Re: [PATCH 1/1] RDMA/rxe: Fix unsafe socket release during namespace cleanup

[Leon Romanovsky <leon@kernel.org>]

On Mon, Apr 27, 2026 at 01:52:17PM -0700, yanjun.zhu wrote:
> On 4/27/26 5:35 AM, Leon Romanovsky wrote:
> > On Fri, Apr 24, 2026 at 06:35:22AM +0200, Zhu Yanjun wrote:
> > > Since all the sockets are created in rdma link create command
> > > and destroyed in rdma link delete command, keeping
> > > udp_tunnel_sock_release in rxe_ns_exit risks a "double-free" if
> > > the namespace and the device are being cleaned up simultaneously.
> > 
> > Please add a ladder diagram to clarify how it can be possible.
> 
> Hi, Leon
> 
> The double-free occurs as follows:
> 
> CPU 0 (Net NameSpace cleanup)        CPU 1 (RDMA device removal)
> ---------------------                ---------------------------
> rxe_ns_exit()                        rxe_link_delete() (rdma link del )
>   -> sk = ns_sk->rxe_sk4               -> sk = ns_sk->rxe_sk4
>   -> udp_tunnel_sock_release(sk)
>      [Success: First Free]             -> udp_tunnel_sock_release(sk)
>                                           [Crash: Double Free]
> 
> After removing the socket release logic from rxe_ns_exit(), we ensure
> that only the device destruction path (rxe_link_delete) is responsible
> for freeing the tunnel sockets, effectively eliminating the double-free
> problem.

I think it is possible to call rxe_ns_exit() without invoking
rxe_link_delete(), and in that case the UDP socket will not be
destroyed.

Thanks

> 
> I am not sure if I should put the above into the commit log.
> 
> Thanks a lot.
> 
> Zhu Yanjun
> 
> > 
> > Thanks
> > 
> > > 
> > > Fixes: 13f2a53c2a71 ("RDMA/rxe: Add net namespace support for IPv4/IPv6 sockets")
> > > Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
> > > ---
> > >   drivers/infiniband/sw/rxe/rxe_ns.c | 20 --------------------
> > >   1 file changed, 20 deletions(-)
> > > 
> > > diff --git a/drivers/infiniband/sw/rxe/rxe_ns.c b/drivers/infiniband/sw/rxe/rxe_ns.c
> > > index 8b9d734229b2..53add78b8e3a 100644
> > > --- a/drivers/infiniband/sw/rxe/rxe_ns.c
> > > +++ b/drivers/infiniband/sw/rxe/rxe_ns.c
> > > @@ -39,26 +39,6 @@ static void rxe_ns_exit(struct net *net)
> > >   {
> > >   	/* called when the network namespace is removed
> > >   	 */
> > > -	struct rxe_ns_sock *ns_sk = net_generic(net, rxe_pernet_id);
> > > -	struct sock *sk;
> > > -
> > > -	rcu_read_lock();
> > > -	sk = rcu_dereference(ns_sk->rxe_sk4);
> > > -	rcu_read_unlock();
> > > -	if (sk) {
> > > -		rcu_assign_pointer(ns_sk->rxe_sk4, NULL);
> > > -		udp_tunnel_sock_release(sk->sk_socket);
> > > -	}
> > > -
> > > -#if IS_ENABLED(CONFIG_IPV6)
> > > -	rcu_read_lock();
> > > -	sk = rcu_dereference(ns_sk->rxe_sk6);
> > > -	rcu_read_unlock();
> > > -	if (sk) {
> > > -		rcu_assign_pointer(ns_sk->rxe_sk6, NULL);
> > > -		udp_tunnel_sock_release(sk->sk_socket);
> > > -	}
> > > -#endif
> > >   }
> > >   /*
> > > -- 
> > > 2.43.0
> > > 
> > > 
>