Re: [PATCH v2 1/1] RDMA/rxe: Fix Use-After-Free problem in rxe_net_del

[Jason Gunthorpe <jgg@nvidia.com>]

On Wed, Jun 03, 2026 at 08:43:31AM -0700, Zhu Yanjun wrote:
> 
> 在 2026/6/2 18:25, Jason Gunthorpe 写道:
> > On Tue, May 19, 2026 at 04:35:41AM +0200, Zhu Yanjun wrote:
> > 
> > > index 50a2cb5405e2..0bf5b0eabc7b 100644
> > > --- a/drivers/infiniband/sw/rxe/rxe_net.c
> > > +++ b/drivers/infiniband/sw/rxe/rxe_net.c
> > > @@ -135,13 +135,21 @@ static struct dst_entry *rxe_find_route6(struct rxe_qp *qp,
> > >   {
> > >   	struct dst_entry *ndst;
> > >   	struct flowi6 fl6 = {};
> > > +	struct sock *sk;
> > >   	fl6.flowi6_oif = ndev->ifindex;
> > >   	memcpy(&fl6.saddr, saddr, sizeof(*saddr));
> > >   	memcpy(&fl6.daddr, daddr, sizeof(*daddr));
> > >   	fl6.flowi6_proto = IPPROTO_UDP;
> > > -	ndst = ip6_dst_lookup_flow(net, rxe_ns_pernet_sk6(net), &fl6, NULL);
> > > +	rxe_ns_lock(net);
> > > +	sk = rxe_ns_pernet_sk6(net);
> > > +	if (sk)
> > > +		sock_hold(sk);
> > > +	rxe_ns_unlock(net);
> > > +
> > > +	ndst = ip6_dst_lookup_flow(net, sk, &fl6, NULL);
> > > +	sock_put(sk);
> > Sashiko says this crashes when sk is null, which it can be.
> > 
> > But this really seems weird, the rxe can be in only one namespace, why
> > not reach the listening sks associated with the ib_dev through
> > qp->pd->dev and not do net lookups?
> > 
> > I would expect net lookups to only exist in the add/del link paths?
> 
> Thanks a lot. I will send out the new patch, following your advice.

I was thinking later I don't really know what rxe did here and normal
rdma core code has multiple namespace flow. IIRC the namespace
flows from the selected GID entry and the namespace mode selects how
gid entries are created from namespaces.

So this still looks quite odd, by the time we get to RXE we should
have already locked down a source gid entry and that should be where
the sk really comes from??

Jason