Re: [PATCH 1/1] RDMA/rxe: Fix unsafe socket release during namespace cleanup

[Leon Romanovsky <leon@kernel.org>]

On Wed, Apr 29, 2026 at 04:31:48PM -0700, yanjun.zhu wrote:
> On 4/29/26 6:49 AM, Zhu Yanjun wrote:
> > 在 2026/4/28 7:26, Leon Romanovsky 写道:
> > > On Mon, Apr 27, 2026 at 01:52:17PM -0700, yanjun.zhu wrote:
> > > > On 4/27/26 5:35 AM, Leon Romanovsky wrote:
> > > > > On Fri, Apr 24, 2026 at 06:35:22AM +0200, Zhu Yanjun wrote:
> > > > > > Since all the sockets are created in rdma link create command
> > > > > > and destroyed in rdma link delete command, keeping
> > > > > > udp_tunnel_sock_release in rxe_ns_exit risks a "double-free" if
> > > > > > the namespace and the device are being cleaned up simultaneously.
> > > > > 
> > > > > Please add a ladder diagram to clarify how it can be possible.
> > > > 
> > > > Hi, Leon
> > > > 
> > > > The double-free occurs as follows:
> > > > 
> > > > CPU 0 (Net NameSpace cleanup)        CPU 1 (RDMA device removal)
> > > > ---------------------                ---------------------------
> > > > rxe_ns_exit()                        rxe_link_delete() (rdma link del )
> > > >    -> sk = ns_sk->rxe_sk4               -> sk = ns_sk->rxe_sk4
> > > >    -> udp_tunnel_sock_release(sk)
> > > >       [Success: First Free]             -> udp_tunnel_sock_release(sk)
> > > >                                            [Crash: Double Free]
> > > > 
> > > > After removing the socket release logic from rxe_ns_exit(), we ensure
> > > > that only the device destruction path (rxe_link_delete) is responsible
> > > > for freeing the tunnel sockets, effectively eliminating the double-free
> > > > problem.
> > > 
> > > I think it is possible to call rxe_ns_exit() without invoking
> > > rxe_link_delete(), and in that case the UDP socket will not be
> > > destroyed.
> > 
> > Thanks, my bad. I missed this scenario.
> > 
> > Zhu Yanjun
> > 
> > > 
> > > Thanks
> > > 
> > > > 
> > > > I am not sure if I should put the above into the commit log.
> > > > 
> > > > Thanks a lot.
> 
> Hi, Leon
> 
> I have performed further tests to verify the execution order and the
> necessity of the cleanup code in rxe_ns_exit().
> 
> My findings show that a double-free race condition is unlikely because of
> how the kernel manages namespace references:
> 
> Reference Dependency: The RXE RDMA link holds a reference to the network
> namespace.
> 
> Order of Execution: When a namespace is deleted while an RDMA link exists,
> rxe_ns_exit() is not invoked immediately. It is deferred until the RDMA link
> itself is deleted (e.g., via rdma link del), which drops the final reference
> count of the namespace.

AFAIC, we've seen syzkaller reports where "rdma link del" was never invoked,  
yet RXE was removed regardless. Is it possible?

Thanks