Re: [PATCH] RDMA/rtrs-clt: Fix double free on path sysfs failure

[Leon Romanovsky <leon@kernel.org>]

On Tue, Jul 14, 2026 at 10:28:38PM +0800, Guangshuo Li wrote:
> alloc_path() allocates clt_path before rtrs_clt_create_path_files()
> initializes its embedded kobject.
> 
> If path sysfs creation fails, rtrs_clt_create_path_files() calls
> kobject_put(). The final reference invokes rtrs_clt_path_release(),
> which calls free_path() and frees clt_path for the first time.
> 
> After the helper returns, both rtrs_clt_open() and
> rtrs_clt_create_path_from_sysfs() continue to access clt_path and call
> free_path() again, resulting in a use-after-free and double free.
> 
> Let the sysfs helper undo the sysfs and stats setup while retaining the
> path kobject reference. After removing the path and closing its
> connections, release that reference with kobject_put() so
> rtrs_clt_path_release() remains the sole owner of the final free.
> 
> This issue was found by a static analysis tool I am developing.
> 
> Fixes: 7ecd7e290bee ("RDMA/rtrs-clt: Fix memory leak of not-freed sess->stats and stats->pcpu_stats")
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c | 20 +++++++++++++++-----
>  drivers/infiniband/ulp/rtrs/rtrs-clt.c       | 12 +++++++++---
>  2 files changed, 24 insertions(+), 8 deletions(-)


We have already discussed this multiple times. What is still
missing?
https://lore.kernel.org/linux-rdma/20260428105515.362051-1-lgs201920130244@gmail.com/
https://lore.kernel.org/linux-rdma/20260511130804.773204-1-lgs201920130244@gmail.com/
https://lore.kernel.org/linux-rdma/20260514113834.865530-1-lgs201920130244@gmail.com/

Thanks