From: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
To: "Md. Haris Iqbal" <haris.iqbal@ionos.com>,
Jack Wang <jinpu.wang@ionos.com>, Jason Gunthorpe <jgg@ziepe.ca>,
Leon Romanovsky <leon@kernel.org>
Cc: Shuangpeng Bai <shuangpeng.kernel@gmail.com>,
linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [BUG] infiniband: rtrs: KASAN: slab-use-after-free in rtrs_clt_remove_path_from_arr
Date: Fri, 31 Jul 2026 15:43:22 -0400 [thread overview]
Message-ID: <20260731194325.2322754-1-shuangpeng.kernel@gmail.com> (raw)
Hi Kernel Maintainers,
I hit the following report while testing current upstream kernel:
KASAN: slab-use-after-free in rtrs_clt_remove_path_from_arr
on commit: fce2dfa773ced15f27dd27cd0b482a7473cdcf2a (2026-07-16)
The reproducer and .config files are here.
https://gist.github.com/shuangpengbai/5f48e1bbb0576eecdf8ec7a5fb6b138b
I'm happy to test debug patches or provide additional information.
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
[ 1396.946778][ T8599] BUG: KASAN: slab-use-after-free in rtrs_clt_remove_path_from_arr (drivers/infiniband/ulp/rtrs/rtrs-clt.c:2236)
[ 1396.948953][ T8599] Read of size 8 at addr ffff88810fc7b2d8 by task bash/8599
[ 1396.953684][ T8599] Call Trace:
[ 1396.953694][ T8599] <TASK>
[ 1396.953701][ T8599] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[ 1396.953716][ T8599] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
[ 1396.953748][ T8599] kasan_report (mm/kasan/report.c:595)
[ 1396.953766][ T8599] rtrs_clt_remove_path_from_arr (drivers/infiniband/ulp/rtrs/rtrs-clt.c:2236)
[ 1396.953786][ T8599] rtrs_clt_create_path_from_sysfs (drivers/infiniband/ulp/rtrs/rtrs-clt.c:3158)
[ 1396.953792][ T8599] add_path_store (drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c:187)
[ 1396.953852][ T8599] kernfs_fop_write_iter (fs/kernfs/file.c:345)
[ 1396.953857][ T8599] vfs_write (fs/read_write.c:595 fs/read_write.c:687)
[ 1396.953898][ T8599] ksys_write (fs/read_write.c:739)
[ 1396.953921][ T8599] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[ 1396.953928][ T8599] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[ 1397.134599][ T8599] Freed by task 8599 on cpu 1 at 1396.942910s:
[ 1397.135348][ T8599] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
[ 1397.135942][ T8599] kasan_save_free_info (mm/kasan/generic.c:584)
[ 1397.136539][ T8599] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
[ 1397.143207][ T8599] kfree (include/linux/kasan.h:235 mm/slub.c:2705 mm/slub.c:6405 mm/slub.c:6720)
[ 1397.143701][ T8599] kobject_put (lib/kobject.c:689 lib/kobject.c:720 include/linux/kref.h:65 lib/kobject.c:737)
[ 1397.144255][ T8599] rtrs_clt_create_path_files (drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c:441)
[ 1397.144944][ T8599] rtrs_clt_create_path_from_sysfs (drivers/infiniband/ulp/rtrs/rtrs-clt.c:3151)
[ 1397.145671][ T8599] add_path_store (drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c:187)
[ 1397.159053][ T8599] kernfs_fop_write_iter (fs/kernfs/file.c:345)
[ 1397.159699][ T8599] vfs_write (fs/read_write.c:595 fs/read_write.c:687)
[ 1397.160233][ T8599] ksys_write (fs/read_write.c:739)
[ 1397.160740][ T8599] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[ 1397.161333][ T8599] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[ 1397.174822][ T8599] The buggy address is located 728 bytes inside of
[ 1397.174822][ T8599] freed 2048-byte region [ffff88810fc7b000, ffff88810fc7b800)
Best,
Shuangpeng
reply other threads:[~2026-07-31 19:43 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260731194325.2322754-1-shuangpeng.kernel@gmail.com \
--to=shuangpeng.kernel@gmail.com \
--cc=haris.iqbal@ionos.com \
--cc=jgg@ziepe.ca \
--cc=jinpu.wang@ionos.com \
--cc=leon@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®