Re: [PATCH -next] bonding: Fix a use-after-free problem when bond_sysfs_slave_add() failed

Fixes: 7afcaec49696 (bonding: use kobject_put instead of _del after kobject_add)
Signed-off-by: Huang Guobin <redacted>
---
 drivers/net/bonding/bond_sysfs_slave.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/net/bonding/bond_sysfs_slave.c b/drivers/net/bonding/bond_sysfs_slave.c
index fd07561..d1a5b3f 100644
--- a/drivers/net/bonding/bond_sysfs_slave.c
+++ b/drivers/net/bonding/bond_sysfs_slave.c

@@ -137,18 +137,23 @@ static ssize_t slave_show(struct kobject *kobj,
 
 int bond_sysfs_slave_add(struct slave *slave)
 {
-	const struct slave_attribute **a;
+	const struct slave_attribute **a, **b;
 	int err;
 
 	for (a = slave_attrs; *a; ++a) {
 		err = sysfs_create_file(&slave->kobj, &((*a)->attr));
 		if (err) {
-			kobject_put(&slave->kobj);
-			return err;
+			goto err_remove_file;
 		}
 	}
 
 	return 0;
+
+err_remove_file:
+	for (b = slave_attrs; b < a; ++b)
+		sysfs_remove_file(&slave->kobj, &((*b)->attr));
+
+	return err;
 }