Re: [PATCH rdma-next 12/13] RDMA/rxe: Implement disassociate_ucontext callback

[Jiri Pirko <jiri@resnulli.us>]

Fri, Jul 10, 2026 at 11:56:30AM +0200, sashiko-bot@kernel.org wrote:
>Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
>- [Critical] Implementing an empty `disassociate_ucontext` callback bypasses the core's VMA zapping because RXE uses legacy, untracked VMAs. This leads to a Use-After-Free of `ib_ucontext` and `rxe_dev` when the VMA is eventually closed, and potential kernel panics upon module unload.
>--
>
>--- Patch [12]: [PATCH rdma-next 12/13] RDMA/rxe: Implement disassociate_ucontext callback ---
>commit 8946fc9f2a378bad6f910a408699c6a70e97a6f6
>Author: Jiri Pirko <jiri@resnulli.us>
>
>RDMA/rxe: Implement disassociate_ucontext callback
>
>Implement an empty disassociate_ucontext() callback so the RDMA core
>can move rxe devices between net namespaces. The core requires this
>callback to reset user contexts without waiting for userspace.
>
>> diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
>> index 1ec130fee8ea7..6eb10d2f0653b 100644
>> --- a/drivers/infiniband/sw/rxe/rxe_verbs.c
>> +++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
>> @@ -240,6 +240,10 @@ static void rxe_dealloc_ucontext(struct ib_ucontext *ibuc)
>>  		rxe_err_uc(uc, "cleanup failed, err = %d\n", err);
>>  }
>>  
>> +static void rxe_disassociate_ucontext(struct ib_ucontext *ibuc)
>> +{
>> +}
>> +
>
>[Severity: Critical]
>By adding this callback, does this opt the driver into asynchronous teardown
>which can lead to a use-after-free and kernel panic?
>
>Because RXE uses legacy, untracked VMAs (bypassing the core's
>rdma_user_mmap_entry mechanism), these VMAs are invisible to the core and are
>not zapped during teardown.
>
>If a user process maps an RXE resource and the device is then removed or
>migrated to another network namespace, the asynchronous teardown will free
>the ib_ucontext and allow module unload while the process still holds the VMA.
>
>When the process later unmaps the memory or exits, the untracked VMA's close
>callback (rxe_vma_close) will trigger rxe_mmap_release(), accessing the
>already-freed ib_ucontext and rxe_dev:
>
>drivers/infiniband/sw/rxe/rxe_mmap.c:rxe_mmap_release() {
>	struct rxe_mmap_info *ip = container_of(ref,
>					struct rxe_mmap_info, ref);
>	struct rxe_dev *rxe = to_rdev(ip->context->device);
>
>	spin_lock_bh(&rxe->pending_lock);
>    ...
>}
>
>If the module was unloaded in the interim, jumping to the VMA's close callback
>could also trigger an immediate kernel panic.

Fixed.

>
>[ ... ]
>
>-- 
>Sashiko AI review · https://sashiko.dev/#/patchset/20260709095532.855647-1-jiri@resnulli.us?part=12