struct ubifs_info *c)
>   {
> @@ -107,7 +101,7 @@ int ubifs_sysfs_register(struct ubifs_info *c)
>   		goto out_free;
>   	}
>   
> -	c->kobj.kset = &ubifs_kset;
> +	c->kobj.kset = ubifs_kset;
>   	init_completion(&c->kobj_unregister);
>   
>   	ret = kobject_init_and_add(&c->kobj, &ubifs_sb_ktype, NULL,
> @@ -139,18 +133,14 @@ void ubifs_sysfs_unregister(struct ubifs_info *c)
>   
>   int __init ubifs_sysfs_init(void)
>   {
> -	int ret;
> +	ubifs_kset = kset_create_and_add("ubifs", NULL, fs_kobj);
> +	if (!ubifs_kset)
> +		return -ENOMEM;
>   
> -	kobject_set_name(&ubifs_kset.kobj, "ubifs");
> -	ubifs_kset.kobj.parent = fs_kobj;
> -	ret = kset_register(&ubifs_kset);
> -	if (ret)
> -		kset_put(&ubifs_kset);
> -
> -	return ret;
> +	return 0;
>   }
>   
>   void ubifs_sysfs_exit(void)
>   {
> -	kset_unregister(&ubifs_kset);
> +	kset_unregister(ubifs_kset);
>   }
>