[PATCH] RDMA/rtrs-clt: Fix double free on path sysfs failure

[PATCH] RDMA/rtrs-clt: Fix double free on path sysfs failure

[Guangshuo Li]

alloc_path() allocates clt_path before rtrs_clt_create_path_files()
initializes its embedded kobject.

If path sysfs creation fails, rtrs_clt_create_path_files() calls
kobject_put(). The final reference invokes rtrs_clt_path_release(),
which calls free_path() and frees clt_path for the first time.

After the helper returns, both rtrs_clt_open() and
rtrs_clt_create_path_from_sysfs() continue to access clt_path and call
free_path() again, resulting in a use-after-free and double free.

Let the sysfs helper undo the sysfs and stats setup while retaining the
path kobject reference. After removing the path and closing its
connections, release that reference with kobject_put() so
rtrs_clt_path_release() remains the sole owner of the final free.

This issue was found by a static analysis tool I am developing.

Fixes: 7ecd7e290bee ("RDMA/rtrs-clt: Fix memory leak of not-freed sess->stats and stats->pcpu_stats")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c | 20 +++++++++++++++-----
 drivers/infiniband/ulp/rtrs/rtrs-clt.c       | 12 +++++++++---
 2 files changed, 24 insertions(+), 8 deletions(-)

diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c b/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c
index f8b833bd81ad..3284f86c745e 100644
--- a/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c
+++ b/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c
@@ -438,13 +438,12 @@ int rtrs_clt_create_path_files(struct rtrs_clt_path *clt_path)
 				   "%s", str);
 	if (err) {
 		pr_err("kobject_init_and_add: %pe\n", ERR_PTR(err));
-		kobject_put(&clt_path->kobj);
-		return err;
+		goto free_stats;
 	}
 	err = sysfs_create_group(&clt_path->kobj, &rtrs_clt_path_attr_group);
 	if (err) {
 		pr_err("sysfs_create_group(): %pe\n", ERR_PTR(err));
-		goto put_kobj;
+		goto del_kobj_free_stats;
 	}
 	err = kobject_init_and_add(&clt_path->stats->kobj_stats, &ktype_stats,
 				   &clt_path->kobj, "stats");
@@ -468,9 +467,20 @@ int rtrs_clt_create_path_files(struct rtrs_clt_path *clt_path)
 	kobject_put(&clt_path->stats->kobj_stats);
 remove_group:
 	sysfs_remove_group(&clt_path->kobj, &rtrs_clt_path_attr_group);
-put_kobj:
+del_kobj:
+	kobject_del(&clt_path->kobj);
+	return err;
+
+del_kobj_free_stats:
 	kobject_del(&clt_path->kobj);
-	kobject_put(&clt_path->kobj);
+free_stats:
+	free_percpu(clt_path->stats->pcpu_stats);
+	kfree(clt_path->stats);
+
+	/*
+	 * Leave the path kobject reference to the caller so it can tear
+	 * down the connections before rtrs_clt_path_release() frees it.
+	 */
 
 	return err;
 }
diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
index d34d7e5f34d6..633a3211c17a 100644
--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
+++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
@@ -2865,8 +2865,7 @@ struct rtrs_clt_sess *rtrs_clt_open(struct rtrs_clt_ops *ops,
 		if (err) {
 			list_del_rcu(&clt_path->s.entry);
 			rtrs_clt_close_conns(clt_path, true);
-			free_percpu(clt_path->stats->pcpu_stats);
-			free_path(clt_path);
+			kobject_put(&clt_path->kobj);
 			goto close_all_path;
 		}
 	}
@@ -3150,9 +3149,16 @@ int rtrs_clt_create_path_from_sysfs(struct rtrs_clt_sess *clt,
 
 	err = rtrs_clt_create_path_files(clt_path);
 	if (err)
-		goto close_path;
+		goto put_path;
 
 	return 0;
+put_path:
+	rtrs_clt_remove_path_from_arr(clt_path);
+	rtrs_clt_close_conns(clt_path, true);
+
+	/* rtrs_clt_path_release() performs the final free_path(). */
+	kobject_put(&clt_path->kobj);
+	return err;
 
 close_path:
 	rtrs_clt_remove_path_from_arr(clt_path);
-- 
2.43.0

Re: [PATCH] RDMA/rtrs-clt: Fix double free on path sysfs failure

[Leon Romanovsky]

On Tue, Jul 14, 2026 at 10:28:38PM +0800, Guangshuo Li wrote:
> alloc_path() allocates clt_path before rtrs_clt_create_path_files()
> initializes its embedded kobject.
> 
> If path sysfs creation fails, rtrs_clt_create_path_files() calls
> kobject_put(). The final reference invokes rtrs_clt_path_release(),
> which calls free_path() and frees clt_path for the first time.
> 
> After the helper returns, both rtrs_clt_open() and
> rtrs_clt_create_path_from_sysfs() continue to access clt_path and call
> free_path() again, resulting in a use-after-free and double free.
> 
> Let the sysfs helper undo the sysfs and stats setup while retaining the
> path kobject reference. After removing the path and closing its
> connections, release that reference with kobject_put() so
> rtrs_clt_path_release() remains the sole owner of the final free.
> 
> This issue was found by a static analysis tool I am developing.
> 
> Fixes: 7ecd7e290bee ("RDMA/rtrs-clt: Fix memory leak of not-freed sess->stats and stats->pcpu_stats")
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c | 20 +++++++++++++++-----
>  drivers/infiniband/ulp/rtrs/rtrs-clt.c       | 12 +++++++++---
>  2 files changed, 24 insertions(+), 8 deletions(-)


We have already discussed this multiple times. What is still
missing?
https://lore.kernel.org/linux-rdma/20260428105515.362051-1-lgs201920130244@gmail.com/
https://lore.kernel.org/linux-rdma/20260511130804.773204-1-lgs201920130244@gmail.com/
https://lore.kernel.org/linux-rdma/20260514113834.865530-1-lgs201920130244@gmail.com/

Thanks

Re: [PATCH] RDMA/rtrs-clt: Fix double free on path sysfs failure

[Guangshuo Li]

Hi Leon,

Thanks for reviewing.

On Wed, 15 Jul 2026 at 16:17, Leon Romanovsky <leon@kernel.org> wrote:
>
> On Tue, Jul 14, 2026 at 10:28:38PM +0800, Guangshuo Li wrote:
> > alloc_path() allocates clt_path before rtrs_clt_create_path_files()
> > initializes its embedded kobject.
> >
> > If path sysfs creation fails, rtrs_clt_create_path_files() calls
> > kobject_put(). The final reference invokes rtrs_clt_path_release(),
> > which calls free_path() and frees clt_path for the first time.
> >
> > After the helper returns, both rtrs_clt_open() and
> > rtrs_clt_create_path_from_sysfs() continue to access clt_path and call
> > free_path() again, resulting in a use-after-free and double free.
> >
> > Let the sysfs helper undo the sysfs and stats setup while retaining the
> > path kobject reference. After removing the path and closing its
> > connections, release that reference with kobject_put() so
> > rtrs_clt_path_release() remains the sole owner of the final free.
> >
> > This issue was found by a static analysis tool I am developing.
> >
> > Fixes: 7ecd7e290bee ("RDMA/rtrs-clt: Fix memory leak of not-freed sess->stats and stats->pcpu_stats")
> > Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> > ---
> >  drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c | 20 +++++++++++++++-----
> >  drivers/infiniband/ulp/rtrs/rtrs-clt.c       | 12 +++++++++---
> >  2 files changed, 24 insertions(+), 8 deletions(-)
>
>
> We have already discussed this multiple times. What is still
> missing?
> https://lore.kernel.org/linux-rdma/20260428105515.362051-1-lgs201920130244@gmail.com/
> https://lore.kernel.org/linux-rdma/20260511130804.773204-1-lgs201920130244@gmail.com/
> https://lore.kernel.org/linux-rdma/20260514113834.865530-1-lgs201920130244@gmail.com/
>
> Thanks

The previous discussions addressed the server-side path,
rtrs_srv_create_path_files(), involving struct rtrs_srv_path.

This patch addresses a different client-side failure path in
rtrs_clt_create_path_files(), involving struct rtrs_clt_path. Here,
the helper may release clt_path through kobject_put(), while its
callers continue to access and free the same object, resulting in a UAF
and double free.

Although both issues involve kobject lifetime handling, the affected
object and call path are different.

Sorry that I did not make this distinction clear enough in the commit
message.

Thanks,
Guangshuo