From nobody Sat Jul 25 19:30:20 2026 Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3DB1A47DD67 for ; Tue, 14 Jul 2026 14:29:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784039342; cv=none; b=fLvGtnfZsk5VnSkhcc63cV7FPBVz+iUm0JsYKIne72WQ0Lwrqs/rV4/EgoEyhx7JhbWKfteMiSJUxTHDNxtpcJYb3vCzGKMIK5CudDSaYyVVu1U9sV16nbNU+ODxy0XxM+u1qWPt+o+wX8U7zcZdSczJwuHdwJj8eGtrER6dVpw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784039342; c=relaxed/simple; bh=gd/r9grCRZ+6cnWU0NBYM0b7O3OAbQA7ZZ0KgEAgfS4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=DLwHXMJL5sqeA9isABIJXufZGVsXTK9pxgRKy32012pt41za6xyfVrpy5ddW1aLF9jWdVKEwOLMOlkRIMFlo156Zofz/XfTAZ/ioarZWziYi8mplgyN65j/dbV/X4pO0eYKxI+pvh1zOn9NNIXkuZVvMWT/Cd6tFesOQ6M/jHPg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=HEFHowfB; arc=none smtp.client-ip=209.85.216.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="HEFHowfB" Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-38d489b6b71so4207610a91.0 for ; Tue, 14 Jul 2026 07:29:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784039339; x=1784644139; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=hIKCPPeciFzVG42F3e4RduFJQxgzqZmRFzkNVetv/mw=; b=HEFHowfBbrxvuAfg69NPIMhlnkYqqVcAEdXhtkGezYAxjAC6Gh4vZRNYobVqbVhrjy 3uwxd0pFNabKGmvX/jHtlH1NLqhCjVA/NUmzH5pKv8llCNNj2u86TgVyF24YQqABhBQ3 42jLDX6IZP4KaaGvx/0oTkIiiyPjcZNRgi4zUfRyeLmXAURQQ0QIDnsveMqiDc9WtHQF vByqvbcXcFsl2Rg89Wquas8PUE3hzjDk6D1+JNaqtHm7OgCrol2pScU6orkDsyNnWKdr bjs3ARSdawlHFCvwVr9DMkjLlLKfkafsEbA/xFu9zbMoWGwNC4VMN3YqqXQ3PWxC4i6n ZgRQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784039339; x=1784644139; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=hIKCPPeciFzVG42F3e4RduFJQxgzqZmRFzkNVetv/mw=; b=lozXGuOe1EjNfV+FtcM7VF7Zd2r+fNd2J5hpH798QH0wbXKxayy+xGUQNpyGKQChaD /cckw0pMfz/QxR+9a6Yhtryw0aiOZn6q/7CfEVQZJOaBuNHcSK1H0YebnhQ3jcUm0q0b K8Ev2hQBKMqS5N3yC+JAZ008OKbX21P0yFuaJx6tWGzfN4pCFNURuQL5uccWgjZ7mD+B 27WiDeRnGF3KGCtyoSuWQtYV1cLay2m8vr052FrWskrR18uxEh3oQeQY4D6fE9xODEId +G/NUGxYQAQeJ3RPb22qnJbYWQ2/JzseZCmn2byjG4hQFkqxDRpaCNJ0sQvXgO28qKDb 9i0g== X-Forwarded-Encrypted: i=1; AHgh+Ro+GLjYZrBUWAAjFSm1wtoN8H1vwz0cDvk7wogkVPmmZ9MncOL0JjWyrqNtlQa9P8jnrqSvK/bKrzFGWPo=@vger.kernel.org X-Gm-Message-State: AOJu0YzYhOTgFa/IjLC8PIXkE9CExsSQiYeIORmNs1ene/Z+yCDqMhZ8 QuT1WLvMyadBB6fA5gDGAVnu9BpSAnnx1Rr+x+KzZwsTmgeoOXvmX4FE X-Gm-Gg: AfdE7cno0BYMv0q8uArUAdle6Ki0S4cjLaIPEnw2fd272AURKu5b4e0v4aGZn9Qn7Ex xRjL62gE5nmXV6S/goOuIxdiu2m5/fT++NHTmFUB7lcTxt7Hci7lSiw9gy2aeAI8nvOQscbCUhx szrMRAKEwo09O/3ZY6uL0HCiH49zyeWzqsmemf7Sotov2Bj/+uUJ2VAnDOiDmIsf6ZA7kp+gIiF 7qmx1Rpr0nKIEyJz+LgRINZ0RsTORHHJWh0Zba3mBpcNMVe9MOviXOuQf3wGrvAe7f6CgmunKDn vhEg9uSiRmSGGeR59/enucpjTN/EL1ah7MLQT7NTGNQrELQrdcSHYXS202DawcongZKBfQ3F1ig +avu3Es0TR8B4PSTlVG274l7Bmm3V8UlscQLSAEKXEc6+aLoxZDJDHobSLWyEw392tB3RwD8Eou 7Vm4gdOiyylQ== X-Received: by 2002:a17:90b:58cd:b0:37f:9cdf:f0af with SMTP id 98e67ed59e1d1-38e17e675fcmr3279564a91.30.1784039338846; Tue, 14 Jul 2026 07:28:58 -0700 (PDT) Received: from lgs.. ([101.76.249.46]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-38e172b6d37sm1569813a91.2.2026.07.14.07.28.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jul 2026 07:28:58 -0700 (PDT) From: Guangshuo Li To: "Md. Haris Iqbal" , Jack Wang , Jason Gunthorpe , Leon Romanovsky , Gioh Kim , linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Guangshuo Li Subject: [PATCH] RDMA/rtrs-clt: Fix double free on path sysfs failure Date: Tue, 14 Jul 2026 22:28:38 +0800 Message-ID: <20260714142838.1723076-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" alloc_path() allocates clt_path before rtrs_clt_create_path_files() initializes its embedded kobject. If path sysfs creation fails, rtrs_clt_create_path_files() calls kobject_put(). The final reference invokes rtrs_clt_path_release(), which calls free_path() and frees clt_path for the first time. After the helper returns, both rtrs_clt_open() and rtrs_clt_create_path_from_sysfs() continue to access clt_path and call free_path() again, resulting in a use-after-free and double free. Let the sysfs helper undo the sysfs and stats setup while retaining the path kobject reference. After removing the path and closing its connections, release that reference with kobject_put() so rtrs_clt_path_release() remains the sole owner of the final free. This issue was found by a static analysis tool I am developing. Fixes: 7ecd7e290bee ("RDMA/rtrs-clt: Fix memory leak of not-freed sess->sta= ts and stats->pcpu_stats") Signed-off-by: Guangshuo Li --- drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c | 20 +++++++++++++++----- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 12 +++++++++--- 2 files changed, 24 insertions(+), 8 deletions(-) diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c b/drivers/infinib= and/ulp/rtrs/rtrs-clt-sysfs.c index f8b833bd81ad..3284f86c745e 100644 --- a/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c +++ b/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c @@ -438,13 +438,12 @@ int rtrs_clt_create_path_files(struct rtrs_clt_path *= clt_path) "%s", str); if (err) { pr_err("kobject_init_and_add: %pe\n", ERR_PTR(err)); - kobject_put(&clt_path->kobj); - return err; + goto free_stats; } err =3D sysfs_create_group(&clt_path->kobj, &rtrs_clt_path_attr_group); if (err) { pr_err("sysfs_create_group(): %pe\n", ERR_PTR(err)); - goto put_kobj; + goto del_kobj_free_stats; } err =3D kobject_init_and_add(&clt_path->stats->kobj_stats, &ktype_stats, &clt_path->kobj, "stats"); @@ -468,9 +467,20 @@ int rtrs_clt_create_path_files(struct rtrs_clt_path *c= lt_path) kobject_put(&clt_path->stats->kobj_stats); remove_group: sysfs_remove_group(&clt_path->kobj, &rtrs_clt_path_attr_group); -put_kobj: +del_kobj: + kobject_del(&clt_path->kobj); + return err; + +del_kobj_free_stats: kobject_del(&clt_path->kobj); - kobject_put(&clt_path->kobj); +free_stats: + free_percpu(clt_path->stats->pcpu_stats); + kfree(clt_path->stats); + + /* + * Leave the path kobject reference to the caller so it can tear + * down the connections before rtrs_clt_path_release() frees it. + */ =20 return err; } diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ul= p/rtrs/rtrs-clt.c index d34d7e5f34d6..633a3211c17a 100644 --- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c +++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c @@ -2865,8 +2865,7 @@ struct rtrs_clt_sess *rtrs_clt_open(struct rtrs_clt_o= ps *ops, if (err) { list_del_rcu(&clt_path->s.entry); rtrs_clt_close_conns(clt_path, true); - free_percpu(clt_path->stats->pcpu_stats); - free_path(clt_path); + kobject_put(&clt_path->kobj); goto close_all_path; } } @@ -3150,9 +3149,16 @@ int rtrs_clt_create_path_from_sysfs(struct rtrs_clt_= sess *clt, =20 err =3D rtrs_clt_create_path_files(clt_path); if (err) - goto close_path; + goto put_path; =20 return 0; +put_path: + rtrs_clt_remove_path_from_arr(clt_path); + rtrs_clt_close_conns(clt_path, true); + + /* rtrs_clt_path_release() performs the final free_path(). */ + kobject_put(&clt_path->kobj); + return err; =20 close_path: rtrs_clt_remove_path_from_arr(clt_path); --=20 2.43.0