[PATCH] RDMA/rtrs-clt: Fix double free on path sysfs failure

[PATCH] RDMA/rtrs-clt: Fix double free on path sysfs failure

[Guangshuo Li]

alloc_path() allocates clt_path before rtrs_clt_create_path_files()
initializes its embedded kobject.

If path sysfs creation fails, rtrs_clt_create_path_files() calls
kobject_put(). The final reference invokes rtrs_clt_path_release(),
which calls free_path() and frees clt_path for the first time.

After the helper returns, both rtrs_clt_open() and
rtrs_clt_create_path_from_sysfs() continue to access clt_path and call
free_path() again, resulting in a use-after-free and double free.

Let the sysfs helper undo the sysfs and stats setup while retaining the
path kobject reference. After removing the path and closing its
connections, release that reference with kobject_put() so
rtrs_clt_path_release() remains the sole owner of the final free.

This issue was found by a static analysis tool I am developing.

Fixes: 7ecd7e290bee ("RDMA/rtrs-clt: Fix memory leak of not-freed sess->stats and stats->pcpu_stats")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c | 20 +++++++++++++++-----
 drivers/infiniband/ulp/rtrs/rtrs-clt.c       | 12 +++++++++---
 2 files changed, 24 insertions(+), 8 deletions(-)

diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c b/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c
index f8b833bd81ad..3284f86c745e 100644
--- a/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c
+++ b/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c
@@ -438,13 +438,12 @@ int rtrs_clt_create_path_files(struct rtrs_clt_path *clt_path)
 				   "%s", str);
 	if (err) {
 		pr_err("kobject_init_and_add: %pe\n", ERR_PTR(err));
-		kobject_put(&clt_path->kobj);
-		return err;
+		goto free_stats;
 	}
 	err = sysfs_create_group(&clt_path->kobj, &rtrs_clt_path_attr_group);
 	if (err) {
 		pr_err("sysfs_create_group(): %pe\n", ERR_PTR(err));
-		goto put_kobj;
+		goto del_kobj_free_stats;
 	}
 	err = kobject_init_and_add(&clt_path->stats->kobj_stats, &ktype_stats,
 				   &clt_path->kobj, "stats");
@@ -468,9 +467,20 @@ int rtrs_clt_create_path_files(struct rtrs_clt_path *clt_path)
 	kobject_put(&clt_path->stats->kobj_stats);
 remove_group:
 	sysfs_remove_group(&clt_path->kobj, &rtrs_clt_path_attr_group);
-put_kobj:
+del_kobj:
+	kobject_del(&clt_path->kobj);
+	return err;
+
+del_kobj_free_stats:
 	kobject_del(&clt_path->kobj);
-	kobject_put(&clt_path->kobj);
+free_stats:
+	free_percpu(clt_path->stats->pcpu_stats);
+	kfree(clt_path->stats);
+
+	/*
+	 * Leave the path kobject reference to the caller so it can tear
+	 * down the connections before rtrs_clt_path_release() frees it.
+	 */
 
 	return err;
 }
diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
index d34d7e5f34d6..633a3211c17a 100644
--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
@@ -2865,8 +2865,7 @@ struct rtrs_clt_sess *rtrs_clt_open(struct rtrs_clt_ops *ops,
 		if (err) {
 			list_del_rcu(&clt_path->s.entry);
 			rtrs_clt_close_conns(clt_path, true);
-			free_percpu(clt_path->stats->pcpu_stats);
-			free_path(clt_path);
+			kobject_put(&clt_path->kobj);
 			goto close_all_path;
 		}
 	}
@@ -3150,9 +3149,16 @@ int rtrs_clt_create_path_from_sysfs(struct rtrs_clt_sess *clt,
 
 	err = rtrs_clt_create_path_files(clt_path);
 	if (err)
-		goto close_path;
+		goto put_path;
 
 	return 0;
+put_path:
+	rtrs_clt_remove_path_from_arr(clt_path);
+	rtrs_clt_close_conns(clt_path, true);
+
+	/* rtrs_clt_path_release() performs the final free_path(). */
+	kobject_put(&clt_path->kobj);
+	return err;
 
 close_path:
 	rtrs_clt_remove_path_from_arr(clt_path);
-- 
2.43.0

Re: [PATCH] RDMA/rtrs-clt: Fix double free on path sysfs failure

[Leon Romanovsky]

On Tue, Jul 14, 2026 at 10:28:38PM +0800, Guangshuo Li wrote:
> alloc_path() allocates clt_path before rtrs_clt_create_path_files()
> initializes its embedded kobject.
> 
> If path sysfs creation fails, rtrs_clt_create_path_files() calls
> kobject_put(). The final reference invokes rtrs_clt_path_release(),
> which calls free_path() and frees clt_path for the first time.
> 
> After the helper returns, both rtrs_clt_open() and
> rtrs_clt_create_path_from_sysfs() continue to access clt_path and call
> free_path() again, resulting in a use-after-free and double free.
> 
> Let the sysfs helper undo the sysfs and stats setup while retaining the
> path kobject reference. After removing the path and closing its
> connections, release that reference with kobject_put() so
> rtrs_clt_path_release() remains the sole owner of the final free.
> 
> This issue was found by a static analysis tool I am developing.
> 
> Fixes: 7ecd7e290bee ("RDMA/rtrs-clt: Fix memory leak of not-freed sess->stats and stats->pcpu_stats")
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c | 20 +++++++++++++++-----
>  drivers/infiniband/ulp/rtrs/rtrs-clt.c       | 12 +++++++++---
>  2 files changed, 24 insertions(+), 8 deletions(-)


We have already discussed this multiple times. What is still
missing?
https://lore.kernel.org/linux-rdma/20260428105515.362051-1-lgs201920130244@gmail.com/
https://lore.kernel.org/linux-rdma/20260511130804.773204-1-lgs201920130244@gmail.com/
https://lore.kernel.org/linux-rdma/20260514113834.865530-1-lgs201920130244@gmail.com/

Thanks

Re: [PATCH] RDMA/rtrs-clt: Fix double free on path sysfs failure

[Guangshuo Li]

Hi Leon,

Thanks for reviewing.

On Wed, 15 Jul 2026 at 16:17, Leon Romanovsky <leon@kernel.org> wrote:
>
> On Tue, Jul 14, 2026 at 10:28:38PM +0800, Guangshuo Li wrote:
> > alloc_path() allocates clt_path before rtrs_clt_create_path_files()
> > initializes its embedded kobject.
> >
> > If path sysfs creation fails, rtrs_clt_create_path_files() calls
> > kobject_put(). The final reference invokes rtrs_clt_path_release(),
> > which calls free_path() and frees clt_path for the first time.
> >
> > After the helper returns, both rtrs_clt_open() and
> > rtrs_clt_create_path_from_sysfs() continue to access clt_path and call
> > free_path() again, resulting in a use-after-free and double free.
> >
> > Let the sysfs helper undo the sysfs and stats setup while retaining the
> > path kobject reference. After removing the path and closing its
> > connections, release that reference with kobject_put() so
> > rtrs_clt_path_release() remains the sole owner of the final free.
> >
> > This issue was found by a static analysis tool I am developing.
> >
> > Fixes: 7ecd7e290bee ("RDMA/rtrs-clt: Fix memory leak of not-freed sess->stats and stats->pcpu_stats")
> > Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> > ---
> >  drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c | 20 +++++++++++++++-----
> >  drivers/infiniband/ulp/rtrs/rtrs-clt.c       | 12 +++++++++---
> >  2 files changed, 24 insertions(+), 8 deletions(-)
>
>
> We have already discussed this multiple times. What is still
> missing?
> https://lore.kernel.org/linux-rdma/20260428105515.362051-1-lgs201920130244@gmail.com/
> https://lore.kernel.org/linux-rdma/20260511130804.773204-1-lgs201920130244@gmail.com/
> https://lore.kernel.org/linux-rdma/20260514113834.865530-1-lgs201920130244@gmail.com/
>
> Thanks

The previous discussions addressed the server-side path,
rtrs_srv_create_path_files(), involving struct rtrs_srv_path.

This patch addresses a different client-side failure path in
rtrs_clt_create_path_files(), involving struct rtrs_clt_path. Here,
the helper may release clt_path through kobject_put(), while its
callers continue to access and free the same object, resulting in a UAF
and double free.

Although both issues involve kobject lifetime handling, the affected
object and call path are different.

Sorry that I did not make this distinction clear enough in the commit
message.

Thanks,
Guangshuo

Re: [PATCH] RDMA/rtrs-clt: Fix double free on path sysfs failure

[Leon Romanovsky]

On Sat, Jul 18, 2026 at 02:55:02PM +0800, Guangshuo Li wrote:
> Hi Leon,
> 
> Thanks for reviewing.
> 
> On Wed, 15 Jul 2026 at 16:17, Leon Romanovsky <leon@kernel.org> wrote:
> >
> > On Tue, Jul 14, 2026 at 10:28:38PM +0800, Guangshuo Li wrote:
> > > alloc_path() allocates clt_path before rtrs_clt_create_path_files()
> > > initializes its embedded kobject.
> > >
> > > If path sysfs creation fails, rtrs_clt_create_path_files() calls
> > > kobject_put(). The final reference invokes rtrs_clt_path_release(),
> > > which calls free_path() and frees clt_path for the first time.
> > >
> > > After the helper returns, both rtrs_clt_open() and
> > > rtrs_clt_create_path_from_sysfs() continue to access clt_path and call
> > > free_path() again, resulting in a use-after-free and double free.
> > >
> > > Let the sysfs helper undo the sysfs and stats setup while retaining the
> > > path kobject reference. After removing the path and closing its
> > > connections, release that reference with kobject_put() so
> > > rtrs_clt_path_release() remains the sole owner of the final free.
> > >
> > > This issue was found by a static analysis tool I am developing.
> > >
> > > Fixes: 7ecd7e290bee ("RDMA/rtrs-clt: Fix memory leak of not-freed sess->stats and stats->pcpu_stats")
> > > Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> > > ---
> > >  drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c | 20 +++++++++++++++-----
> > >  drivers/infiniband/ulp/rtrs/rtrs-clt.c       | 12 +++++++++---
> > >  2 files changed, 24 insertions(+), 8 deletions(-)
> >
> >
> > We have already discussed this multiple times. What is still
> > missing?
> > https://lore.kernel.org/linux-rdma/20260428105515.362051-1-lgs201920130244@gmail.com/
> > https://lore.kernel.org/linux-rdma/20260511130804.773204-1-lgs201920130244@gmail.com/
> > https://lore.kernel.org/linux-rdma/20260514113834.865530-1-lgs201920130244@gmail.com/
> >
> > Thanks
> 
> The previous discussions addressed the server-side path,
> rtrs_srv_create_path_files(), involving struct rtrs_srv_path.
> 
> This patch addresses a different client-side failure path in
> rtrs_clt_create_path_files(), involving struct rtrs_clt_path. Here,
> the helper may release clt_path through kobject_put(), while its
> callers continue to access and free the same object, resulting in a UAF
> and double free.
> 
> Although both issues involve kobject lifetime handling, the affected
> object and call path are different.
> 
> Sorry that I did not make this distinction clear enough in the commit
> message.

You likely need to apply the same fix as in the srv patch.

Thanks

> 
> Thanks,
> Guangshuo

Re: [PATCH] RDMA/rtrs-clt: Fix double free on path sysfs failure

[Guangshuo Li]

Hi Leon,

Thanks for reviewing.

On Sun, 19 Jul 2026 at 17:26, Leon Romanovsky <leon@kernel.org> wrote:
>
> On Sat, Jul 18, 2026 at 02:55:02PM +0800, Guangshuo Li wrote:
> > Hi Leon,
> >
> > Thanks for reviewing.
> >
> > On Wed, 15 Jul 2026 at 16:17, Leon Romanovsky <leon@kernel.org> wrote:
> > >
> > > On Tue, Jul 14, 2026 at 10:28:38PM +0800, Guangshuo Li wrote:
> > > > alloc_path() allocates clt_path before rtrs_clt_create_path_files()
> > > > initializes its embedded kobject.
> > > >
> > > > If path sysfs creation fails, rtrs_clt_create_path_files() calls
> > > > kobject_put(). The final reference invokes rtrs_clt_path_release(),
> > > > which calls free_path() and frees clt_path for the first time.
> > > >
> > > > After the helper returns, both rtrs_clt_open() and
> > > > rtrs_clt_create_path_from_sysfs() continue to access clt_path and call
> > > > free_path() again, resulting in a use-after-free and double free.
> > > >
> > > > Let the sysfs helper undo the sysfs and stats setup while retaining the
> > > > path kobject reference. After removing the path and closing its
> > > > connections, release that reference with kobject_put() so
> > > > rtrs_clt_path_release() remains the sole owner of the final free.
> > > >
> > > > This issue was found by a static analysis tool I am developing.
> > > >
> > > > Fixes: 7ecd7e290bee ("RDMA/rtrs-clt: Fix memory leak of not-freed sess->stats and stats->pcpu_stats")
> > > > Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> > > > ---
> > > >  drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c | 20 +++++++++++++++-----
> > > >  drivers/infiniband/ulp/rtrs/rtrs-clt.c       | 12 +++++++++---
> > > >  2 files changed, 24 insertions(+), 8 deletions(-)
> > >
> > >
> > > We have already discussed this multiple times. What is still
> > > missing?
> > > https://lore.kernel.org/linux-rdma/20260428105515.362051-1-lgs201920130244@gmail.com/
> > > https://lore.kernel.org/linux-rdma/20260511130804.773204-1-lgs201920130244@gmail.com/
> > > https://lore.kernel.org/linux-rdma/20260514113834.865530-1-lgs201920130244@gmail.com/
> > >
> > > Thanks
> >
> > The previous discussions addressed the server-side path,
> > rtrs_srv_create_path_files(), involving struct rtrs_srv_path.
> >
> > This patch addresses a different client-side failure path in
> > rtrs_clt_create_path_files(), involving struct rtrs_clt_path. Here,
> > the helper may release clt_path through kobject_put(), while its
> > callers continue to access and free the same object, resulting in a UAF
> > and double free.
> >
> > Although both issues involve kobject lifetime handling, the affected
> > object and call path are different.
> >
> > Sorry that I did not make this distinction clear enough in the commit
> > message.
>
> You likely need to apply the same fix as in the srv patch.
>
> Thanks
>
> >
> > Thanks,
> > Guangshuo

 I will prepare and send a v2 following your suggestion.

Thanks,
Guangshuo

Re: [PATCH] RDMA/rtrs-clt: Fix double free on path sysfs failure

[kernel test robot]

Hi Guangshuo,

kernel test robot noticed the following build warnings:

[auto build test WARNING on rdma/for-next]
[also build test WARNING on linus/master v7.2-rc7 next-20260813]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Guangshuo-Li/RDMA-rtrs-clt-Fix-double-free-on-path-sysfs-failure/20260815-173725
base:   https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git for-next
patch link:    https://lore.kernel.org/r/20260714142838.1723076-1-lgs201920130244%40gmail.com
patch subject: [PATCH] RDMA/rtrs-clt: Fix double free on path sysfs failure
config: powerpc-allmodconfig (https://download.01.org/0day-ci/archive/20260815/202608151946.R0SOCia4-lkp@intel.com/config)
compiler: powerpc64-linux-gcc (GCC) 16.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260815/202608151946.R0SOCia4-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608151946.R0SOCia4-lkp@intel.com/

All warnings (new ones prefixed by >>):

   drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c: In function 'rtrs_clt_create_path_files':
>> drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c:470:1: warning: label 'del_kobj' defined but not used [-Wunused-label]
     470 | del_kobj:
         | ^~~~~~~~


vim +/del_kobj +470 drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c

   424	
   425	int rtrs_clt_create_path_files(struct rtrs_clt_path *clt_path)
   426	{
   427		struct rtrs_clt_sess *clt = clt_path->clt;
   428		char str[NAME_MAX];
   429		int err;
   430		struct rtrs_addr path = {
   431			.src = &clt_path->s.src_addr,
   432			.dst = &clt_path->s.dst_addr,
   433		};
   434	
   435		rtrs_addr_to_str(&path, str, sizeof(str));
   436		err = kobject_init_and_add(&clt_path->kobj, &ktype_sess,
   437					   clt->kobj_paths,
   438					   "%s", str);
   439		if (err) {
   440			pr_err("kobject_init_and_add: %pe\n", ERR_PTR(err));
   441			goto free_stats;
   442		}
   443		err = sysfs_create_group(&clt_path->kobj, &rtrs_clt_path_attr_group);
   444		if (err) {
   445			pr_err("sysfs_create_group(): %pe\n", ERR_PTR(err));
   446			goto del_kobj_free_stats;
   447		}
   448		err = kobject_init_and_add(&clt_path->stats->kobj_stats, &ktype_stats,
   449					   &clt_path->kobj, "stats");
   450		if (err) {
   451			pr_err("kobject_init_and_add: %pe\n", ERR_PTR(err));
   452			kobject_put(&clt_path->stats->kobj_stats);
   453			goto remove_group;
   454		}
   455	
   456		err = sysfs_create_group(&clt_path->stats->kobj_stats,
   457					 &rtrs_clt_stats_attr_group);
   458		if (err) {
   459			pr_err("failed to create stats sysfs group, err: %pe\n", ERR_PTR(err));
   460			goto put_kobj_stats;
   461		}
   462	
   463		return 0;
   464	
   465	put_kobj_stats:
   466		kobject_del(&clt_path->stats->kobj_stats);
   467		kobject_put(&clt_path->stats->kobj_stats);
   468	remove_group:
   469		sysfs_remove_group(&clt_path->kobj, &rtrs_clt_path_attr_group);
 > 470	del_kobj:
   471		kobject_del(&clt_path->kobj);
   472		return err;
   473	
   474	del_kobj_free_stats:
   475		kobject_del(&clt_path->kobj);
   476	free_stats:
   477		free_percpu(clt_path->stats->pcpu_stats);
   478		kfree(clt_path->stats);
   479	
   480		/*
   481		 * Leave the path kobject reference to the caller so it can tear
   482		 * down the connections before rtrs_clt_path_release() frees it.
   483		 */
   484	
   485		return err;
   486	}
   487	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki