From: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
To: "Md. Haris Iqbal" <haris.iqbal@ionos.com>,
Jack Wang <jinpu.wang@ionos.com>, Jason Gunthorpe <jgg@ziepe.ca>,
Leon Romanovsky <leon@kernel.org>
Cc: Shuangpeng Bai <shuangpeng.kernel@gmail.com>,
linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [BUG] RDMA/rtrs-clt: race between close_work submission and synchronous close
Date: Sun, 20 Sep 2026 23:33:36 -0400 [thread overview]
Message-ID: <20260921033339.1320291-1-shuangpeng.kernel@gmail.com> (raw)
Hi Kernel Maintainers,
I hit the following report while testing current upstream kernel:
KASAN: slab-use-after-free in rtrs_clt_stop_and_destroy_conns
on commit: 93f51579e7df248780214094418f205253383cc5 (2026-09-20)
To help trigger the bug more reliably, we applied a minimal diagnostic patch
that only adds delays and print statements.
The reproducer and .config files are here.
https://gist.github.com/shuangpengbai/1b0782d283051b34df6548d387be90a6
I'm happy to test debug patches or provide additional information.
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
[ 86.996512] ==================================================================
[ 86.996866] BUG: KASAN: slab-use-after-free in rtrs_clt_stop_and_destroy_conns (./include/linux/instrumented.h:82 ./include/linux/atomic/atomic-instrumented.h:32 drivers/infiniband/ulp/rtrs/rtrs-clt.c:2237)
[ 86.996866] Read of size 4 at addr ffff8881038672fc by task kworker/0:0/9
[ 86.996866]
[ 86.999871] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.999871] Workqueue: rtrs_client_wq rtrs_clt_close_work
[ 86.999871] Call Trace:
[ 87.001599] <TASK>
[ 87.001599] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[ 87.001599] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
[ 87.001599] kasan_report (mm/kasan/report.c:595)
[ 87.001599] kasan_check_range (mm/kasan/generic.c:? mm/kasan/generic.c:200)
[ 87.001599] rtrs_clt_stop_and_destroy_conns (./include/linux/instrumented.h:82 ./include/linux/atomic/atomic-instrumented.h:32 drivers/infiniband/ulp/rtrs/rtrs-clt.c:2237)
[ 87.001599] rtrs_clt_close_work (drivers/infiniband/ulp/rtrs/rtrs-clt.c:2364)
[ 87.001599] process_scheduled_works (kernel/workqueue.c:3396 kernel/workqueue.c:3479)
[ 87.001599] worker_thread (kernel/workqueue.c:3560)
[ 87.001599] kthread (kernel/kthread.c:436)
[ 87.001599] ret_from_fork (arch/x86/kernel/process.c:158)
[ 87.001599] ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
[ 87.001599] </TASK>
[ 87.001599]
[ 87.001599] Allocated by task 1 on cpu 1 at 34.840929s:
[ 87.001599] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
[ 87.001599] __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)
[ 87.001599] alloc_path (./include/linux/slab.h:991 ./include/linux/slab.h:1312 drivers/infiniband/ulp/rtrs/rtrs-clt.c:1544)
[ 87.001599] rtrs_clt_open (drivers/infiniband/ulp/rtrs/rtrs-clt.c:2870)
[ 87.001599] rnbd_clt_map_device (drivers/block/rnbd/rnbd-clt.c:1268 drivers/block/rnbd/rnbd-clt.c:1551)
[ 87.001599] rnbd_clt_map_device_store (drivers/block/rnbd/rnbd-clt-sysfs.c:612)
[ 87.001599] kernfs_fop_write_iter (fs/kernfs/file.c:345)
[ 87.001599] vfs_write (fs/read_write.c:595 fs/read_write.c:687)
[ 87.001599] ksys_write (fs/read_write.c:739)
[ 87.001599] do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
[ 87.001599] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[ 87.001599]
[ 87.001599] Freed by task 1 on cpu 1 at 56.591404s:
[ 87.001599] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
[ 87.001599] kasan_save_free_info (mm/kasan/generic.c:584)
[ 87.001599] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
[ 87.001599] kfree (./include/linux/kasan.h:235 mm/slub.c:2748 mm/slub.c:6508 mm/slub.c:6801)
[ 87.001599] kobject_put (lib/kobject.c:689 lib/kobject.c:720 ./include/linux/kref.h:65 lib/kobject.c:737)
[ 87.001599] rtrs_clt_close (drivers/infiniband/ulp/rtrs/rtrs-clt.c:2933)
[ 87.001599] free_sess (drivers/block/rnbd/rnbd-clt.c:754 drivers/block/rnbd/rnbd-clt.c:766)
[ 87.001599] rnbd_clt_put_dev (drivers/block/rnbd/rnbd-clt.c:48 drivers/block/rnbd/rnbd-clt.c:61)
[ 87.001599] rnbd_clt_unmap_device (drivers/block/rnbd/rnbd-clt.c:1703)
[ 87.001599] rnbd_clt_unmap_dev_store (drivers/block/rnbd/rnbd-clt-sysfs.c:334)
[ 87.001599] kernfs_fop_write_iter (fs/kernfs/file.c:345)
[ 87.001599] vfs_write (fs/read_write.c:595 fs/read_write.c:687)
[ 87.001599] ksys_write (fs/read_write.c:739)
[ 87.001599]
[ 87.001599] Last potentially related work creation:
[ 87.001599] kasan_save_stack (mm/kasan/common.c:57)
[ 87.001599] kasan_record_aux_stack (mm/kasan/generic.c:556)
[ 87.001599] insert_work (kernel/workqueue.c:2272)
[ 87.001599] __queue_work (kernel/workqueue.c:2448)
[ 87.001599] queue_work_on (kernel/workqueue.c:2501)
[ 87.001599] rtrs_clt_close_conns (./include/linux/workqueue.h:700 drivers/infiniband/ulp/rtrs/rtrs-clt.c:1967)
[ 87.001599] rtrs_clt_rdma_cm_handler (drivers/infiniband/ulp/rtrs/rtrs-clt.c:2063)
[ 87.001599] cma_cm_event_handler (drivers/infiniband/core/cma.c:2181)
[ 87.001599] cma_process_remove (drivers/infiniband/core/cma.c:5313 drivers/infiniband/core/cma.c:5346)
[ 87.001599] cma_remove_one (drivers/infiniband/core/cma.c:5453)
[ 87.001599] remove_client_context (drivers/infiniband/core/device.c:810)
[ 87.001599] disable_device (drivers/infiniband/core/device.c:1325)
[ 87.001599] __ib_unregister_device (drivers/infiniband/core/device.c:1571)
[ 87.001599] ib_unregister_device_and_put (drivers/infiniband/core/device.c:1636)
[ 87.001599] nldev_dellink (drivers/infiniband/core/nldev.c:1902)
[ 87.001599] rdma_nl_rcv (drivers/infiniband/core/netlink.c:? drivers/infiniband/core/netlink.c:239 drivers/infiniband/core/netlink.c:259)
[ 87.001599] netlink_unicast (net/netlink/af_netlink.c:1338 net/netlink/af_netlink.c:1364)
[ 87.001599] netlink_sendmsg (net/netlink/af_netlink.c:1919)
[ 87.001599] __sock_sendmsg (net/socket.c:800 net/socket.c:815)
[ 87.001599] __sys_sendto (net/socket.c:2281)
[ 87.001599] __x64_sys_sendto (net/socket.c:2288 net/socket.c:2284 net/socket.c:2284)
[ 87.001599] do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
[ 87.001599] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[ 87.001599]
[ 87.001599] The buggy address belongs to the object at ffff888103867000
[ 87.001599] which belongs to the cache kmalloc-2k of size 2048
[ 87.001599] The buggy address is located 764 bytes inside of
[ 87.001599] freed 2048-byte region [ffff888103867000, ffff888103867800)
[ 87.001599] ==================================================================
Best,
Shuangpeng
reply other threads:[~2026-09-21 3:34 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260921033339.1320291-1-shuangpeng.kernel@gmail.com \
--to=shuangpeng.kernel@gmail.com \
--cc=haris.iqbal@ionos.com \
--cc=jgg@ziepe.ca \
--cc=jinpu.wang@ionos.com \
--cc=leon@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®