Re: [PATCH v2 1/1] RDMA/rxe: Fix Use-After-Free problem in rxe_net_del

[Jason Gunthorpe <jgg@nvidia.com>]

On Tue, May 19, 2026 at 04:35:41AM +0200, Zhu Yanjun wrote:

> index 50a2cb5405e2..0bf5b0eabc7b 100644
> --- a/drivers/infiniband/sw/rxe/rxe_net.c
> +++ b/drivers/infiniband/sw/rxe/rxe_net.c
> @@ -135,13 +135,21 @@ static struct dst_entry *rxe_find_route6(struct rxe_qp *qp,
>  {
>  	struct dst_entry *ndst;
>  	struct flowi6 fl6 = {};
> +	struct sock *sk;
>  
>  	fl6.flowi6_oif = ndev->ifindex;
>  	memcpy(&fl6.saddr, saddr, sizeof(*saddr));
>  	memcpy(&fl6.daddr, daddr, sizeof(*daddr));
>  	fl6.flowi6_proto = IPPROTO_UDP;
>  
> -	ndst = ip6_dst_lookup_flow(net, rxe_ns_pernet_sk6(net), &fl6, NULL);
> +	rxe_ns_lock(net);
> +	sk = rxe_ns_pernet_sk6(net);
> +	if (sk)
> +		sock_hold(sk);
> +	rxe_ns_unlock(net);
> +
> +	ndst = ip6_dst_lookup_flow(net, sk, &fl6, NULL);
> +	sock_put(sk);

Sashiko says this crashes when sk is null, which it can be.

But this really seems weird, the rxe can be in only one namespace, why
not reach the listening sks associated with the ib_dev through
qp->pd->dev and not do net lookups?

I would expect net lookups to only exist in the add/del link paths?

Jason