[BUG] infiniband: rtrs: KASAN: slab-use-after-free in rtrs_clt_remove_path_from_arr

[Shuangpeng Bai]

Hi Kernel Maintainers,

I hit the following report while testing current upstream kernel:

KASAN: slab-use-after-free in rtrs_clt_remove_path_from_arr

on commit: fce2dfa773ced15f27dd27cd0b482a7473cdcf2a (2026-07-16)

The reproducer and .config files are here.
https://gist.github.com/shuangpengbai/5f48e1bbb0576eecdf8ec7a5fb6b138b

I'm happy to test debug patches or provide additional information.

Reported-by: Shuangpeng Bai <shuangpeng.kernel@xxxxxxxxx>

[ 1396.946778][ T8599] BUG: KASAN: slab-use-after-free in rtrs_clt_remove_path_from_arr (drivers/infiniband/ulp/rtrs/rtrs-clt.c:2236)
[ 1396.948953][ T8599] Read of size 8 at addr ffff88810fc7b2d8 by task bash/8599
[ 1396.953684][ T8599] Call Trace:
[ 1396.953694][ T8599]  <TASK>
[ 1396.953701][ T8599]  dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[ 1396.953716][ T8599]  print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
[ 1396.953748][ T8599]  kasan_report (mm/kasan/report.c:595)
[ 1396.953766][ T8599]  rtrs_clt_remove_path_from_arr (drivers/infiniband/ulp/rtrs/rtrs-clt.c:2236)
[ 1396.953786][ T8599]  rtrs_clt_create_path_from_sysfs (drivers/infiniband/ulp/rtrs/rtrs-clt.c:3158)
[ 1396.953792][ T8599]  add_path_store (drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c:187)
[ 1396.953852][ T8599]  kernfs_fop_write_iter (fs/kernfs/file.c:345)
[ 1396.953857][ T8599]  vfs_write (fs/read_write.c:595 fs/read_write.c:687)
[ 1396.953898][ T8599]  ksys_write (fs/read_write.c:739)
[ 1396.953921][ T8599]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[ 1396.953928][ T8599]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[ 1397.134599][ T8599] Freed by task 8599 on cpu 1 at 1396.942910s:
[ 1397.135348][ T8599]  kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
[ 1397.135942][ T8599]  kasan_save_free_info (mm/kasan/generic.c:584)
[ 1397.136539][ T8599]  __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
[ 1397.143207][ T8599]  kfree (include/linux/kasan.h:235 mm/slub.c:2705 mm/slub.c:6405 mm/slub.c:6720)
[ 1397.143701][ T8599]  kobject_put (lib/kobject.c:689 lib/kobject.c:720 include/linux/kref.h:65 lib/kobject.c:737)
[ 1397.144255][ T8599]  rtrs_clt_create_path_files (drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c:441)
[ 1397.144944][ T8599]  rtrs_clt_create_path_from_sysfs (drivers/infiniband/ulp/rtrs/rtrs-clt.c:3151)
[ 1397.145671][ T8599]  add_path_store (drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c:187)
[ 1397.159053][ T8599]  kernfs_fop_write_iter (fs/kernfs/file.c:345)
[ 1397.159699][ T8599]  vfs_write (fs/read_write.c:595 fs/read_write.c:687)
[ 1397.160233][ T8599]  ksys_write (fs/read_write.c:739)
[ 1397.160740][ T8599]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[ 1397.161333][ T8599]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[ 1397.174822][ T8599] The buggy address is located 728 bytes inside of
[ 1397.174822][ T8599]  freed 2048-byte region [ffff88810fc7b000, ffff88810fc7b800)


Best,
Shuangpeng