Re: [PATCH] RDMA/rtrs-clt: Fix double free on path sysfs failure

[Guangshuo Li]

Hi Leon,

Thanks for reviewing.

On Sun, 19 Jul 2026 at 17:26, Leon Romanovsky <leon@xxxxxxxxxx> wrote:
>
> On Sat, Jul 18, 2026 at 02:55:02PM +0800, Guangshuo Li wrote:
> > Hi Leon,
> >
> > Thanks for reviewing.
> >
> > On Wed, 15 Jul 2026 at 16:17, Leon Romanovsky <leon@xxxxxxxxxx> wrote:
> > >
> > > On Tue, Jul 14, 2026 at 10:28:38PM +0800, Guangshuo Li wrote:
> > > > alloc_path() allocates clt_path before rtrs_clt_create_path_files()
> > > > initializes its embedded kobject.
> > > >
> > > > If path sysfs creation fails, rtrs_clt_create_path_files() calls
> > > > kobject_put(). The final reference invokes rtrs_clt_path_release(),
> > > > which calls free_path() and frees clt_path for the first time.
> > > >
> > > > After the helper returns, both rtrs_clt_open() and
> > > > rtrs_clt_create_path_from_sysfs() continue to access clt_path and call
> > > > free_path() again, resulting in a use-after-free and double free.
> > > >
> > > > Let the sysfs helper undo the sysfs and stats setup while retaining the
> > > > path kobject reference. After removing the path and closing its
> > > > connections, release that reference with kobject_put() so
> > > > rtrs_clt_path_release() remains the sole owner of the final free.
> > > >
> > > > This issue was found by a static analysis tool I am developing.
> > > >
> > > > Fixes: 7ecd7e290bee ("RDMA/rtrs-clt: Fix memory leak of not-freed sess->stats and stats->pcpu_stats")
> > > > Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
> > > > ---
> > > >  drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c | 20 +++++++++++++++-----
> > > >  drivers/infiniband/ulp/rtrs/rtrs-clt.c       | 12 +++++++++---
> > > >  2 files changed, 24 insertions(+), 8 deletions(-)
> > >
> > >
> > > We have already discussed this multiple times. What is still
> > > missing?
> > > https://lore.kernel.org/linux-rdma/20260428105515.362051-1-lgs201920130244@xxxxxxxxx/
> > > https://lore.kernel.org/linux-rdma/20260511130804.773204-1-lgs201920130244@xxxxxxxxx/
> > > https://lore.kernel.org/linux-rdma/20260514113834.865530-1-lgs201920130244@xxxxxxxxx/
> > >
> > > Thanks
> >
> > The previous discussions addressed the server-side path,
> > rtrs_srv_create_path_files(), involving struct rtrs_srv_path.
> >
> > This patch addresses a different client-side failure path in
> > rtrs_clt_create_path_files(), involving struct rtrs_clt_path. Here,
> > the helper may release clt_path through kobject_put(), while its
> > callers continue to access and free the same object, resulting in a UAF
> > and double free.
> >
> > Although both issues involve kobject lifetime handling, the affected
> > object and call path are different.
> >
> > Sorry that I did not make this distinction clear enough in the commit
> > message.
>
> You likely need to apply the same fix as in the srv patch.
>
> Thanks
>
> >
> > Thanks,
> > Guangshuo

 I will prepare and send a v2 following your suggestion.

Thanks,
Guangshuo