Re:Re: [PATCH] RDMA/rtrs: Fix potential use-after-free on client sysfs setup failure

[李广硕]

Hi Leon,

Thanks for reviewing.

From: Leon Romanovsky <leon@xxxxxxxxxx>
Date: 2026-11-09 19:16:52
To:  Guangshuo Li <liguangshuo@xxxxxxxxxxxxxxx>
Cc:  Jason Gunthorpe <jgg@xxxxxxxx>,stable@xxxxxxxxxxxxxxx,"Md. Haris Iqbal" <haris.iqbal@xxxxxxxxx>,Jack Wang <jinpu.wang@xxxxxxxxx>,linux-rdma@xxxxxxxxxxxxxxx,linux-kernel@xxxxxxxxxxxxxxx
Subject: Re: [PATCH] RDMA/rtrs: Fix potential use-after-free on client sysfs setup failure>On Sat, Oct 31, 2026 at 10:14:46PM +0800, Guangshuo Li wrote:
>> rtrs_clt_create_path_files() drops the path reference on failure, but
>> its callers still close connections and free the path. This can access
>> freed memory and free the path twice.
>
>Sorry, but how?
>
Consider an allocation failure while setting the name of the path
kobject in rtrs_clt_create_path_files(). kobject_init_and_add() has
already initialized the reference count to one when setting the name
fails with -ENOMEM. The stats kobject has not been created yet, and
adding the path to clt->paths_list did not take a kobject reference.

The error branch then calls kobject_put(&clt_path->kobj). This drops
the only reference. With CONFIG_DEBUG_KOBJECT_RELEASE=n,
rtrs_clt_path_release() runs synchronously and calls free_path(), which
does kfree(clt_path).

Back in rtrs_clt_open(), the first statement on that error path is:

        list_del_rcu(&clt_path->s.entry);

That accesses the list node embedded in the path that was just freed.
This is the use-after-free I meant.

Thanks,
Guangshuo