damon_sysfs_scheme_add_dirs() sets up the tried_regions directory after the stats directory has already been created. If damon_sysfs_scheme_set_tried_regions() fails, scheme->tried_regions has not been assigned. The error path nevertheless jumps to put_tried_regions_out and dereferences scheme->tried_regions while trying to put its kobject. This can dereference uninitialized memory because struct damon_sysfs_scheme is allocated with kmalloc-style allocation and scheme->tried_regions is only assigned after tried_regions setup succeeds. On tried_regions setup failure, start cleanup from the last successfully created directory, stats, instead of trying to put tried_regions. Fixes: 5181b75f438d ("mm/damon/sysfs-schemes: implement schemes/tried_regions directory") Signed-off-by: Guangshuo Li --- mm/damon/sysfs-schemes.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/mm/damon/sysfs-schemes.c b/mm/damon/sysfs-schemes.c index 329cfd0bbe9f..0668a0e53971 100644 --- a/mm/damon/sysfs-schemes.c +++ b/mm/damon/sysfs-schemes.c @@ -2516,12 +2516,12 @@ static int damon_sysfs_scheme_add_dirs(struct damon_sysfs_scheme *scheme) goto put_filters_watermarks_quotas_access_pattern_out; err = damon_sysfs_scheme_set_tried_regions(scheme); if (err) - goto put_tried_regions_out; + goto put_stats_out; return 0; -put_tried_regions_out: - kobject_put(&scheme->tried_regions->kobj); - scheme->tried_regions = NULL; +put_stats_out: + kobject_put(&scheme->stats->kobj); + scheme->stats = NULL; put_filters_watermarks_quotas_access_pattern_out: kobject_put(&scheme->ops_filters->kobj); scheme->ops_filters = NULL; -- 2.43.0