Re: [PATCH] RDMA/rtrs-clt: Fix double free on path sysfs failure

[Guangshuo Li]

Hi Leon,

Thanks for reviewing.

On Wed, 15 Jul 2026 at 16:17, Leon Romanovsky <leon@xxxxxxxxxx> wrote:
>
> On Tue, Jul 14, 2026 at 10:28:38PM +0800, Guangshuo Li wrote:
> > alloc_path() allocates clt_path before rtrs_clt_create_path_files()
> > initializes its embedded kobject.
> >
> > If path sysfs creation fails, rtrs_clt_create_path_files() calls
> > kobject_put(). The final reference invokes rtrs_clt_path_release(),
> > which calls free_path() and frees clt_path for the first time.
> >
> > After the helper returns, both rtrs_clt_open() and
> > rtrs_clt_create_path_from_sysfs() continue to access clt_path and call
> > free_path() again, resulting in a use-after-free and double free.
> >
> > Let the sysfs helper undo the sysfs and stats setup while retaining the
> > path kobject reference. After removing the path and closing its
> > connections, release that reference with kobject_put() so
> > rtrs_clt_path_release() remains the sole owner of the final free.
> >
> > This issue was found by a static analysis tool I am developing.
> >
> > Fixes: 7ecd7e290bee ("RDMA/rtrs-clt: Fix memory leak of not-freed sess->stats and stats->pcpu_stats")
> > Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
> > ---
> >  drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c | 20 +++++++++++++++-----
> >  drivers/infiniband/ulp/rtrs/rtrs-clt.c       | 12 +++++++++---
> >  2 files changed, 24 insertions(+), 8 deletions(-)
>
>
> We have already discussed this multiple times. What is still
> missing?
> https://lore.kernel.org/linux-rdma/20260428105515.362051-1-lgs201920130244@xxxxxxxxx/
> https://lore.kernel.org/linux-rdma/20260511130804.773204-1-lgs201920130244@xxxxxxxxx/
> https://lore.kernel.org/linux-rdma/20260514113834.865530-1-lgs201920130244@xxxxxxxxx/
>
> Thanks

The previous discussions addressed the server-side path,
rtrs_srv_create_path_files(), involving struct rtrs_srv_path.

This patch addresses a different client-side failure path in
rtrs_clt_create_path_files(), involving struct rtrs_clt_path. Here,
the helper may release clt_path through kobject_put(), while its
callers continue to access and free the same object, resulting in a UAF
and double free.

Although both issues involve kobject lifetime handling, the affected
object and call path are different.

Sorry that I did not make this distinction clear enough in the commit
message.

Thanks,
Guangshuo