Re: [PATCH 1/3] RDMA/rtrs-srv: Do not free the path on path file creation failure

[sashiko-bot@kernel.org]

> When rtrs_srv_create_path_files() fails after kobject_init_and_add() of
> srv_path->kobj, its error path ends with kobject_put(&srv_path->kobj),
> and the release, rtrs_srv_release(), frees srv_path.  The caller does
> not expect that: process_info_req() goes on to free its tx IU through
> srv_path->s.dev, and rtrs_srv_info_req_done() then closes the path,
> whose close work tears down the connections, puts the session and
> finally frees srv_path again in free_path().
> 
> Commit 5b7437339011 ("RDMA/rtrs: Fix use-after-free in path file
> creation cleanup") reordered the cleanup inside
> rtrs_srv_create_path_files() so that the helper runs before the put, but
> the final put still frees srv_path under the caller.  The same pattern
> exists one level down: rtrs_srv_create_stats_files() puts
> srv_path->stats->kobj_stats on failure, whose release frees
> srv_path->stats, which free_path() frees again.
> [ ... ]
> 
> Fixes: 424774c9f3fa ("RDMA/rtrs: Call kobject_put in the failure path")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-5-5 kbound
> Signed-off-by: Yuqiang Sun <izaiahsun@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261029042719.75868-1-izaiahsun@gmail.com?part=1