Re: Re: [PATCH] RDMA/rtrs: Fix potential use-after-free on client sysfs setup failure

[Leon Romanovsky <leon@kernel.org>]

On Mon, Nov 09, 2026 at 08:56:46PM +0800, 李广硕 wrote:
> Hi Leon,
> 
> Thanks for reviewing.
> 
> From: Leon Romanovsky <leon@kernel.org>
> Date: 2026-11-09 19:16:52
> To:  Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
> Cc:  Jason Gunthorpe <jgg@ziepe.ca>,stable@vger.kernel.org,"Md. Haris Iqbal" <haris.iqbal@ionos.com>,Jack Wang <jinpu.wang@ionos.com>,linux-rdma@vger.kernel.org,linux-kernel@vger.kernel.org
> Subject: Re: [PATCH] RDMA/rtrs: Fix potential use-after-free on client sysfs setup failure>On Sat, Oct 31, 2026 at 10:14:46PM +0800, Guangshuo Li wrote:
> >> rtrs_clt_create_path_files() drops the path reference on failure, but
> >> its callers still close connections and free the path. This can access
> >> freed memory and free the path twice.
> >
> >Sorry, but how?
> >
> Consider an allocation failure while setting the name of the path
> kobject in rtrs_clt_create_path_files(). kobject_init_and_add() has
> already initialized the reference count to one when setting the name
> fails with -ENOMEM. The stats kobject has not been created yet, and
> adding the path to clt->paths_list did not take a kobject reference.
> 
> The error branch then calls kobject_put(&clt_path->kobj). This drops
> the only reference. With CONFIG_DEBUG_KOBJECT_RELEASE=n,
> rtrs_clt_path_release() runs synchronously and calls free_path(), which
> does kfree(clt_path).
> 
> Back in rtrs_clt_open(), the first statement on that error path is:
> 
>         list_del_rcu(&clt_path->s.entry);
> 
> That accesses the list node embedded in the path that was just freed.
> This is the use-after-free I meant.

The error handling appears to be incorrect. rtrs_clt_create_path_files()
should undo only the changes it made internally and error handling of
call to rtrs_clt_create_path_files() should undo what was done in
rtrs_clt_open().

Thanks

> 
> Thanks,
> Guangshuo