Re: [PATCH] RDMA/rtrs-clt: Fix double free on path sysfs failure

[Leon Romanovsky <leon@kernel.org>]

On Sat, Jul 18, 2026 at 02:55:02PM +0800, Guangshuo Li wrote:
> Hi Leon,
> 
> Thanks for reviewing.
> 
> On Wed, 15 Jul 2026 at 16:17, Leon Romanovsky <leon@kernel.org> wrote:
> >
> > On Tue, Jul 14, 2026 at 10:28:38PM +0800, Guangshuo Li wrote:
> > > alloc_path() allocates clt_path before rtrs_clt_create_path_files()
> > > initializes its embedded kobject.
> > >
> > > If path sysfs creation fails, rtrs_clt_create_path_files() calls
> > > kobject_put(). The final reference invokes rtrs_clt_path_release(),
> > > which calls free_path() and frees clt_path for the first time.
> > >
> > > After the helper returns, both rtrs_clt_open() and
> > > rtrs_clt_create_path_from_sysfs() continue to access clt_path and call
> > > free_path() again, resulting in a use-after-free and double free.
> > >
> > > Let the sysfs helper undo the sysfs and stats setup while retaining the
> > > path kobject reference. After removing the path and closing its
> > > connections, release that reference with kobject_put() so
> > > rtrs_clt_path_release() remains the sole owner of the final free.
> > >
> > > This issue was found by a static analysis tool I am developing.
> > >
> > > Fixes: 7ecd7e290bee ("RDMA/rtrs-clt: Fix memory leak of not-freed sess->stats and stats->pcpu_stats")
> > > Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> > > ---
> > >  drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c | 20 +++++++++++++++-----
> > >  drivers/infiniband/ulp/rtrs/rtrs-clt.c       | 12 +++++++++---
> > >  2 files changed, 24 insertions(+), 8 deletions(-)
> >
> >
> > We have already discussed this multiple times. What is still
> > missing?
> > https://lore.kernel.org/linux-rdma/20260428105515.362051-1-lgs201920130244@gmail.com/
> > https://lore.kernel.org/linux-rdma/20260511130804.773204-1-lgs201920130244@gmail.com/
> > https://lore.kernel.org/linux-rdma/20260514113834.865530-1-lgs201920130244@gmail.com/
> >
> > Thanks
> 
> The previous discussions addressed the server-side path,
> rtrs_srv_create_path_files(), involving struct rtrs_srv_path.
> 
> This patch addresses a different client-side failure path in
> rtrs_clt_create_path_files(), involving struct rtrs_clt_path. Here,
> the helper may release clt_path through kobject_put(), while its
> callers continue to access and free the same object, resulting in a UAF
> and double free.
> 
> Although both issues involve kobject lifetime handling, the affected
> object and call path are different.
> 
> Sorry that I did not make this distinction clear enough in the commit
> message.

You likely need to apply the same fix as in the srv patch.

Thanks

> 
> Thanks,
> Guangshuo