Re: [PATCH v2 1/2] RDMA/rxe: drive UDP tunnel socket lifetime from the GID table

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Asynchronous GID deletion outlives netns teardown, causing a Use-After-Free panic and state corruption.
--

commit 2c5402d7d2ec6f9905d17f75a69f7841c9e31efb
Author: Serhat Kumral <serhatkumral1@gmail.com>

RDMA/rxe: drive UDP tunnel socket lifetime from the GID table

This commit keys the lifetime of shared per-netns UDP tunnel sockets off
the GID table instead of driver-side bookkeeping. It implements
add_gid/del_gid to manage the wildcard sockets, keeping the per-netns
state in a global list and removing the pernet storage and hooks.

Closes: https://syzkaller.appspot.com/bug?extid=8c9eede336e3a843750e

> diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
> index 53daaf4c1eb2e..fa1cf49c13e33 100644
> --- a/drivers/infiniband/sw/rxe/rxe_net.c
> +++ b/drivers/infiniband/sw/rxe/rxe_net.c

[ ... ]

> @@ -288,10 +283,165 @@ static struct socket *rxe_setup_udp_tunnel(struct net *net, __be16 port,

[ ... ]

> +int rxe_add_gid(const struct ib_gid_attr *attr, void **context)
> +{

[ ... ]

> +	mutex_unlock(&rxe_ns_lock);
> +
> +	put_net(net);
> +	*context = ns;
> +	return 0;

[Severity: Critical]
Is it safe to drop the active netns reference here?

A code comment mentions that passive net references keep the net pointer
valid as a list key until the sockets are released. However, kernel
sockets use passive references precisely so they do not keep the netns
alive. If a user deletes the namespace, the net structure can be freed
while its pointer remains in ns->net.

If a new netns is allocated at the same memory address before the old
GIDs are completely removed, could a concurrent rxe_add_gid() find
this stale rxe_ns_sock entry, leading to state corruption and
cross-namespace socket sharing?

> +
> +out_free:

[ ... ]

> +int rxe_del_gid(const struct ib_gid_attr *attr, void **context)
> +{

[ ... ]

> +	/*
> +	 * Release under the lock: a concurrent rxe_add_gid() must not
> +	 * see a zero count while the old socket still holds the port,
> +	 * or its bind() fails with -EADDRINUSE.
> +	 */
> +	if (sock)
> +		udp_tunnel_sock_release(sock->sk);

[Severity: Critical]
Can this lead to a use-after-free panic when the namespace is torn down?

When a net namespace is deleted, the NETDEV_UNREGISTER event triggers
an asynchronous unregistration of the IB device via ib_unreg_wq.
Because this is asynchronous, the netns teardown can complete and free
the net structure memory before rxe_del_gid() is executed.

When udp_tunnel_sock_release() is eventually called here, the socket
release path (such as udp_lib_unhash) will dereference sock_net(sk).
Since that points to the freed netns memory, won't this cause a
fatal use-after-free panic?

> +
> +	if (!ns->nr4 && !ns->nr6) {
> +		list_del(&ns->node);
> +		kfree(ns);
> +	}
> +	mutex_unlock(&rxe_ns_lock);
> +
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260910104906.19681-1-serhatkumral1@gmail.com?part=1