Re: [PATCH 1/1] RDMA/rxe: Fix Use-After-Free problem in rxe_net_del

[Leon Romanovsky <leon@kernel.org>]

On Sun, May 17, 2026 at 06:47:47AM +0200, Zhu Yanjun wrote:
> syzbot reported a general protection fault (KASAN: null-ptr-deref) in
> kernel_sock_shutdown() called during the software RoCE (rxe) link
> deletion path (rxe_dellink -> rxe_net_del).
> 
> The root cause is a TOCTOU (Time-of-Check to Time-of-Use) race condition
> in rxe_net_del(). Previously, the function fetched the socket pointer
> via rxe_ns_pernet_sk4/6() outside the critical section, and then
> acquired the lock to release it via rxe_sock_put().
> 
> In a highly concurrent teardown environment, another thread could close
> and clear the pernet socket after it was fetched but before the lock
> was acquired. This causes rxe_sock_put() to operate on a dangling or
> already cleared socket pointer, leading to a NULL pointer dereference
> when kernel_sock_shutdown() attempts to access sock->sk.
> 
> Fix this by introducing a dedicated, per-netns mutex 'release_lock'
> and extending its scope. The socket pointers are now fetched, checked,
> and released entirely within the same locked critical section. This
> ensures the atomicity of the socket lookup and teardown sequence.
> 
> Reported-by: syzbot+d8f76778263ab65c2b21@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=d8f76778263ab65c2b21
> Fixes: f1327abd6abe ("RDMA/rxe: Support RDMA link creation and destruction per net namespace")
> Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
> ---
>  drivers/infiniband/sw/rxe/rxe_net.c |  4 ++++
>  drivers/infiniband/sw/rxe/rxe_ns.c  | 22 ++++++++++++++++++++++
>  drivers/infiniband/sw/rxe/rxe_ns.h  |  3 +++
>  3 files changed, 29 insertions(+)
> 
> diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
> index 50a2cb5405e2..b689ba085da4 100644
> --- a/drivers/infiniband/sw/rxe/rxe_net.c
> +++ b/drivers/infiniband/sw/rxe/rxe_net.c
> @@ -655,6 +655,8 @@ void rxe_net_del(struct ib_device *dev)
>  
>  	net = dev_net(ndev);
>  
> +	rxe_ns_lock(net);
> +
>  	sk = rxe_ns_pernet_sk4(net);
>  	if (sk)
>  		rxe_sock_put(sk, rxe_ns_pernet_set_sk4, net);
> @@ -663,6 +665,8 @@ void rxe_net_del(struct ib_device *dev)
>  	if (sk)
>  		rxe_sock_put(sk, rxe_ns_pernet_set_sk6, net);
>  
> +	rxe_ns_unlock(net);
> +
>  	dev_put(ndev);
>  }
>  
> diff --git a/drivers/infiniband/sw/rxe/rxe_ns.c b/drivers/infiniband/sw/rxe/rxe_ns.c
> index 8b9d734229b2..799a727bc1fe 100644
> --- a/drivers/infiniband/sw/rxe/rxe_ns.c
> +++ b/drivers/infiniband/sw/rxe/rxe_ns.c
> @@ -16,6 +16,7 @@
>  struct rxe_ns_sock {
>  	struct sock __rcu *rxe_sk4;
>  	struct sock __rcu *rxe_sk6;
> +	struct mutex	release_lock;

This change renders the existing rcu_read_lock() and rcu_read_unlock()
calls unnecessary.

Thanks